Symantec™ Data Loss

Prevention Administration
Guide

Version 15.0

Last updated: 13 March 2018

Symantec Data Loss Prevention Administration Guide
Documentation version: 15.0

Legal Notice
Copyright © 2018 Symantec Corporation. All rights reserved.

Symantec, CloudSOC, Blue Coat, the Symantec Logo, the Checkmark Logo, the Blue Coat logo, and the
Shield Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S.
and other countries. Other names may be trademarks of their respective owners.

This Symantec product may contain third party software for which Symantec is required to provide attribution
to the third party (“Third Party Programs”). Some of the Third Party Programs are available under open
source or free software licenses. The License Agreement accompanying the Software does not alter any
rights or obligations you may have under those open source or free software licenses. Please see the
Third Party Legal Notice Appendix to this Documentation or TPIP ReadMe File accompanying this Symantec
product for more information on the Third Party Programs.

The product described in this document is distributed under licenses restricting its use, copying, distribution,
and decompilation/reverse engineering. No part of this document may be reproduced in any form by any
means without prior written authorization of Symantec Corporation and its licensors, if any.

THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS,
REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE
DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY
INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL
DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS
DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO
CHANGE WITHOUT NOTICE.

The Licensed Software and Documentation are deemed to be commercial computer software as defined
in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19 "Commercial Computer
Software - Restricted Rights" and DFARS 227.7202, et seq. "Commercial Computer Software and
Commercial Computer Software Documentation," as applicable, and any successor regulations, whether
delivered by Symantec as on premises or hosted services. Any use, modification, reproduction release,
performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government
shall be solely in accordance with the terms of this Agreement.
Symantec Corporation
350 Ellis Street
Mountain View, CA 94043

http://www.symantec.com
 Contents

Section 1 Getting started .............................................................. 56

Chapter 1 Introducing Symantec Data Loss Prevention ................ 57
About updates to the Symantec Data Loss Prevention Administration
Guide ................................................................................... 57
About Symantec Data Loss Prevention ............................................. 58
About the Enforce platform ............................................................. 60
About Network Monitor and Prevent ................................................. 61
About Network Discover/Cloud Storage Discover ................................ 62
About Network Protect ................................................................... 63
About Endpoint Discover ................................................................ 63
About Endpoint Prevent ................................................................. 64

Chapter 2 Getting started administering Symantec Data Loss

Prevention ...................................................................... 65

About Symantec Data Loss Prevention administration .......................... 65

About the Enforce Server administration console ................................ 66
Logging on and off the Enforce Server administration console ............... 67
About the administrator account ...................................................... 68
Performing initial setup tasks .......................................................... 68
Changing the administrator password ............................................... 69
Adding an administrator email account .............................................. 69
Editing a user profile ..................................................................... 70
Changing your password ............................................................... 72

Chapter 3 Working with languages and locales ............................... 74

About support for character sets, languages, and locales ...................... 74
Supported languages for detection ................................................... 75
Working with international characters ............................................... 77
About Symantec Data Loss Prevention language packs ....................... 78
About locales ............................................................................... 79
Using a non-English language on the Enforce Server administration
console ................................................................................ 79
Using the Language Pack Utility ...................................................... 80
 Contents 5

Section 2 Managing the Enforce Server

platform ...................................................................... 84
Chapter 4 Managing Enforce Server services and settings ........... 85
About Symantec Data Loss Prevention services ................................. 85
About starting and stopping services on Windows ............................... 86
Starting an Enforce Server on Windows ...................................... 86
Stopping an Enforce Server on Windows .................................... 86
Starting a Detection Server on Windows ..................................... 87
Stopping a Detection Server on Windows .................................... 87
Starting services on single-tier Windows installations ..................... 88
Stopping services on single-tier Windows installations ................... 88
Starting and stopping services on Linux ............................................ 89
Starting an Enforce Server on Linux ........................................... 89
Stopping an Enforce Server on Linux ......................................... 90
Starting a detection server on Linux ........................................... 90
Stopping a detection server on Linux .......................................... 90
Starting services on single-tier Linux installations .......................... 91
Stopping services on single-tier Linux installations ........................ 91

Chapter 5 Managing roles and users ................................................. 93

About role-based access control ...................................................... 93
About configuring roles and users .................................................... 94
About recommended roles for your organization ................................. 95
Roles included with solution packs ................................................... 96
Configuring roles .......................................................................... 98
Configuring user accounts ............................................................ 105
Configuring password enforcement settings ..................................... 108
Resetting the Administrator password ............................................. 109
Manage and add roles ................................................................. 110
Manage and add users ................................................................ 110
About authenticating users ........................................................... 111
Configuring user authentication ..................................................... 115
About SAML authentication .................................................... 115
Setting up authentication ........................................................ 116
Administrator Bypass URL ..................................................... 117
Set up and configure the authentication method .......................... 117
Set up the SAML authentication configuration ............................ 119
Generate or download Enforce (service providers) SAML
metadata ...................................................................... 120
 Contents 6

Configure the Enforce Server as a SAML service provider with

the IdP (Create an application in your identity provider) .......... 120
Export the IdP metadata to DLP .............................................. 120
Configuring Active Directory authentication ................................ 121
Configuring forms-based authentication .................................... 121
Configuring certificate authentication ........................................ 121
Integrating Active Directory for user authentication ............................ 121
Creating the configuration file for Active Directory
integration ..................................................................... 122
Verifying the Active Directory connection ................................... 124
About certificate authentication configuration .................................... 125
Configuring certificate authentication for the Enforce Server
administration console ..................................................... 127
Adding certificate authority (CA) certificates to the Tomcat trust
store ............................................................................ 129
Mapping Common Name (CN) values to Symantec Data Loss
Prevention user accounts ................................................. 132
About certificate revocation checks .......................................... 133
Troubleshooting certificate authentication .................................. 139
Disabling password authentication and forms-based logon ............ 139

Chapter 6 Connecting to group directories ..................................... 140

Creating connections to LDAP servers ............................................ 140
Configuring directory server connections ......................................... 141
Scheduling directory server indexing .............................................. 143

Chapter 7 Managing stored credentials .......................................... 145

About the credential store ............................................................. 145
Adding new credentials to the credential store .................................. 146
Configuring endpoint credentials .................................................... 146
Managing credentials in the credential store ..................................... 147
Managing stored credentials ......................................................... 147

Chapter 8 Managing system events and messages ...................... 149

About system events ................................................................... 149
System events reports ................................................................. 150
Working with saved system reports ................................................ 153
Server and Detectors event detail .................................................. 154
Configuring event thresholds and triggers ........................................ 155
About system event responses ...................................................... 157
Enabling a syslog server .............................................................. 159
 Contents 7

About system alerts ..................................................................... 160

Configuring the Enforce Server to send email alerts ........................... 161
Configuring system alerts ............................................................. 162
About log review ......................................................................... 164
System event codes and messages ................................................ 164

Chapter 9 Managing the Symantec Data Loss Prevention

database ........................................................................ 190
Working with Symantec Data Loss Prevention database diagnostic
tools ................................................................................... 190
Viewing tablespaces and data file allocations ................................... 191
Adjusting warning thresholds for tablespace usage in large
databases ..................................................................... 192
Generating a database report ................................................. 192
Viewing table details .................................................................... 193
Checking the database update readiness ........................................ 194
Locating the Update Readiness tool ......................................... 195
Creating the Update Readiness tool database account ................. 195
Running the Update Readiness tool for Symantec Data Loss
Prevention version 14.x ................................................... 196
Reviewing update readiness results ......................................... 197

Chapter 10 Working with Symantec Information Centric

Encryption ..................................................................... 199
About Symantec Information Centric Encryption ................................ 199
About the Symantec ICE Utility ...................................................... 201
Overview of implementing Information Centric Encryption
capabilities .......................................................................... 202
Configuring the Enforce Server to connect to the Symantec ICE
Cloud ................................................................................. 204

Chapter 11 Adding a new product module ........................................ 206

Installing a new license file ........................................................... 206
About system upgrades ............................................................... 207
 Contents 8

Section 3 Managing detection servers ................................ 208

Chapter 12 Installing and managing detection servers and
cloud detectors ............................................................ 209
About managing Symantec Data Loss Prevention servers ................... 210
Enabling Advanced Process Control ............................................... 210
Server controls ........................................................................... 211
Server configuration—basic .......................................................... 213
Network Monitor Server—basic configuration ............................. 214
Network Prevent for Email Server—basic configuration ................ 216
Network Prevent for Web Server—basic configuration ................. 219
Network Discover/Cloud Storage Discover Server and Network
Protect—basic configuration ............................................. 221
Endpoint Server—basic configuration ....................................... 222
Single Tier Monitor — basic configuration .................................. 223
Classification Server—basic configuration ................................. 232
Editing a detector ........................................................................ 233
Server and detector configuration—advanced .................................. 234
Adding a detection server ............................................................. 234
Adding a cloud detector ............................................................... 236
Removing a server ...................................................................... 237
Importing SSL certificates to Enforce or Discover servers .................... 238
About the Overview screen ........................................................... 239
Configuring the Enforce Server to use a proxy to connect to cloud
services .............................................................................. 240
Server and detector status overview ............................................... 241
Recent error and warning events list ............................................... 243
Server/Detector Detail screen ........................................................ 243
Advanced server settings ............................................................. 245
Advanced detector settings ........................................................... 286
About using load balancers in an endpoint deployment ....................... 291

Chapter 13 Managing log files ............................................................. 293

About log files ............................................................................ 293
Operational log files .............................................................. 294
Debug log files ..................................................................... 297
Log collection and configuration screen ........................................... 301
Configuring server logging behavior ............................................... 301
Collecting server logs and configuration files .................................... 306
About log event codes ................................................................. 309
 Contents 9

Network Prevent for Web operational log files and event

codes ........................................................................... 310
Network Prevent for Web access log files and fields .................... 311
Network Prevent for Web protocol debug log files ....................... 313
Network Prevent for Email log levels ........................................ 314
Network Prevent for Email operational log codes ........................ 314
Network Prevent for Email originated responses and codes .......... 318

Chapter 14 Using Symantec Data Loss Prevention utilities .......... 321

About Symantec Data Loss Prevention utilities ................................. 321
About Endpoint utilities ................................................................ 322
About DBPasswordChanger ......................................................... 323
DBPasswordChanger syntax .................................................. 323
Example of using DBPasswordChanger .................................... 324

Section 4 Authoring policies ..................................................... 325

Chapter 15 Introduction to policies .................................................... 327
About Data Loss Prevention policies ............................................... 327
Policy components ...................................................................... 329
Policy templates ......................................................................... 330
Solution packs ........................................................................... 331
Policy groups ............................................................................. 331
Policy deployment ....................................................................... 332
Policy severity ............................................................................ 333
Policy authoring privileges ............................................................ 334
Data Profiles .............................................................................. 334
User Groups .............................................................................. 335
Policy template import and export .................................................. 336
Workflow for implementing policies ................................................. 337
Viewing, printing, and downloading policy details ............................... 338

Chapter 16 Overview of policy detection ........................................... 340

Detecting data loss ..................................................................... 340
Content that can be detected .................................................. 341
Files that can be detected ...................................................... 341
Protocols that can be monitored .............................................. 341
Endpoint events that can be detected ....................................... 342
Identities that can be detected ................................................. 342
Languages that can be detected .............................................. 342
 Contents 10

Detecting Symantec Information Centric Tagging (ICT) classifications

......................................................................................... 342
About Symantec Information Centric Tagging ............................. 343
About integrating Information Centric Tagging with Data Loss
Prevention .................................................................... 343
Integrating Symantec Information Centric Tagging with Data Loss
Prevention .................................................................... 344
Best practices for the ICT-DLP integration ................................. 346
Troubleshooting the ICT-DLP integration ................................... 347
Data Loss Prevention policy detection technologies ........................... 347
Policy matching conditions ............................................................ 349
Content matching conditions ................................................... 350
File property matching conditions ............................................. 351
Protocol matching condition for network .................................... 352
Endpoint matching conditions ................................................. 352
Groups (identity) matching conditions ....................................... 353
Detection messages and message components ................................ 354
Exception conditions ................................................................... 355
Compound conditions .................................................................. 356
Policy detection execution ............................................................ 357
Two-tier detection for DLP Agents .................................................. 358

Chapter 17 Creating policies from templates ................................... 360

Creating a policy from a template ................................................... 360
US Regulatory Enforcement policy templates ................................... 363
General Data Protection Regulation policy templates ......................... 365
International Regulatory Enforcement policy templates ....................... 366
Customer and Employee Data Protection policy templates .................. 366
Confidential or Classified Data Protection policy templates .................. 368
Network Security Enforcement policy templates ................................ 369
Acceptable Use Enforcement policy templates .................................. 369
Columbia Personal Data Regulatory Enforcement policy template ........ 371
Choosing an Exact Data Profile ..................................................... 371
Choosing an Indexed Document Profile ........................................... 373

Chapter 18 Configuring policies .......................................................... 375

Adding a new policy or policy template ............................................ 375
Configuring policies ..................................................................... 376
Adding a rule to a policy ............................................................... 378
Configuring policy rules ................................................................ 380
Defining rule severity ................................................................... 383
Configuring match counting .......................................................... 384
 Contents 11

Selecting components to match on ................................................. 386

Adding an exception to a policy ..................................................... 387
Configuring policy exceptions ........................................................ 389
Configuring compound match conditions ......................................... 392
Input character limits for policy configuration .................................... 393

Chapter 19 Administering policies ...................................................... 395

Manage and add policies ............................................................. 395
Manage and add policy groups ...................................................... 398
Creating and modifying policy groups ............................................. 399
Importing policies ........................................................................ 400
About importing policies ......................................................... 400
About policy references ......................................................... 401
Exporting policies ....................................................................... 402
About policy export ............................................................... 402
Cloning policies .......................................................................... 403
Importing policy templates ............................................................ 404
Exporting policy detection as a template .......................................... 405
Adding an automated response rule to a policy ................................. 405
Removing policies and policy groups .............................................. 406
Viewing and printing policy details .................................................. 407
Downloading policy details ........................................................... 407
Troubleshooting policies ............................................................... 408
Updating EDM and IDM profiles to the latest version .......................... 409
Updating policies after upgrading to the latest version ........................ 410

Chapter 20 Best practices for authoring policies ............................ 412

Best practices for authoring policies ................................................ 412
Develop a policy strategy that supports your data security
objectives ........................................................................... 414
Use a limited number of policies to get started .................................. 414
Use policy templates but modify them to meet your requirements ......... 415
Use the appropriate match condition for your data loss prevention
objectives ........................................................................... 415
Test and tune policies to improve match accuracy ............................. 416
Start with high match thresholds to reduce false positives ................... 417
Use a limited number of exceptions to narrow detection scope ............. 418
Use compound conditions to improve match accuracy ........................ 418
Author policies to limit the potential effect of two-tier detection ............. 419
Use policy groups to manage policy lifecycle .................................... 420
Follow detection-specific best practices ........................................... 420
 Contents 12

Chapter 21 Detecting content using Exact Data Matching

(EDM) ............................................................................. 422

Introducing Exact Data Matching (EDM) .......................................... 422

About using EDM to protect content ......................................... 423
EDM policy features .............................................................. 424
EDM policy templates ............................................................ 425
About the Exact Data Profile and index ..................................... 426
About the exact data source file ............................................... 426
About cleansing the exact data source file ................................. 427
About using System Fields for data source validation ................... 428
About index scheduling .......................................................... 429
About the Content Matches Exact Data From condition ................ 429
About Data Owner Exception .................................................. 429
About profiled Directory Group Matching (DGM) ......................... 430
About two-tier detection for EDM on the endpoint ........................ 431
About upgrading EDM deployments ......................................... 431
Configuring Exact Data profiles ...................................................... 431
Creating the exact data source file for EDM ............................... 433
Creating the exact data source file for Data Owner
Exception ..................................................................... 434
Creating the exact data source file for profiled DGM .................... 434
Preparing the exact data source file for indexing ......................... 435
Uploading exact data source files to the Enforce Server ............... 436
Creating and modifying Exact Data Profiles ............................... 438
Mapping Exact Data Profile fields ............................................ 442
Using system-provided pattern validators for EDM profiles ............ 444
Scheduling Exact Data Profile indexing ..................................... 445
Managing and adding Exact Data Profiles ................................. 447
Configuring EDM policies ............................................................. 448
Configuring the Content Matches Exact Data policy
condition ....................................................................... 448
Configuring Data Owner Exception for EDM policy
conditions ..................................................................... 451
Configuring the Sender/User based on a Profiled Directory policy
condition ....................................................................... 451
Configuring the Recipient based on a Profiled Directory policy
condition ....................................................................... 452
About configuring natural language processing for Chinese,
Japanese, and Korean for EDM policies .............................. 453
Configuring Advanced Server Settings for EDM policies ............... 454
Using multi-token matching ........................................................... 457
Characteristics of multi-token cells ........................................... 457
 Contents 13

Multi-token with spaces ......................................................... 458

Multi-token with stopwords ..................................................... 459
Multi-token with mixed language characters ............................... 459
Multi-token with punctuation ................................................... 460
Additional examples for multi-token cells with punctuation ............. 461
Some special use cases for system-recognized data
patterns ........................................................................ 463
Multi-token punctuation characters ........................................... 465
Match count variant examples ................................................. 466
Proximity matching example ................................................... 468
Updating EDM indexes to the latest version ..................................... 470
Update process using the Remote EDM Indexer ......................... 470
Update process using the Enforce Server .................................. 472
EDM index out-of-date error codes ........................................... 474
Memory requirements for EDM ...................................................... 475
About memory requirements for EDM ....................................... 475
Overview of configuring memory and indexing the data
source .......................................................................... 476
Determining requirements for both local and remote
indexers ....................................................................... 476
Increasing the memory for the Enforce Server EDM indexer .......... 478
Increasing the memory for the Remote EDM indexer ................... 478
Detection server memory requirements ..................................... 479
Increasing the memory for the detection server (File
Reader) ........................................................................ 482
Using the EDM Memory Requirements Spreadsheet ................... 483
Remote EDM indexing ................................................................. 483
About the Remote EDM Indexer .............................................. 484
About the SQL Preindexer ...................................................... 484
System requirements for remote EDM indexing .......................... 485
Workflow for remote EDM indexing .......................................... 485
About installing and running the Remote EDM Indexer and SQL
Preindexer utilities .......................................................... 486
Creating an EDM profile template for remote indexing .................. 487
Downloading and copying the EDM profile file to a remote
system ......................................................................... 490
Generating remote index files ................................................. 490
Remote indexing examples using data source file ....................... 491
Remote indexing examples using SQL Preindexer ...................... 492
Copying and loading remote index files to the Enforce
Server .......................................................................... 493
SQL Preindexer command options ........................................... 494
Remote EDM Indexer command options ................................... 496
 Contents 14

Troubleshooting preindexing errors .......................................... 497

Troubleshooting remote indexing errors .................................... 498
Installing the Remote EDM Indexer (Windows) ........................... 499
Installing the Remote EDM Indexer (Linux) ................................ 500
Best practices for using EDM ........................................................ 501
Ensure data source has at least one column of unique data .......... 503
Cleanse the data source file of blank columns and duplicate
rows ............................................................................ 504
Remove ambiguous character types from the data source
file ............................................................................... 504
Understand how multi-token cell matching functions .................... 505
Do not use the comma delimiter if the data source has number
fields ............................................................................ 505
Map data source column to system fields to leverage
validation ...................................................................... 506
Ensure that the data source is clean for indexing ........................ 506
Leverage EDM policy templates when possible .......................... 507
Include column headers as the first row of the data source
file ............................................................................... 507
Check the system alerts to tune profile accuracy ......................... 507
Use stopwords to exclude common words from detection ............. 507
Use scheduled indexing to automate profile updates .................... 508
Match on 3 columns in an EDM condition to increase detection
accuracy ....................................................................... 509
Leverage exception tuples to avoid false positives ....................... 510
Use a WHERE clause to detect records that meet specific
criteria .......................................................................... 510
Use the minimum matches field to fine tune EDM rules ................ 510
Combine Data Identifiers with EDM rules to limit the impact of
two-tier detection ............................................................ 510
Include an email address field in the Exact Data Profile for profiled
DGM ............................................................................ 511
Use profiled DGM for Network Prevent for Web identity
detection ...................................................................... 511

Chapter 22 Detecting content using Indexed Document

Matching (IDM) ............................................................ 512
Introducing Indexed Document Matching (IDM) ................................. 512
About using IDM .................................................................. 513
Supported forms of matching for IDM ....................................... 513
Types of IDM detection .......................................................... 514
About the Indexed Document Profile ........................................ 515
 Contents 15

About the document data source ............................................. 516

About the indexing process .................................................... 516
About indexing remote documents ........................................... 517
About the server index files and the agent index files ................... 518
About index deployment and logging ........................................ 519
Using IDM to detect exact files ................................................ 520
Using IDM to detect exact and partial file contents ....................... 521
About using the Content Matches Document Signature policy
condition ....................................................................... 523
About white listing partial file contents ....................................... 524
Configuring IDM profiles and policy conditions .................................. 525
Preparing the document data source for indexing ........................ 525
White listing file contents to exclude from partial matching ............ 527
Manage and add Indexed Document Profiles ............................. 528
Creating and modifying Indexed Document Profiles ..................... 529
Configure endpoint partial content matching ............................... 531
Uploading a document archive to the Enforce Server ................... 532
Referencing a document archive on the Enforce Server ............... 533
Using local path on Enforce Server .......................................... 535
Using the remote SMB share option to index file shares ............... 536
Using the remote SMB share option to index SharePoint
documents .................................................................... 536
Filtering documents by file name ............................................. 539
Filtering documents by file size ................................................ 541
Scheduling document profile indexing ....................................... 542
Changing the default indexer properties .................................... 543
Enabling Agent IDM .............................................................. 544
Estimating endpoint memory use for agent IDM .......................... 545
Configuring the Content Matches Document Signature policy
condition ....................................................................... 545
Best practices for using IDM ......................................................... 547
Reindex IDM profiles after major upgrade .................................. 548
Do not compress files in the document source ............................ 548
Do not index empty documents ............................................... 548
Prefer partial matching over exact matching on the DLP
Agent ........................................................................... 549
Understand limitations of exact matching ................................... 549
Use white listing to exclude non-sensitive content from partial
matching ...................................................................... 550
Filter documents from indexing to reduce false positives ............... 551
Distinguish IDM exceptions from white listing and filtering ............. 551
Create separate profiles to index large document sources ............ 552
 Contents 16

Use WebDAV or CIFS to index remote document data

sources ........................................................................ 552
Use scheduled indexing to keep profiles up to date ..................... 552
Use parallel IDM rules to tune match thresholds ......................... 553
Remote IDM indexing .................................................................. 554
About the Remote IDM Indexer ............................................... 554
Installing the Remote IDM Indexer ........................................... 555
Indexing the document data source using the properties file .......... 556
Indexing the document data source using the CLI ....................... 558
Scheduling remote indexing .................................................... 559
Incremental indexing ............................................................. 561
Logging and troubleshooting ................................................... 562
Copying the preindex file to the Enforce Server host .................... 562
Loading the remote index file into the Enforce Server ................... 562

Chapter 23 Detecting content using Vector Machine Learning

(VML) .............................................................................. 564
Introducing Vector Machine Learning (VML) ..................................... 564
About the Vector Machine Learning Profile ................................ 565
About the content you train ..................................................... 565
About the base accuracy from training percentage rates ............... 566
About the Similarity Threshold and Similarity Score ..................... 567
About using unaccepted VML profiles in policies ......................... 567
Configuring VML profiles and policy conditions ................................. 568
Creating new VML profiles ..................................................... 569
Working with the Current Profile and Temporary Workspace
tabs ............................................................................. 570
Uploading example documents for training ................................ 571
Training VML profiles ............................................................ 572
Adjusting the memory allocation .............................................. 575
Managing training set documents ............................................ 576
Managing VML profiles .......................................................... 577
Changing names and descriptions for VML profiles ..................... 579
Configuring the Detect using Vector Machine Learning Profile
condition ....................................................................... 579
Configuring VML policy exceptions ........................................... 580
Adjusting the Similarity Threshold ............................................ 581
Testing and tuning VML profiles ............................................... 582
Properties for configuring training ............................................ 583
Log files for troubleshooting VML training and policy
detection ...................................................................... 586
Best practices for using VML ......................................................... 587
 Contents 17

When to use VML ................................................................. 588

When not to use VML ............................................................ 589
Recommendations for training set definition ............................... 589
Guidelines for training set sizing .............................................. 590
Recommendations for uploading documents for training ............... 591
Guidelines for profile sizing ..................................................... 591
Recommendations for accepting or rejecting a profile .................. 592
Guidelines for accepting or rejecting training results .................... 593
Recommendations for deploying profiles ................................... 594

Chapter 24 Detecting content using Form Recognition -

Sensitive Image Recognition ..................................... 595
About Form Recognition detection .................................................. 595
How Form Recognition works ................................................. 596
Configuring Form Recognition detection .......................................... 596
Preparing a Form Recognition Gallery Archive ........................... 597
Configuring a Form Recognition profile ..................................... 598
Configuring the Form Recognition detection rule ......................... 599
Configuring the Form Recognition exception rule ........................ 600
Managing Form Recognition profiles ............................................... 600
Advanced server settings for Form Recognition ................................ 602
Viewing a Form Recognition incident .............................................. 603

Chapter 25 Detecting Content using OCR - Sensitive Image

Recognition ................................................................... 604
About content detection with OCR Sensitive Image Recognition ........... 604
Detection types supported for OCR extraction ............................ 605
File types supported for OCR extraction .................................... 605
OCR Server system requirements .................................................. 606
Using the OCR Server Sizing Estimator spreadsheet ......................... 606
Setting up OCR Servers ............................................................... 606
Installing an OCR Sensitive Image Recognition license ...................... 607
Creating an OCR configuration ...................................................... 607
Using the OCR engine ................................................................. 609
More about languages and Dictionaries ........................................... 609
Specialized Dictionaries available for OCR content
extraction ...................................................................... 610
Languages supported for OCR extraction .................................. 610
Viewing OCR incidents in reports ................................................... 611
 Contents 18

Chapter 26 Detecting content using data identifiers ...................... 612

Introducing data identifiers ............................................................ 612
System-defined data identifiers ............................................... 613
Extending and customizing data identifiers ................................ 621
About data identifier configuration ............................................ 622
About data identifier breadths ................................................. 622
About optional validators for data identifiers ............................... 623
About data identifier patterns .................................................. 623
About pattern validators ......................................................... 624
About data normalizers .......................................................... 624
About cross-component matching ............................................ 624
About unique match counting .................................................. 625
Configuring data identifier policy conditions ...................................... 625
Workflow for configuring data identifier policies ........................... 625
Managing and adding data identifiers ....................................... 626
Editing data identifiers ........................................................... 626
Configuring the Content Matches data identifier condition ............. 628
Using data identifier breadths .................................................. 629
Selecting a data identifier breadth ............................................ 629
Using optional validators ........................................................ 643
Configuring optional validators ................................................ 644
Acceptable characters for optional validators .............................. 645
Using unique match counting .................................................. 647
Configuring unique match counting .......................................... 648
Modifying system data identifiers ................................................... 648
Cloning a system data identifier before modifying it ..................... 649
Editing pattern validator input .................................................. 650
List of pattern validators that accept input data ........................... 650
Editing keywords for international PII data identifiers .................... 651
List of keywords for international system data identifiers ............... 652
Updating policies to use the Randomized US SSN data
identifier ....................................................................... 665
Creating custom data identifiers ..................................................... 666
Workflow for creating custom data identifiers .............................. 666
Custom data identifier configuration ......................................... 668
Using the data identifier pattern language .................................. 669
Writing data identifier patterns to match data .............................. 671
Using pattern validators ......................................................... 672
Selecting pattern validators .................................................... 679
Selecting a data normalizer .................................................... 680
Creating custom script validators ............................................. 680
Best practices for using data identifiers ........................................... 681
 Contents 19

Use data identifiers instead of regular expressions to improve

accuracy ....................................................................... 682
Clone system-defined data identifiers before modifying to preserve
original state .................................................................. 682
Modify data identifier definitions when you want tuning to apply
globally ........................................................................ 683
Consider using multiple breadths in parallel to detect different
severities of confidential data ............................................ 683
Avoid matching on the Envelope over HTTP to reduce false
positives ....................................................................... 684
Use the Randomized US SSN data identifier to detect SSNs ......... 684
Use unique match counting to improve accuracy and ease
remediation ................................................................... 685

Chapter 27 Detecting content using keyword matching ................ 686

Introducing keyword matching ....................................................... 686
About keyword matching for Chinese, Japanese, and Korean
(CJK) languages ............................................................ 687
About keyword proximity ........................................................ 688
Keyword matching syntax ...................................................... 688
Keyword matching examples .................................................. 689
Keyword matching examples for CJK languages ......................... 690
About updates to the Drug, Disease, and Treatment keyword
lists ............................................................................. 691
Configuring keyword matching ...................................................... 692
Configuring the Content Matches Keyword condition ................... 692
Enabling and using CJK token verification for server keyword
matching ...................................................................... 695
Updating the Drug, Disease, and Treatment keyword lists for your
HIPAA and Caldicott policies ............................................. 696
Best practices for using keyword matching ....................................... 697
Enable token verification on the server to reduce false positives
for CJK keyword detection ................................................ 698
Keep the keyword lists for your HIPAA and Caldicott policies up
to date ......................................................................... 698
Tune keywords lists for data identifiers to improve match
accuracy ....................................................................... 699
Use keyword matching to detect document metadata ................... 699
Use VML to generate and maintain large keyword
dictionaries ................................................................... 699
 Contents 20

Chapter 28 Detecting content using regular expressions .............. 700

Introducing regular expression matching ......................................... 700
About the updated regular expression engine ................................... 701
About writing regular expressions ................................................... 701
Configuring the Content Matches Regular Expression condition ........... 702
Best practices for using regular expression matching ......................... 703
When to use regular expression matching ................................. 704
Use look ahead and look behind characters to improve regular
expression accuracy ....................................................... 704
Use regular expressions sparingly to support efficient
performance .................................................................. 705
Test regular expressions before deployment to improve
accuracy ....................................................................... 705

Chapter 29 Detecting international language content ................... 706

Detecting non-English language content .......................................... 706
Best practices for detecting non-English language content .................. 707
Upgrade to the latest version of Data Loss Prevention ................. 707
Use international policy templates for policy creation ................... 707
Use custom keywords for system data identifiers ........................ 708
Enable token validation to match Chinese, Japanese, and Korean
keywords on the server .................................................... 710

Chapter 30 Detecting file properties .................................................. 711

Introducing file property detection ................................................... 711
About file type matching ......................................................... 711
About file format support for file type matching ........................... 712
About custom file type identification .......................................... 712
About file size matching ......................................................... 713
About file name matching ....................................................... 714
Configuring file property matching .................................................. 714
Configuring the Message Attachment or File Type Match
condition ....................................................................... 715
Configuring the Message Attachment or File Size Match
condition ....................................................................... 716
Configuring the Message Attachment or File Name Match
condition ....................................................................... 717
File name matching syntax ..................................................... 718
File name matching examples ................................................. 718
Enabling the Custom File Type Signature condition in the policy
console ........................................................................ 719
 Contents 21

Configuring the Custom File Type Signature condition .................. 719

Best practices for using file property matching .................................. 720
Use compound file property rules to protect design and multimedia
files ............................................................................. 720
Do not use file type matching to detect content ........................... 721
Calculate file size properly to improve match accuracy ................. 721
Use expression patterns to match file names ............................. 721
Use scripts and plugins to detect custom file types ...................... 721

Chapter 31 Detecting network incidents ........................................... 723

Introducing protocol monitoring for network ...................................... 723
Configuring the Protocol Monitoring condition for network
detection ............................................................................. 724
Best practices for using network protocol matching ............................ 725
Use separate policies for specific protocols ................................ 725
Consider detection server network placement to support IP
address matching ........................................................... 726

Chapter 32 Detecting endpoint events .............................................. 727

Introducing endpoint event detection .............................................. 727
About endpoint protocol monitoring .......................................... 727
About endpoint destination monitoring ...................................... 728
About endpoint application monitoring ...................................... 728
About endpoint location detection ............................................ 729
About endpoint device detection .............................................. 729
Configuring endpoint event detection conditions ................................ 729
Configuring the Endpoint Monitoring condition ............................ 730
Configuring the Endpoint Location condition ............................... 732
Configuring the Endpoint Device Class or ID condition ................. 733
Gathering endpoint device IDs for removable devices .................. 733
Creating and modifying endpoint device configurations ................ 734
Best practices for using endpoint detection ...................................... 736

Chapter 33 Detecting described identities ........................................ 737

Introducing described identity matching ........................................... 737
Described identity matching examples ............................................ 737
Configuring described identity matching policy conditions .................... 738
About Reusable Sender/Recipient Patterns ............................... 739
Configuring the Sender/User Matches Pattern condition ............... 739
Configuring a Reusable Sender Pattern .................................... 741
Configuring the Recipient Matches Pattern condition ................... 742
 Contents 22

Configuring a Reusable Recipient Pattern ................................. 743

Best practices for using described identity matching ........................... 744
Define precise identity patterns to match users ........................... 744
Specify email addresses exactly to improve accuracy .................. 745
Match domains instead of IP addresses to improve
accuracy ....................................................................... 745

Chapter 34 Detecting synchronized identities ................................. 747

Introducing synchronized Directory Group Matching (DGM) ................. 747
About two-tier detection for synchronized DGM ................................. 748
Configuring User Groups .............................................................. 748
Configuring synchronized DGM policy conditions .............................. 750
Configuring the Sender/User based on a Directory Server Group
condition ....................................................................... 751
Configuring the Recipient based on a Directory Server Group
condition ....................................................................... 752
Best practices for using synchronized DGM ..................................... 753
Refresh the directory on initial save of the User Group ................. 753
Distinguish synchronized DGM from other types endpoint
detection ...................................................................... 753

Chapter 35 Detecting profiled identities ........................................... 754

Introducing profiled Directory Group Matching (DGM) ......................... 754
About two-tier detection for profiled DGM ......................................... 754
Configuring Exact Data profiles for DGM ......................................... 755
Configuring profiled DGM policy conditions ...................................... 756
Configuring the Sender/User based on a Profiled Directory
condition ....................................................................... 756
Configuring the Recipient based on a Profiled Directory
condition ....................................................................... 757
Best practices for using profiled DGM ............................................. 758
Follow EDM best practices when implementing profiled
DGM ............................................................................ 758
Include an email address field in the Exact Data Profile for profiled
DGM ............................................................................ 758
Use profiled DGM for Network Prevent for Web identity
detection ...................................................................... 758

Chapter 36 Supported file formats for detection ............................ 759

Overview of detection file format support ......................................... 759
Supported formats for file type identification ..................................... 761
 Contents 23

Supported formats for content extraction ......................................... 777

Supported word-processing formats for content extraction ............ 777
Supported presentation formats for content extraction .................. 779
Supported spreadsheet formats for content extraction .................. 780
Supported text and markup formats for content extraction ............. 781
Supported email formats for content extraction ........................... 782
Supported CAD formats for content extraction ............................ 782
Supported graphics formats for content extraction ....................... 783
Supported database formats for content extraction ...................... 783
Other file formats supported for content extraction ....................... 783
Supported encapsulation formats for subfile extraction ....................... 784
Supported file formats for metadata extraction .................................. 786
About document metadata detection ........................................ 786
Enabling server metadata detection ......................................... 787
Enabling endpoint metadata detection ...................................... 787
Best practices for using metadata detection ............................... 788

Chapter 37 Library of system data identifiers .................................. 793

Library of system data identifiers .................................................... 798
ABA Routing Number .................................................................. 798
ABA Routing Number wide breadth .......................................... 799
ABA Routing Number medium breadth ..................................... 799
ABA Routing Number narrow breadth ....................................... 800
Argentina Tax Identification Number ............................................... 801
Argentina Tax Identification Number wide breadth ....................... 801
Argentina Tax Identification Number medium breadth ................... 802
Argentina Tax Identification Number narrow breadth .................... 802
Australian Business Number ......................................................... 803
Australian Business Number wide breadth ................................. 804
Australian Business Number medium breadth ............................ 804
Australian Business Number narrow breadth .............................. 804
Australian Company Number ........................................................ 805
Australian Company Number wide breadth ................................ 806
Australian Company Number medium breadth ............................ 806
Australian Company Number narrow breadth ............................. 806
Australian Medicare Number ......................................................... 807
Australian Medicare Number wide breadth ................................. 807
Australian Medicare Number medium breadth ............................ 808
Australian Medicare Number narrow breadth .............................. 809
Australian Passport Number ......................................................... 810
Australian Passport Number wide breadth ................................. 810
Australian Passport Number narrow breadth .............................. 811
 Contents 24

Australian Tax File Number ........................................................... 812

Australian Tax File Number wide breadth ................................... 812
Australian Tax File Number narrow breadth ................................ 812
Austria Passport Number ............................................................. 813
Austria Passport Number wide breadth ..................................... 813
Austria Passport Number narrow breadth .................................. 814
Austria Tax Identification Number ................................................... 814
Austria Tax Identification Number wide breadth ........................... 815
Austria Tax Identification Number narrow breadth ........................ 815
Austrian Social Security Number .................................................... 816
Austrian Social Security Number wide breadth ........................... 816
Austrian Social Security Number medium breadth ....................... 817
Austrian Social Security Number narrow breadth ........................ 817
Belgian National Number .............................................................. 818
Belgian National Number wide breadth .................................... 818
Belgian National Number medium breadth ................................. 819
Belgian National Number narrow breadth .................................. 819
Belgium Driver's License Number .................................................. 820
Belgium Driver's License Number wide breadth .......................... 821
Belgium Driver's License Number narrow breadth ....................... 821
Belgium Passport Number ............................................................ 822
Belgium Passport Number wide breadth .................................... 822
Belgium Passport Number narrow breadth ................................. 823
Belgium Tax Identification Number ................................................. 823
Belgium Tax Identification Number wide breadth ......................... 824
Belgium Tax Identification Number narrow breadth ...................... 824
Belgium Value Added Tax (VAT) Number ......................................... 825
Belgium Value Added Tax (VAT) Number wide breadth ................. 826
Belgium Value Added Tax (VAT) Number medium breadth ............ 826
Belgium Value Added Tax (VAT) Number narrow breadth .............. 827
Brazilian Bank Account Number ..................................................... 827
Brazilian Bank Account Number wide breadth ............................ 828
Brazilian Bank Account Number medium breadth ........................ 828
Brazilian Bank Account Number narrow breadth ......................... 829
Brazilian Election Identification Number ........................................... 830
Brazilian Election Identification Number wide breadth .................. 830
Brazilian Election Identification Number medium breadth .............. 831
Brazilian Election Identification Number narrow breadth ............... 832
Brazilian National Registry of Legal Entities Number .......................... 833
Brazilian National Registry of Legal Entities Number wide
breadth ........................................................................ 834
Brazilian National Registry of Legal Entities Number medium
breadth ........................................................................ 834
 Contents 25

Brazilian National Registry of Legal Entities Number narrow

breadth ........................................................................ 835
Brazilian Natural Person Registry Number (CPF) .............................. 836
Brazilian Natural Person Registry Number wide breadth ............... 836
Brazilian Natural Person Registry Number medium breadth .......... 836
Brazilian Natural Person Registry Number narrow breadth ........... 837
British Columbia Personal Healthcare Number .................................. 838
British Columbia Personal Healthcare Number wide breadth ....
8 3 8
British Columbia Personal Healthcare Number medium
breadth ........................................................................ 839
British Columbia Personal Healthcare Number narrow
breadth ........................................................................ 839
Bulgarian Uniform Civil Number - EGN ............................................ 840
Bulgarian Uniform Civil Number - EGN wide breadth ................... 840
Bulgarian Uniform Civil Number - EGN medium breadth ............... 841
Bulgarian Uniform Civil Number - EGN narrow breadth ................ 841
Burgerservicenummer ................................................................. 842
Burgerservicenummer wide breadth ......................................... 843
Burgerservicenummer narrow breadth ...................................... 843
Canadian Social Insurance Number ............................................... 844
Canadian Social Insurance Number wide breadth ....................... 844
Canadian Social Insurance Number medium breadth ................... 845
Canadian Social Insurance Number narrow breadth .................... 845
Chilean National Identification Number ............................................ 846
Chilean National Identification Number wide breadth ................... 847
Chilean National Identification Number medium breadth ............... 847
Chilean National Identification Number narrow breadth ................ 848
China Passport Number ............................................................... 849
China Passport Number wide breadth ....................................... 849
China Passport Number narrow breadth .................................... 849
Codice Fiscale ........................................................................... 850
Codice Fiscale wide breadth ................................................... 850
Codice Fiscale narrow breadth ................................................ 851
Colombian Addresses ................................................................. 851
Colombian Addresses wide breadth ......................................... 852
Colombian Addresses narrow breadth ...................................... 853
Colombian Cell Phone Number ...................................................... 854
Colombian Cell Phone Number wide breadth ............................. 855
Colombian Cell Phone Number narrow breadth .......................... 856
Colombian Personal Identification Number ....................................... 857
Colombian Personal Identification Number wide breadth .............. 857
Colombian Personal Identification Number narrow breadth ........... 858
 Contents 26

Colombian Tax Identification Number .............................................. 859

Colombian Tax Identification Number wide breadth ...................... 859
Colombian Tax Identification Number narrow breadth ................... 860
Credit Card Magnetic Stripe Data ................................................... 861
Credit Card Number ................................................................... 863
Credit Card Number wide breadth ............................................ 863
Credit Card Number medium breadth ....................................... 864
Credit Card Number narrow breadth ......................................... 867
CUSIP Number ......................................................................... 872
CUSIP Number wide breadth .................................................. 872
CUSIP Number medium breadth ............................................. 873
CUSIP Number narrow breadth ............................................... 873
Czech Personal Identification Number ............................................. 874
Czech Personal Identification Number wide breadth .................... 874
Czech Personal Identification Number medium breadth ................ 875
Czech Personal Identification Number narrow breadth ................. 876
Denmark Personal Identification Number ......................................... 877
Denmark Personal Identification Number wide breadth ................. 877
Denmark Personal Identification Number medium breadth ............ 878
Denmark Personal Identification Number narrow breadth .............. 878
Drivers License Number – CA State ............................................... 879
Drivers License Number – CA State wide breadth ....................... 880
Drivers License Number – CA State medium breadth ................... 880
Drivers License Number - FL, MI, MN States ................................... 881
Drivers License Number- FL, MI, MN States wide breadth ............ 881
Drivers License Number- FL, MI, MN States medium
breadth ........................................................................ 881
Drivers License Number - IL State .................................................. 882
Drivers License Number- IL State wide breadth .......................... 882
Drivers License Number- IL State medium breadth ...................... 883
Drivers License Number - NJ State ................................................. 883
Drivers License Number- NJ State wide breadth ......................... 884
Drivers License Number- NJ State medium breadth ..................... 884
Drivers License Number - NY State ................................................ 885
Drivers License Number- NY State wide breadth ......................... 885
Drivers License Number - NY State medium breadth ................... 886
Driver's License Number - WA State ............................................... 886
Driver's License Number - WA State wide breadth ....................... 887
Driver's License Number - WA State medium breadth .................. 887
Driver's License Number - WA State narrow breadth .................... 888
Driver's License Number - WI State ................................................ 888
Driver's License Number - WI State wide breadth ........................ 889
Driver's License Number - WI State medium breadth ................... 889
 Contents 27

Driver's License Number - WI State narrow breadth ..................... 890

Drug Enforcement Agency (DEA) Number ....................................... 891
Drug Enforcement Agency (DEA) Number wide breadth ............... 891
Drug Enforcement Agency (DEA) Number medium breadth .......... 892
Drug Enforcement Agency (DEA) Number narrow breadth ............ 892
Finnish Personal Identification Number ........................................... 893
Finnish Personal Identification Number wide breadth ................... 893
Finnish Personal Identification Number medium breadth ............... 894
Finnish Personal Identification Number narrow breadth ................ 894
France Driver's License Number .................................................... 895
France Driver's License Number wide breadth ............................ 895
France Driver's License Number narrow breadth ......................... 896
France Health Insurance Number ................................................... 896
France Health Insurance Number wide breadth .......................... 897
France Health Insurance Number narrow breadth ....................... 897
France Tax Identification Number ................................................... 898
France Tax Identification Number wide breadth ........................... 898
France Tax Identification Number narrow breadth ........................ 899
France Value Added Tax (VAT) Number ........................................... 899
France Value Added Tax (VAT) Number wide breadth .................. 900
France Value Added Tax (VAT) Number medium breadth .............. 900
France Value Added Tax (VAT) Number narrow breadth ............... 901
French INSEE Code .................................................................... 902
French INSEE Code wide breadth ........................................... 902
French INSEE Code narrow breadth ........................................ 903
French Passport Number ............................................................. 903
French Passport Number wide breadth ..................................... 904
French Passport Number narrow breadth .................................. 904
French Social Security Number ..................................................... 905
French Social Security Number wide breadth ............................. 905
French Social Security Number medium breadth ......................... 906
French Social Security Number narrow breadth .......................... 906
German Passport Number ............................................................ 907
German Passport Number wide breadth .................................... 907
German Passport Number medium breadth ............................... 907
German Passport Number narrow breadth ................................. 908
German Personal ID Number ........................................................ 909
German Personal ID Number wide breadth ................................ 909
German Personal ID Number medium breadth ........................... 909
German Personal ID Number narrow breadth ............................. 910
Germany Driver's License Number ................................................. 910
Germany Driver's License Number wide breadth ......................... 911
Germany Driver's License Number narrow breadth ...................... 911
 Contents 28

Germany Value Added Tax (VAT) Number ........................................ 912

Germany Value Added Tax (VAT) Number wide breadth ............... 912
Germany Value Added Tax (VAT) Number medium breadth ........... 913
Germany Value Added Tax (VAT) Number narrow breadth ............ 913
Greek Tax Identification Number .................................................... 914
Greek Tax Identification Number wide breadth ............................ 915
Greek Tax Identification Number medium breadth ....................... 915
Greek Tax Identification Number narrow breadth ......................... 915
Hong Kong ID ............................................................................ 916
Hong Kong ID wide breadth .................................................... 916
Hong Kong ID narrow breadth ................................................. 917
Hungarian Social Security Number ................................................. 918
Hungarian Social Security Number wide breadth ......................... 918
Hungarian Social Security Number medium breadth .................... 919
Hungarian Social Security Number narrow breadth ...................... 919
Hungarian Tax Identification Number .............................................. 920
Hungarian Tax Identification Number wide breadth ...................... 920
Hungarian Tax Identification Number medium breadth .................. 921
Hungarian Tax Identification Number narrow breadth ................... 921
Hungarian VAT Number ............................................................... 922
Hungarian VAT Number wide breadth ....................................... 922
Hungarian VAT Number medium breadth ................................... 923
Hungarian VAT Number narrow breadth .................................... 923
IBAN Central ............................................................................. 924
IBAN Central wide breadth ..................................................... 925
IBAN Central narrow breadth .................................................. 926
IBAN East ................................................................................. 928
IBAN East wide breadth ......................................................... 929
IBAN East narrow-breadth ...................................................... 931
IBAN West ................................................................................ 934
IBAN West wide breadth ........................................................ 935
IBAN West narrow-breadth ..................................................... 937
Indian Aadhaar Card Number ........................................................ 939
Indian Aadhaar Card Number wide breadth ............................... 939
Indian Aadhaar Card Number medium breadth ........................... 939
Indian Aadhaar Card Number narrow breadth ............................ 940
Indian Permanent Account Number ................................................ 941
Indian Permanent Account Number wide breadth ........................ 941
Indian Permanent Account Number narrow breadth ..................... 941
Indonesian Identity Card Number ................................................... 942
Indonesian Identity Card Number wide breadth ........................... 942
Indonesian Identity Card Number medium breadth ...................... 943
Indonesian Identity Card Number narrow breadth ........................ 943
 Contents 29

International Mobile Equipment Identity Number ................................ 944

International Mobile Equipment Identity Number wide
breadth ........................................................................ 944
International Mobile Equipment Identity Number medium
breadth ........................................................................ 945
International Mobile Equipment Identity Number narrow
breadth ........................................................................ 945
International Securities Identification Number ................................... 946
International Securities Identification Number wide breadth ........... 946
International Securities Identification Number medium
breadth ........................................................................ 947
International Securities Identification Number narrow
breadth ........................................................................ 947
IP Address ................................................................................ 948
IP Address wide breadth ........................................................ 948
IP Address medium breadth ................................................... 949
IP Address narrow breadth ..................................................... 949
IPv6 Address ............................................................................. 950
IPv6 Address wide breadth ..................................................... 950
IPv6 Address medium breadth ................................................ 951
IPv6 Address narrow breadth .................................................. 952
Irish Personal Public Service Number ............................................ 952
Irish Personal Public Service Number wide breadth ..................... 953
Irish Personal Public Service Number medium breadth ................ 953
Irish Personal Public Service Number narrow breadth .................. 954
Israel Personal Identification Number .............................................. 954
Israel Personal Identification Number wide breadth ..................... 955
Israel Personal Identification Number medium breadth ................. 955
Israel Personal Identification Number narrow breadth .................. 955
Italy Driver's License Number ........................................................ 956
Italy Driver's License Number wide breadth ................................ 956
Italy Driver's License Number narrow breadth ............................. 957
Italy Health Insurance Number ...................................................... 958
Italy Health Insurance Number wide breadth .............................. 958
Italy Health Insurance Number narrow breadth ........................... 959
Italy Passport Number ................................................................. 960
Italy Passport Number wide breadth ......................................... 960
Italy Passport Number narrow breadth ...................................... 960
Italy Value Added Tax (VAT) Number .............................................. 961
Italy Value Added Tax (VAT) Number wide breadth ...................... 961
Italy Value Added Tax (VAT) Number medium breadth .................. 962
Italy Value Added Tax (VAT) Number narrow breadth ................... 963
Japan Passport Number ............................................................... 963
 Contents 30

Japan Passport Number wide breadth ...................................... 964

Japan Passport Number narrow breadth ................................... 964
Japanese Juki-Net Identification Number ......................................... 965
Japanese Juki-Net Identification Number wide breadth ................. 965
Japanese Juki-Net Identification Number medium breadth ............ 966
Japanese Juki-Net Identification Number narrow breadth .............. 966
Japanese My Number - Corporate .................................................. 967
Japanese My Number - Corporate wide breadth ......................... 967
Japanese My Number - Corporate narrow breadth ...................... 968
Japanese My Number - Personal ................................................... 968
Japanese My Number - Personal wide breadth ........................... 969
Japanese My Number - Personal medium breadth ...................... 969
Japanese My Number - Personal narrow breadth ........................ 970
Korea Passport Number ............................................................... 970
Korea Passport Number wide breadth ...................................... 971
Korea Passport Number narrow breadth ................................... 971
Korea Residence Registration Number for Foreigners ........................ 972
Korea Residence Registration Number for Foreigners wide
breadth ........................................................................ 972
Korea Residence Registration Number for Foreigners medium
breadth ........................................................................ 973
Korea Residence Registration Number for Foreigners narrow
breadth ........................................................................ 974
Korea Residence Registration Number for Korean ............................. 974
Korea Residence Registration Number for Korean wide
breadth ........................................................................ 975
Korea Residence Registration Number for Korean medium
breadth ........................................................................ 975
Korea Residence Registration Number for Korean narrow
breadth ........................................................................ 976
Luxembourg National Register of Individuals Number ........................ 977
Luxembourg National Register of Individuals Number wide
breadth ........................................................................ 977
Luxembourg National Register of Individuals Number medium
breadth ........................................................................ 977
Luxembourg National Register of Individuals Number narrow
breadth ........................................................................ 978
Malaysian MyKad Number (MyKad) ............................................... 979
Malaysian MyKad Number (MyKad) wide breadth ....................... 979
Malaysian MyKad Number (MyKad) medium breadth ................... 979
Malaysian MyKad Number (MyKad) narrow breadth .................... 980
Mexican Personal Registration and Identification Number ................... 981
 Contents 31

Mexican Personal Registration and Identification Number wide

breadth ........................................................................ 981
Mexican Personal Registration and Identification Number medium
breadth ........................................................................ 982
Mexican Personal Registration and Identification Number narrow
breadth ........................................................................ 983
Mexican Tax Identification Number ................................................. 983
Mexican Tax Identification Number wide breadth ......................... 984
Mexican Tax Identification Number medium breadth .................... 984
Mexican Tax Identification Number narrow breadth ...................... 985
Mexican Unique Population Registry Code ....................................... 986
Mexican Unique Population Registry Code wide breadth .............. 986
Mexican Unique Population Registry Code medium breadth ....
9 8 6
Mexican Unique Population Registry Code narrow breadth ........... 987
Mexico CLABE Number ............................................................... 987
Mexico CLABE Number wide breadth ....................................... 988
Mexico CLABE Number medium breadth .................................. 988
Mexico CLABE Number narrow breadth .................................... 988
National Drug Code (NDC) ........................................................... 989
National Drug Code (NDC) wide breadth ................................... 990
National Drug Code (NDC) medium breadth .............................. 990
National Drug Code (NDC) narrow breadth ................................ 991
National Provider Identifier Number ................................................ 991
National Provider Identifier Number wide breadth ........................ 992
National Provider Identifier Number medium breadth ................... 992
National Provider Identifier Number narrow breadth ..................... 992
Netherlands Driver's License Number ............................................. 993
Netherlands Driver's License Number wide breadth ..................... 993
Netherlands Driver's License Number narrow breadth .................. 994
Netherlands Passport Number ....................................................... 995
Netherlands Passport Number wide breadth .............................. 995
Netherlands Passport Number narrow breadth ........................... 995
Netherlands Tax Identification Number ............................................ 996
Netherlands Tax Identification Number wide breadth .................... 996
Netherlands Tax Identification Number medium breadth ............... 997
Netherlands Tax Identification Number narrow breadth ................. 997
Netherlands Value Added Tax (VAT) Number .................................... 999
Netherlands Value Added Tax (VAT) Number wide breadth ........... 999
Netherlands Value Added Tax (VAT) Number medium
breadth ....................................................................... 1000
Netherlands Value Added Tax (VAT) Number narrow
breadth ....................................................................... 1000
 Contents 32

New Zealand National Health Index Number ................................... 1001

New Zealand National Health Index Number wide breadth .......... 1001
New Zealand National Health Index Number medium
breadth ....................................................................... 1001
New Zealand National Health Index Number narrow breadth ....... 1002
Norwegian Birth Number ............................................................ 1003
Norwegian Birth Number wide breadth .................................... 1003
Norwegian Birth Number medium breadth ................................ 1003
Norwegian Birth Number narrow breadth ................................. 1004
People's Republic of China ID ..................................................... 1005
People's Republic of China ID wide breadth ............................. 1005
People's Republic of China ID narrow breadth .......................... 1006
Polish Identification Number ........................................................ 1006
Polish Identification Number wide breadth ................................ 1007
Polish Identification Number medium breadth ........................... 1007
Polish Identification Number narrow breadth ............................. 1007
Polish REGON Number .............................................................. 1008
Polish REGON Number wide breadth ..................................... 1009
Polish REGON Number medium breadth ................................. 1009
Polish REGON Number narrow breadth .................................. 1010
Polish Social Security Number (PESEL) ........................................ 1010
Polish Social Security Number (PESEL) wide breadth ................ 1011
Polish Social Security Number (PESEL) medium breadth ............ 1011
Polish Social Security Number (PESEL) narrow breadth ............. 1012
Polish Tax Identification Number .................................................. 1012
Polish Tax Identification Number wide breadth .......................... 1013
Polish Tax Identification Number medium breadth ...................... 1013
Polish Tax Identification Number narrow breadth ....................... 1014
Randomized US Social Security Number (SSN) .............................. 1015
Randomized US Social Security Number (SSN) medium
breadth ....................................................................... 1015
Randomized US Social Security Number (SSN) narrow
breadth ....................................................................... 1016
Romanian Numerical Personal Code ............................................ 1017
Romanian Numerical Personal Code wide breadth .................... 1017
Romanian Numerical Personal Code medium breadth ................ 1018
Romanian Numerical Personal Code narrow breadth ................. 1018
Russian Passport Identification Number ......................................... 1019
Russian Passport Identification Number wide breadth ................ 1019
Russian Passport Identification Number narrow breadth ............. 1020
Russian Taxpayer Identification Number ........................................ 1021
Russian Taxpayer Identification Number wide breadth ................ 1021
Russian Taxpayer Identification Number medium breadth ........... 1021
 Contents 33

Russian Taxpayer Identification Number narrow breadth ............. 1022

Singapore NRIC data identifier ..................................................... 1023
South African Personal Identification Number ................................. 1023
South African Personal Identification Number wide breadth ......... 1024
South African Personal Identification Number medium
breadth ....................................................................... 1024
South African Personal Identification Number narrow
breadth ....................................................................... 1025
Spain Driver's License Number .................................................... 1025
Spain Driver's License Number wide breadth ............................ 1026
Spain Driver's License Number narrow breadth ......................... 1027
Spanish Customer Account Number ............................................. 1028
Spanish Customer Account Number wide breadth ..................... 1028
Spanish Customer Account Number medium breadth ................. 1029
Spanish Customer Account Number narrow breadth .................. 1029
Spanish DNI ID ......................................................................... 1030
Spanish DNI ID wide breadth ................................................ 1031
Spanish DNI ID narrow breadth ............................................. 1031
Spanish Passport Number .......................................................... 1032
Spanish Passport Number wide breadth .................................. 1032
Spanish Passport Number narrow breadth ............................... 1033
Spanish Social Security Number ................................................. 1034
Spanish Social Security Number wide breadth .......................... 1034
Spanish Social Security Number medium breadth ..................... 1035
Spanish Social Security Number narrow breadth ....................... 1035
Spanish Tax Identification (CIF) .................................................... 1036
Spanish Tax Identification (CIF) wide breadth ........................... 1036
Spanish Tax Identification (CIF) medium breadth ....................... 1037
Spanish Tax Identification (CIF) narrow breadth ........................ 1038
Swedish Passport Number .......................................................... 1039
Swedish Passport Number wide breadth ................................. 1039
Swedish Passport Number narrow breadth .............................. 1039
Swedish Personal Identification Number ........................................ 1040
Swedish Personal Identification Number wide breadth ................ 1040
Swedish Personal Identification Number medium breadth .......... 1041
Swedish Personal Identification Number narrow breadth ............. 1042
SWIFT Code ........................................................................... 1043
SWIFT Code wide breadth .................................................... 1043
SWIFT Code narrow breadth ................................................. 1043
Swiss AHV Number ................................................................... 1044
Swiss AHV Number wide breadth ........................................... 1044
Swiss AHV Number narrow breadth ........................................ 1045
Swiss Social Security Number (AHV) ............................................ 1046
 Contents 34

Swiss Social Security Number (AHV) wide breadth .................... 1046

Swiss Social Security Number (AHV) medium breadth ............... 1046
Swiss Social Security Number (AHV) narrow breadth ................. 1047
Taiwan ROC ID ......................................................................... 1048
Taiwan ROC ID wide breadth ................................................ 1048
Taiwan ROC ID narrow breadth ............................................. 1048
Thailand Personal Identification Number ........................................ 1049
Thailand Personal Identification Number wide breadth ................ 1049
Thailand Personal Identification Number medium breadth ........... 1050
Thailand Personal Identification Number narrow breadth ............. 1050
Turkish Identification Number ...................................................... 1051
Turkish Identification Number wide breadth .............................. 1051
Turkish Identification Number medium breadth .......................... 1052
Turkish Identification Number narrow breadth ........................... 1052
UK Drivers Licence Number ........................................................ 1053
UK Drivers Licence Number wide breadth ................................ 1053
UK Drivers Licence Number medium breadth ........................... 1054
UK Drivers Licence Number narrow breadth ............................. 1054
UK Electoral Roll Number ........................................................... 1055
UK National Health Service (NHS) Number .................................... 1056
UK National Health Service (NHS) Number medium breadth ....... 1056
UK National Health Service (NHS) Number narrow breadth ......... 1057
UK National Insurance Number .................................................... 1058
UK National Insurance Number wide breadth ........................... 1058
UK National Insurance Number medium breadth ....................... 1059
UK National Insurance Number narrow breadth ........................ 1059
UK Passport Number ................................................................. 1060
UK Passport Number wide breadth ......................................... 1060
UK Passport Number medium breadth .................................... 1061
UK Passport Number narrow breadth ...................................... 1061
UK Tax ID Number .................................................................... 1062
UK Tax ID Number wide breadth ............................................ 1062
UK Tax ID Number medium breadth ....................................... 1063
UK Tax ID Number narrow breadth ......................................... 1063
Ukraine Passport (Domestic) ....................................................... 1064
Ukraine Passport (Domestic) wide breadth ............................... 1064
Ukraine Passport (Domestic) narrow breadth ............................ 1064
Ukraine Identity Card ................................................................. 1065
Ukraine Identity Card wide breadth ......................................... 1065
Ukraine Identity Card medium breadth .................................... 1066
Ukraine Identity Card narrow breadth ...................................... 1066
Ukraine Passport (International) ................................................... 1067
Ukraine Passport (International) wide breadth ........................... 1067
 Contents 35

Ukraine Passport (International) narrow breadth ........................ 1068

United Arab Emirates Personal Number ......................................... 1068
United Arab Emirates Personal Number wide breadth ............... 1069
United Arab Emirates Personal Number medium breadth ............ 1069
United Arab Emirates Personal Number narrow breadth ............. 1070
US Individual Tax Identification Number (ITIN) ................................ 1070
US Individual Tax Identification Number (ITIN) wide breadth ........ 1071
US Individual Tax Identification Number (ITIN) medium
breadth ....................................................................... 1071
US Individual Tax Identification Number (ITIN) narrow
breadth ....................................................................... 1072
US Passport Number ................................................................. 1073
US Passport Number wide breadth ......................................... 1073
US Passport Number narrow breadth ...................................... 1073
US Social Security Number (SSN) ................................................ 1074
US Social Security Number (SSN) wide breadth ........................ 1075
US Social Security Number (SSN) medium breadth ................... 1075
US Social Security Number (SSN) narrow breadth ..................... 1076
US ZIP+4 Postal Codes ............................................................. 1077
US ZIP+4 Postal Codes wide breadth ..................................... 1077
US ZIP+4 Postal Codes medium breadth ................................. 1078
US ZIP+4 Postal Codes narrow breadth .................................. 1079
Venezuela National Identification Number ...................................... 1079
Venezuela National Identification Number wide breadth .............. 1080
Venezuela National Identification Number medium breadth ......... 1080
Venezuela National Identification Number narrow breadth ........... 1081

Chapter 38 Library of policy templates ............................................ 1082

Caldicott Report policy template ................................................... 1085
Canadian Social Insurance Numbers policy template ........................ 1086
CAN-SPAM Act policy template .................................................... 1087
Colombian Personal Data Protection Law 1581 policy template .......... 1088
Common Spyware Upload Sites policy template .............................. 1088
Competitor Communications policy template ................................... 1089
Confidential Documents policy template ......................................... 1089
Credit Card Numbers policy template ............................................ 1090
Customer Data Protection policy template ...................................... 1091
Data Protection Act 1998 policy template ....................................... 1092
Data Protection Directives (EU) policy template ............................... 1094
Defense Message System (DMS) GENSER Classification policy
template ............................................................................ 1096
Design Documents policy template ............................................... 1097
 Contents 36

Employee Data Protection policy template ...................................... 1098

Encrypted Data policy template .................................................... 1099
Export Administration Regulations (EAR) policy template .................. 1100
FACTA 2003 (Red Flag Rules) policy template ................................ 1101
Financial Information policy template ............................................. 1105
Forbidden Websites policy template .............................................. 1105
Gambling policy template ............................................................ 1106
General Data Protection Regulation (Banking and Finance) ............... 1107
General Data Protection Regulation (Digital Identity) ........................ 1121
General Data Protection Regulation (Government Identification) ......... 1121
General Data Protection Regulation (Healthcare and Insurance) ......... 1136
General Data Protection Regulation (Personal Profile) ...................... 1145
General Data Protection Regulation (Travel) ................................... 1145
Gramm-Leach-Bliley policy template ............................................. 1150
HIPAA and HITECH (including PHI) policy template ......................... 1152
Human Rights Act 1998 policy template ......................................... 1156
Illegal Drugs policy template ........................................................ 1157
Individual Taxpayer Identification Numbers (ITIN) policy template ........ 1157
International Traffic in Arms Regulations (ITAR) policy template .......... 1158
Media Files policy template ......................................................... 1159
Merger and Acquisition Agreements policy template ......................... 1160
NASD Rule 2711 and NYSE Rules 351 and 472 policy template ......... 1161
NASD Rule 3010 and NYSE Rule 342 policy template ...................... 1163
NERC Security Guidelines for Electric Utilities policy template ............ 1164
Network Diagrams policy template ................................................ 1165
Network Security policy template .................................................. 1166
Offensive Language policy template .............................................. 1166
Office of Foreign Assets Control (OFAC) policy template ................... 1167
OMB Memo 06-16 and FIPS 199 Regulations policy template ............ 1168
Password Files policy template .................................................... 1170
Payment Card Industry (PCI) Data Security Standard policy
template ............................................................................ 1170
PIPEDA policy template ............................................................. 1172
Price Information policy template .................................................. 1174
Project Data policy template ........................................................ 1174
Proprietary Media Files policy template .......................................... 1174
Publishing Documents policy template ........................................... 1175
Racist Language policy template .................................................. 1176
Restricted Files policy template .................................................... 1176
Restricted Recipients policy template ............................................ 1176
Resumes policy template ............................................................ 1177
Sarbanes-Oxley policy template ................................................... 1177
SEC Fair Disclosure Regulation policy template .............................. 1180
 Contents 37

Sexually Explicit Language policy template ..................................... 1182

Source Code policy template ....................................................... 1183
State Data Privacy policy template ................................................ 1184
SWIFT Codes policy template ...................................................... 1187
Symantec DLP Awareness and Avoidance policy template ................ 1187
UK Drivers License Numbers policy template .................................. 1188
UK Electoral Roll Numbers policy template ..................................... 1188
UK National Health Service (NHS) Number policy template ............... 1189
UK National Insurance Numbers policy template ............................. 1189
UK Passport Numbers policy template ........................................... 1189
UK Tax ID Numbers policy template .............................................. 1190
US Intelligence Control Markings (CAPCO) and DCID 1/7 policy
template ............................................................................ 1190
US Social Security Numbers policy template ................................... 1191
Violence and Weapons policy template .......................................... 1192
Webmail policy template ............................................................. 1192
Yahoo Message Board Activity policy template ................................ 1193
Yahoo and MSN Messengers on Port 80 policy template ................... 1194

Section 5 Configuring policy response rules ................. 1197

Chapter 39 Responding to policy violations .................................... 1198
About response rules ................................................................. 1199
About response rule actions ........................................................ 1199
Response rule actions for all detection servers ................................ 1200
Response rule actions for endpoint detection .................................. 1201
Response rule actions for Network Prevent detection ....................... 1202
Response rule actions for Network Protect detection ........................ 1203
Response rule actions for Cloud Storage detection .......................... 1204
Response rule actions for Cloud Applications and API appliance
detectors ........................................................................... 1204
About response rule execution types ............................................. 1208
About Automated Response rules ................................................ 1209
About Smart Response rules ....................................................... 1209
About response rule conditions .................................................... 1210
About response rule action execution priority .................................. 1211
About response rule authoring privileges ....................................... 1215
Implementing response rules ....................................................... 1216
Response rule best practices ...................................................... 1217
 Contents 38

Chapter 40 Configuring and managing response rules ................ 1219

Manage response rules .............................................................. 1219
Adding a new response rule ........................................................ 1220
Configuring response rules ......................................................... 1221
About configuring Smart Response rules ....................................... 1222
Configuring response rule conditions ............................................ 1222
Configuring response rule actions ................................................ 1223
Modifying response rule ordering ................................................. 1227
About removing response rules .................................................... 1227

Chapter 41 Response rule conditions ............................................... 1229

Configuring the Endpoint Location response condition ...................... 1229
Configuring the Endpoint Device response condition ........................ 1230
Configuring the Incident Type response condition ............................ 1231
Configuring the Incident Match Count response condition .................. 1232
Configuring the Protocol or Endpoint Monitoring response
condition ........................................................................... 1233
Configuring the Severity response condition ................................... 1235

Chapter 42 Response rule actions ..................................................... 1237

Configuring the Add Note action ................................................... 1239
Configuring the Limit Incident Data Retention action ......................... 1239
Retaining data for endpoint incidents ...................................... 1240
Discarding data for network incidents ...................................... 1241
Configuring the Log to a Syslog Server action ................................. 1242
Configuring the Send Email Notification action ................................ 1243
Configuring the Server FlexResponse action .................................. 1245
Configuring the Set Attribute action ............................................... 1246
Configuring the Set Status action ................................................. 1247
Configuring the Classify Enterprise Vault Content response
action ............................................................................... 1247
Configuring the retention categories that are available for
classification ................................................................ 1250
Configuring the Cloud Storage: Add Visual Tag action ...................... 1252
Configuring the Cloud Storage: Quarantine action ............................ 1252
Configuring the Quarantine Smart Response action ......................... 1253
Configuring the Restore File Smart Response action ........................ 1254
Configuring the Break Links in Data-at-Rest action ........................... 1254
Configuring the Custom Action on Data-at-Rest action ...................... 1255
Configuring the Delete Data-at-Rest action ..................................... 1256
Configuring the Encrypt Data-at-Rest action ................................... 1257
 Contents 39

Configuring the Perform DRM on Data-at-Rest action ....................... 1257

Configuring the Quarantine Data-at-Rest action ............................... 1258
Configuring the Tag Data-at-Rest action ......................................... 1259
Configuring the Prevent download, copy, print action ........................ 1260
Configuring the Remove Collaborator Access action ........................ 1260
Configuring the Set Collaborator Access to 'Edit' action ..................... 1261
Configuring the Set Collaborator Access to 'Preview' action ............... 1261
Configuring the Set Collaborator Access to 'Read' action ................... 1262
Configuring the Set File Access to 'All Read' action .......................... 1262
Configuring the Set File Access to 'Internal Edit' .............................. 1263
Configuring the Set File Access to 'Internal Read' action ................... 1264
Configuring the Add two-factor authentication action ........................ 1264
Configuring the Block Data-in-Motion action ................................... 1265
Configuring the Custom Action on Data-in-Motion action ................... 1265
Configuring the Encrypt Data-in-Motion action ................................. 1266
Configuring the Perform DRM on Data-in-Motion action .................... 1267
Configuring the Quarantine Data-in-Motion action ............................ 1268
Configuring the Redact Data-in-Motion action ................................. 1268
Configuring the Endpoint: FlexResponse action ............................... 1269
Configuring the Endpoint Discover: Quarantine File action ................. 1270
Configuring the Endpoint Prevent: Block action ............................... 1272
Configuring the Endpoint Prevent: Encrypt action ............................ 1275
Configuring the Endpoint Prevent: Notify action ............................... 1279
Configuring the Endpoint Prevent: User Cancel action ...................... 1282
Configuring the Network Prevent for Web: Block FTP Request
action ............................................................................... 1285
Configuring the Network Prevent for Web: Block HTTP/S action ......... 1285
Configuring the Network Prevent: Block SMTP Message action .......... 1286
Configuring the Network Prevent: Modify SMTP Message action ........ 1287
Configuring the Network Prevent for Web: Remove HTTP/S Content
action ............................................................................... 1288
Configuring the Network Protect: Copy File action ............................ 1290
Configuring the Network Protect: Quarantine File action .................... 1290
Configuring the Network Protect: Encrypt File action ........................ 1292

Section 6 Remediating and managing incidents ......... 1293

Chapter 43 Remediating incidents .................................................... 1294
About incident remediation .......................................................... 1294
Remediating incidents ................................................................ 1297
Executing Smart response rules ................................................... 1298
Incident remediation action commands .......................................... 1298
 Contents 40

Response action variables .......................................................... 1300

General incident variables .................................................... 1300
Network Monitor and Network Prevent incident variables ............ 1301
Discover incident variables ................................................... 1301
Endpoint incident variables ................................................... 1302
Cloud Connector incident variables ........................................ 1302

Chapter 44 Remediating Network incidents ................................... 1304

Network incident list ................................................................... 1304
Network incident list—Actions ...................................................... 1307
Network incident list—Columns .................................................... 1309
Network incident snapshot .......................................................... 1310
Network incident snapshot—Heading and navigation ....................... 1310
Network incident snapshot—General information ............................. 1311
Network incident snapshot—Matches ............................................ 1313
Network incident snapshot—Attributes .......................................... 1314
Network summary report ............................................................ 1314

Chapter 45 Remediating Endpoint incidents .................................. 1316

About endpoint incident lists ........................................................ 1316
Endpoint incident snapshot ......................................................... 1319
Reporting on Endpoint Prevent response rules ................................ 1324
Endpoint incident destination or protocol-specific information ............. 1325
Endpoint incident summary reports ............................................... 1326

Chapter 46 Remediating Discover incidents ................................... 1329

About reports for Network Discover ............................................... 1329
About incident reports for Network Discover/Cloud Storage
Discover ........................................................................... 1330
Discover incident reports ............................................................ 1331
Discover incident lists ................................................................ 1332
Discover incident actions ............................................................ 1332
Discover incident entries ............................................................. 1333
Discover incident snapshot ......................................................... 1335
Discover summary reports .......................................................... 1338

Chapter 47 Working with Cloud Connector incidents ................... 1340

About Application incident reports ................................................. 1340
Application incident list ............................................................... 1342
Application incident entries .......................................................... 1342
Application incident actions ......................................................... 1344
 Contents 41

Application incident snapshot ...................................................... 1345

Application summary reports ....................................................... 1349

Chapter 48 Managing and reporting incidents ............................... 1350

About Symantec Data Loss Prevention reports ................................ 1352
About strategies for using reports ................................................. 1353
Setting report preferences ........................................................... 1354
About incident reports ................................................................ 1354
About dashboard reports and executive summaries ......................... 1356
Viewing dashboards .................................................................. 1357
Creating dashboard reports ......................................................... 1358
Configuring dashboard reports ..................................................... 1359
Choosing reports to include in a dashboard .................................... 1361
About summary reports .............................................................. 1361
Viewing summary reports ........................................................... 1361
Creating summary reports ........................................................... 1362
Viewing incidents ...................................................................... 1363
About custom reports and dashboards .......................................... 1364
Using IT Analytics to manage incidents .......................................... 1365
Filtering reports ........................................................................ 1366
Saving custom incident reports .................................................... 1366
Scheduling custom incident reports ............................................... 1367
Delivery schedule options for incident and system reports ................. 1369
Delivery schedule options for dashboard reports ............................. 1371
Using the date widget to schedule reports ...................................... 1373
Editing custom dashboards and reports ......................................... 1373
Exporting incident reports ........................................................... 1373
Exported fields for Network Monitor .............................................. 1374
Exported fields for Network Discover/Cloud Storage Discover ............ 1375
Exported fields for Endpoint Discover ............................................ 1376
Deleting incidents ..................................................................... 1377
About the incident deletion process ........................................ 1378
Configuring the incident deletion job schedule .......................... 1379
Starting and stopping incident deletion jobs .............................. 1379
Working with the deletion jobs history ..................................... 1380
Deleting custom dashboards and reports ....................................... 1381
Common incident report features .................................................. 1381
Page navigation in incident reports ............................................... 1382
Incident report filter and summary options ...................................... 1383
Sending incident reports by email ................................................. 1384
Printing incident reports .............................................................. 1385
Incident snapshot history tab ....................................................... 1385
 Contents 42

Incident snapshot attributes section .............................................. 1385

Incident snapshot correlations tab ................................................ 1386
Incident snapshot policy section ................................................... 1386
Incident snapshot matches section ............................................... 1386
Incident snapshot access information section .................................. 1387
Customizing incident snapshot pages ........................................... 1388
About filters and summary options for reports ................................. 1388
General filters for reports ............................................................ 1390
Summary options for incident reports ............................................ 1393
Advanced filter options for reports ................................................ 1398

Chapter 49 Hiding incidents ............................................................... 1406

About incident hiding ................................................................. 1406
Hiding incidents ....................................................................... 1407
Unhiding hidden incidents .......................................................... 1407
Preventing incidents from being hidden ......................................... 1408
Deleting hidden incidents ............................................................ 1409

Chapter 50 Working with incident data ........................................... 1410

About incident status attributes .................................................... 1410
Configuring status attributes and values ......................................... 1412
Configuring status groups ........................................................... 1413
Export web archive .................................................................... 1414
Export web archive—Create Archive ............................................. 1414
Export web archive—All Recent Events ......................................... 1415
About custom attributes .............................................................. 1416
About using custom attributes ...................................................... 1417
How custom attributes are populated ............................................ 1418
Configuring custom attributes ...................................................... 1418
Setting custom attributes ............................................................ 1419
Setting the values of custom attributes manually .............................. 1420

Chapter 51 Working with user risk .................................................... 1421

About user risk ......................................................................... 1421
About user data sources ............................................................. 1423
Defining custom attributes for user data ................................... 1424
Bringing in user data ........................................................... 1425
About identifying users in web incidents ........................................ 1429
Enabling user identification and configuring the mapping
schedule ..................................................................... 1430
Checking the status of the domain controllers ........................... 1431
 Contents 43

Viewing the user list ................................................................... 1431

Viewing user details ................................................................... 1432
Working with the user risk summary .............................................. 1432

Chapter 52 Implementing lookup plug-ins ...................................... 1434

About lookup plug-ins ................................................................ 1434
Types of lookup plug-ins ....................................................... 1435
About lookup parameters ..................................................... 1438
About plug-in deployment ..................................................... 1439
About plug-in chaining ......................................................... 1439
About upgrading lookup plug-ins ............................................ 1439
Implementing and testing lookup plug-ins ....................................... 1440
Managing and configuring lookup plug-ins ............................... 1442
Creating new lookup plug-ins ................................................ 1443
Selecting lookup parameters ................................................. 1444
Enabling lookup plug-ins ...................................................... 1449
Chaining lookup plug-ins ...................................................... 1449
Reloading lookup plug-ins .................................................... 1450
Troubleshooting lookup plug-ins ............................................. 1450
Configuring detailed logging for lookup plug-ins ........................ 1451
Configuring advanced plug-in properties .................................. 1452
Configuring the CSV Lookup Plug-In ............................................. 1453
Requirements for creating the CSV file .................................... 1455
Specifying the CSV file path .................................................. 1456
Choosing the CSV file delimiter ............................................. 1456
Selecting the CSV file character set ........................................ 1456
Mapping attributes and parameter keys to CSV fields ................. 1457
CSV attribute mapping example ............................................. 1458
Testing and troubleshooting the CSV Lookup Plug-In ................ 1459
CSV Lookup Plug-In tutorial .................................................. 1460
Configuring LDAP Lookup Plug-Ins ............................................... 1462
Requirements for LDAP server connections ............................. 1463
Mapping attributes to LDAP data ............................................ 1464
Attribute mapping examples for LDAP ..................................... 1465
Testing and troubleshooting LDAP Lookup Plug-ins ................... 1465
LDAP Lookup Plug-In tutorial ................................................ 1466
Configuring Script Lookup Plug-Ins ............................................... 1467
Writing scripts for Script Lookup Plug-Ins ................................. 1468
Specifying the Script Command ............................................. 1469
Specifying the Arguments ..................................................... 1470
Enabling the stdin and stdout options ...................................... 1470
Enabling incident protocol filtering for scripts ............................ 1471
 Contents 44

Enabling and encrypting script credentials ............................... 1472

Chaining multiple Script Lookup Plug-Ins ................................. 1474
Script Lookup Plug-In tutorial ................................................ 1474
Example script ................................................................... 1476
Configuring migrated Custom (Legacy) Lookup Plug-Ins ................... 1478

Section 7 Monitoring and preventing data loss in

the network ............................................................ 1480
Chapter 53 Implementing Network Monitor ................................... 1481
Implementing Network Monitor ..................................................... 1481
About IPv6 support for Network Monitor ......................................... 1483
Choosing a network packet capture method ................................... 1484
About packet capture software installation and configuration .............. 1485
Installing WinPcap on a Windows platform ............................... 1485
Updating the Endace card driver ............................................ 1486
Installing and updating the Napatech network adapter and driver
software ...................................................................... 1486
Configuring the Network Monitor Server ......................................... 1492
Enabling GET processing with Network Monitor .............................. 1493
Creating a policy for Network Monitor ............................................ 1494
Testing Network Monitor ............................................................. 1495

Chapter 54 Implementing Network Prevent for Email .................. 1496

Implementing Network Prevent for Email ........................................ 1496
About Mail Transfer Agent (MTA) integration ................................... 1498
Configuring Network Prevent for Email Server for reflecting or
forwarding mode ................................................................. 1498
Configuring Linux IP tables to reroute traffic from a restricted
port ............................................................................ 1503
Specifying one or more upstream mail transfer agents (MTAs) ........... 1504
Creating a policy for Network Prevent for Email ............................... 1505
About policy violation data headers ............................................... 1506
Enabling policy violation data headers ........................................... 1507
Testing Network Prevent for Email ................................................ 1508

Chapter 55 Implementing Network Prevent for Web .................... 1509

Implementing Network Prevent for Web ......................................... 1509
Configuring Network Prevent for Web Server .................................. 1511
About proxy server configuration .................................................. 1514
 Contents 45

Configuring request and response mode services ...................... 1515

Specifying one or more proxy servers ............................................ 1516
Enabling GET processing for Network Prevent for Web ..................... 1516
Creating policies for Network Prevent for Web ................................ 1517
Testing Network Prevent for Web ................................................. 1519
Troubleshooting information for Network Prevent for Web Server ........ 1519

Section 8 Discovering where confidential data is

stored ........................................................................ 1520
Chapter 56 About Network Discover ................................................ 1522

About Network Discover/Cloud Storage Discover ............................. 1522

How Network Discover/Cloud Storage Discover works ...................... 1523

Chapter 57 Setting up and configuring Network Discover ........... 1526

Setting up and configuring Network Discover/Cloud Storage
Discover ........................................................................... 1526
Modifying the Network Discover/Cloud Storage Discover Server
configuration ...................................................................... 1527
Adding a new Network Discover/Cloud Storage Discover target .......... 1529
Editing an existing Network Discover/Cloud Storage Discover
target ................................................................................ 1530

Chapter 58 Network Discover scan target configuration

options ......................................................................... 1532

Network Discover/Cloud Storage Discover scan target configuration

options ............................................................................. 1532
Configuring the required fields for Network Discover targets ............... 1534
Scheduling Network Discover/Cloud Storage Discover scans ............. 1535
Providing the password authentication for Network Discover scanned
content ............................................................................. 1537
Managing cloud storage authorizations .......................................... 1538
Providing Box cloud storage authorization credentials ................ 1539
Encrypting passwords in configuration files ..................................... 1541
Setting up Network Discover/Cloud Storage Discover filters to include
or exclude items from the scan .............................................. 1542
Filtering Discover targets by item size ........................................... 1545
Filtering Discover targets by date last accessed or modified ............... 1545
Optimizing resources with Network Discover/Cloud Storage Discover
scan throttling ..................................................................... 1548
 Contents 46

Creating an inventory of the locations of unprotected sensitive

data ................................................................................. 1549

Chapter 59 Managing Network Discover target scans .................. 1552

Managing Network Discover/Cloud Storage Discover target
scans ............................................................................... 1553
Managing Network Discover/Cloud Storage Discover targets ............. 1553
About the Network Discover/Cloud Storage Discover scan target
list ............................................................................. 1553
Working with Network Discover/Cloud Storage Discover scan
targets ........................................................................ 1555
Removing Network Discover/Cloud Storage Discover scan
targets ........................................................................ 1555
Managing Network Discover/Cloud Storage Discover scan histories
....................................................................................... 1556
About Discover and Endpoint Discover scan histories ................ 1556
Working with Network Discover/Cloud Storage Discover scan
histories ...................................................................... 1558
Deleting Network Discover/Cloud Storage Discover scans .......... 1558
About Discover scan details .................................................. 1559
Working with Network Discover/Cloud Storage Discover scan
details ........................................................................ 1562
Troubleshooting grid scans ................................................... 1581
Managing Network Discover/Cloud Storage Discover Servers ............ 1564
Viewing Network Discover/Cloud Storage Discover server
status ......................................................................... 1564
About Network Discover/Cloud Storage Discover scan
optimization ....................................................................... 1565
About the difference between incremental scans and differential
scans ............................................................................... 1568
About incremental scans ............................................................ 1569
Scanning new or modified items with incremental scans .................... 1569
About managing incremental scans .............................................. 1570
Scanning new or modified items with differential scans ..................... 1571
Configuring parallel scanning of Network Discover/Cloud Storage
Discover targets .................................................................. 1571
About grid scanning ................................................................... 1573
Configuring grid scanning ........................................................... 1575
Renewing grid communication certificates for Discover detection
servers ............................................................................. 1577
Migrating a Discover scan from a single server to a grid .................... 1579
Performance guidelines .............................................................. 1579
 Contents 47

Troubleshooting grid scans ......................................................... 1581

Chapter 60 Using Server FlexResponse plug-ins to remediate

incidents ...................................................................... 1583
About the Server FlexResponse platform ....................................... 1583
Using Server FlexResponse custom plug-ins to remediate
incidents ........................................................................... 1585
Deploying a Server FlexResponse plug-in ...................................... 1586
Adding a Server FlexResponse plug-in to the plug-ins properties
file ............................................................................. 1586
Creating a properties file to configure a Server FlexResponse
plug-in ........................................................................ 1588
Locating incidents for manual remediation ...................................... 1591
Using the action of a Server FlexResponse plug-in to remediate an
incident manually ................................................................ 1592
Verifying the results of an incident response action .......................... 1593
Troubleshooting a Server FlexResponse plug-in .............................. 1594

Chapter 61 Setting up scans of Box cloud storage using an

on-premises detection server ................................. 1595
Setting up scans of Box cloud storage targets using an on-premises
detection server .................................................................. 1595
Configuring scans of Box cloud storage targets ............................... 1596
Optimizing Box cloud storage scanning ......................................... 1598
Configuring remediation options for Box cloud storage targets ............ 1599

Chapter 62 Setting up scans of file shares ...................................... 1601

Setting up server scans of file systems .......................................... 1601
Supported file system targets ...................................................... 1602
Automatically discovering servers and shares before configuring a file
system target ..................................................................... 1603
Working with Content Root Enumeration scans ......................... 1603
Troubleshooting Content Root Enumeration scans ..................... 1607
Automatically discovering open file shares ..................................... 1607
About automatically tracking incident remediation status ................... 1608
Troubleshooting automated incident remediation tracking ............ 1609
Configuration options for Automated Incident Remediation
Tracking ...................................................................... 1609
Excluding internal DFS folders ..................................................... 1613
Configuring scans of Microsoft Outlook Personal Folders (.pst
files) ................................................................................. 1613
 Contents 48

Configuring scans of file systems ................................................. 1614

Optimizing file system target scanning ........................................... 1618
Configuring Network Protect for file shares ..................................... 1619

Chapter 63 Setting up scans of Lotus Notes databases ............... 1622

Setting up server scans of IBM (Lotus) Notes databases ................... 1622
Supported IBM (Lotus) Notes targets ............................................ 1623
Configuring and running IBM (Lotus) Notes scans ............................ 1623
Configuring IBM (Lotus) Notes DIIOP mode configuration scan
options ............................................................................. 1626

Chapter 64 Setting up scans of SQL databases .............................. 1628

Setting up server scans of SQL databases ..................................... 1628
Supported SQL database targets ................................................. 1629
Configuring and running SQL database scans ................................ 1629
Installing the JDBC driver for SQL database targets ......................... 1633
SQL database scan configuration properties ................................... 1633

Chapter 65 Setting up scans of SharePoint servers ...................... 1636

Setting up server scans of SharePoint servers ................................ 1636
About scans of SharePoint servers ............................................... 1637
Supported SharePoint server targets ............................................. 1639
Access privileges for SharePoint scans ......................................... 1639
About Alternate Access Mapping Collections .................................. 1640
Configuring and running SharePoint server scans ............................ 1640
Installing the SharePoint solution on the Web Front Ends in a
farm ................................................................................. 1644
Enabling SharePoint scanning without installing the SharePoint
solution ............................................................................. 1646
Setting up SharePoint scans to use Kerberos authentication .............. 1647
Troubleshooting SharePoint scans ............................................... 1648

Chapter 66 Setting up scans of Exchange servers ......................... 1650

Setting up server scans of Exchange repositories ............................ 1650
About scans of Exchange servers ................................................. 1651
Supported Exchange Server targets .............................................. 1652
Configuring Exchange Server scans ............................................. 1653
Setting up Exchange scans to use Kerberos authentication ............... 1656
Example configurations and use cases for Exchange scans ............... 1657
Troubleshooting Exchange scans ................................................. 1658
 Contents 49

Chapter 67 About Network Discover scanners ............................... 1659

Setting up scanning of Microsoft Exchange Servers ........................ 1659
How Network Discover scanners work ........................................... 1660
Troubleshooting scanners ........................................................... 1661
Scanner processes ................................................................... 1662
Scanner installation directory structure .......................................... 1663
Scanner configuration files .......................................................... 1664
Scanner controller configuration options ........................................ 1665

Chapter 68 Setting up scanning of file systems ............................. 1667

Setting up remote scanning of file systems ..................................... 1668
Supported file system scanner targets ........................................... 1669
Installing file system scanners ..................................................... 1669
Starting file system scans ........................................................... 1672
Installing file system scanners silently from the command line ............ 1673
Configuration options for file system scanners ................................. 1674
Example configuration for scanning the C drive on a Windows
computer ........................................................................... 1675
Example configuration for scanning the /usr directory on UNIX .......... 1676
Example configuration for scanning with include filters ...................... 1676
Example configuration for scanning with exclude filters ..................... 1676
Example configuration for scanning with include and exclude filters
....................................................................................... 1677
Example configuration for scanning with date filtering ...................... 1677
Example configuration for scanning with file size filtering ................... 1678
Example configuration for scanning that skips symbolic links on UNIX
systems ............................................................................ 1678

Chapter 69 Setting up scanning of Web servers ............................ 1680

Setting up remote scanning of web servers .................................... 1680
Supported web server (scanner) targets ........................................ 1681
Installing web server scanners ..................................................... 1681
Starting web server scans ........................................................... 1683
Configuration options for web server scanners ................................ 1685
Example configuration for a web site scan with no authentication ........ 1687
Example configuration for a web site scan with basic
authentication .................................................................... 1687
Example configuration for a web site scan with form-based
authentication .................................................................... 1688
Example configuration for a web site scan with NTLM ....................... 1688
Example of URL filtering for a web site scan ................................... 1689
 Contents 50

Example of date filtering for a web site scan ................................... 1690

Chapter 70 Setting up scanning of Documentum

repositories ................................................................. 1691
Setting up remote scanning of Documentum repositories .................. 1691
Supported Documentum (scanner) targets ..................................... 1692
Installing Documentum scanners .................................................. 1692
Starting Documentum scans ........................................................ 1694
Configuration options for Documentum scanners ............................. 1695
Example configuration for scanning all documents in a Documentum
repository .......................................................................... 1697

Chapter 71 Setting up scanning of Livelink repositories .............. 1699

Setting up remote scanning of OpenText (Livelink) repositories ........... 1699
Supported OpenText (Livelink) scanner targets ............................... 1700
Creating an ODBC data source for SQL Server ............................... 1700
Installing Livelink scanners ......................................................... 1701
Starting OpenText (Livelink) scans ................................................ 1703
Configuration options for Livelink scanners ..................................... 1704
Example configuration for scanning a Livelink database .................... 1705

Chapter 72 Setting up Web Services for custom scan

targets .......................................................................... 1707
Setting up Web Services for custom scan targets ............................ 1707
About setting up the Web Services Definition Language (WSDL) ........ 1708
Example of a Web Services Java client ......................................... 1708
Sample Java code for the Web Services example ............................ 1709

Section 9 Discovering and preventing data loss on

endpoints ................................................................ 1713
Chapter 73 Overview of Symantec Data Loss Prevention for
endpoints ..................................................................... 1714
About discovering and preventing data loss on endpoints .................. 1714
Guidelines for authoring Endpoint policies ...................................... 1716
 Contents 51

Chapter 74 Summary of DLP Agent for Mac support .................... 1718

About DLP Agent feature-level support .......................................... 1718
Mac agent installation and tools feature details ................................ 1719
Mac agent installation support ............................................... 1719
Mac endpoint tools features .................................................. 1720
Mac agent management features ................................................. 1720
Mac agent endpoint location ................................................. 1721
Mac agent groups features ................................................... 1721
Overview of Mac agent detection technologies and policy authoring
features ............................................................................ 1721
Mac agent detection technologies .......................................... 1721
Mac agent policy response rule features .................................. 1724
Mac agent monitoring support ...................................................... 1737
Mac agent removable storage features .................................... 1727
Clipboard features supported on Mac agents ............................ 1728
Mac agent Email features ..................................................... 1729
Mac agent browser features .................................................. 1730
Mac agent Application Monitoring features ............................... 1730
Mac agent copy to network share features ............................... 1731
Mac agent filter by file properties features ................................ 1732
Mac agent filter by network properties features ......................... 1732
Endpoint Prevent for Mac agent advanced agent settings
features ............................................................................ 1733
Endpoint Discover for Mac targets features .................................... 1734
Endpoint Discover for Mac file system support ................................ 1734
Endpoint Discover for Mac advanced agent settings support .............. 1735

Chapter 75 Using Endpoint Prevent .................................................. 1736

About Endpoint Prevent monitoring ............................................... 1736
About removable storage monitoring ....................................... 1737
About endpoint network monitoring ......................................... 1739
About CD/DVD monitoring .................................................... 1740
About print/fax monitoring ..................................................... 1741
About network share monitoring ............................................. 1742
About clipboard monitoring ................................................... 1743
About application monitoring ................................................. 1743
About cloud storage application monitoring .............................. 1744
About virtual desktop support with Endpoint Prevent .................. 1745
About rules results caching (RRC) .......................................... 1747
About policy creation for Endpoint Prevent ..................................... 1748
About monitoring policies with response rules for Endpoint
Servers ....................................................................... 1748
 Contents 52

How to implement Endpoint Prevent ............................................. 1751

Setting the endpoint location ................................................. 1751
About Endpoint Prevent response rules in different locales .......... 1753

Chapter 76 Using Endpoint Discover ................................................ 1755

How Endpoint Discover works ..................................................... 1755
About Endpoint Discover scanning ............................................... 1755
About scanning targeted endpoints ........................................ 1756
About Endpoint Discover full scanning .................................... 1757
About Endpoint Discover incremental scanning ......................... 1757
About parallel scans on targeted endpoints .............................. 1759
Optimizing the scan for endpoint performance .......................... 1760
Preparing to set up Endpoint Discover ........................................... 1760
Creating a policy group for Endpoint Discover ........................... 1761
Creating a policy for Endpoint Discover ................................... 1762
Adding a rule for Endpoint Discover ........................................ 1762
Setting up and configuring Endpoint Discover ................................. 1763
Creating an Endpoint Discover scan ............................................. 1764
Creating a new Endpoint Discover target ................................. 1765
About Endpoint Discover filters .............................................. 1770
Configuring Endpoint Discover scan timeout settings ................. 1777
Managing Endpoint Discover target scans ...................................... 1778
About managing Endpoint Discover scans ............................... 1778
About Endpoint Discover targeted endpoints scan details ............ 1779
About remediating Endpoint Discover incidents ......................... 1781
About Endpoint reports ........................................................ 1781

Chapter 77 Working with agent configurations .............................. 1783

About agent configurations ......................................................... 1783
About cloning agent configurations ......................................... 1784
Adding and editing agent configurations ........................................ 1784
Channel settings ................................................................. 1785
Channel Filters settings ........................................................ 1788
Device Control settings ........................................................ 1797
Agent settings .................................................................... 1798
Advanced agent settings ...................................................... 1804
Setting specific channels to monitor based on the endpoint
location ....................................................................... 1847
Applying agent configurations to an agent group ............................. 1848
Configuring the agent connection status ........................................ 1848
 Contents 53

Chapter 78 Working with Agent Groups ........................................... 1849

About agent groups ................................................................... 1849
Developing a strategy for deploying Agent Groups ........................... 1850
Overview of the agent group deployment process ............................ 1851
Creating and managing agent attributes ........................................ 1852
Creating a new agent attribute ............................................... 1853
Defining a search filter for creating user-defined attributes ........... 1854
Verifying attribute queries with the Attribute Query Resolver
tool ............................................................................ 1854
Applying a new attribute or changed attribute to agents .............. 1855
Undoing changes to agent attributes ....................................... 1856
Editing user-defined agent attributes ....................................... 1856
Viewing and managing agent groups ............................................. 1856
Agent group conditions ........................................................ 1857
Creating a new agent group .................................................. 1858
Updating outdated agent configurations ................................... 1858
Assigning configurations to deploy groups ............................... 1859
Verify that group assignments are correct ................................ 1859
Viewing group conflicts ............................................................... 1860
Changing groups ...................................................................... 1860

Chapter 79 Managing Symantec DLP Agents .................................. 1862

About Symantec DLP Agent administration .................................... 1862
Agent Overview screen ........................................................ 1863
About agent events ............................................................. 1881
About Symantec DLP Agent removal ...................................... 1888
About DLP Agent logs ................................................................ 1891
Setting the log levels for an Endpoint Agent ............................. 1892
About agent password management ............................................. 1893
Create a new agent uninstall or Endpoint tools password ............ 1893
Change an existing agent uninstall or Endpoint tools
password .................................................................... 1894
Retain existing agent uninstall or Endpoint tools passwords ......... 1894

Chapter 80 Using application monitoring ........................................ 1896

About monitoring applications ...................................................... 1896
Changing application monitoring settings ................................. 1897
Monitoring instant messenger applications on Mac
endpoints .................................................................... 1900
List of CD/DVD applications .................................................. 1900
About adding applications ........................................................... 1901
 Contents 54

Adding a Windows application ..................................................... 1902

Using the GetAppInfo tool ..................................................... 1905
Adding a macOS application ....................................................... 1906
Defining macOS application binary names ............................... 1909
Ignoring macOS applications ....................................................... 1909
About Application File Access monitoring ....................................... 1910
Implementing Application File Access monitoring ............................. 1911

Chapter 81 Working with Endpoint FlexResponse ......................... 1913

About Endpoint FlexResponse ..................................................... 1913
Deploying Endpoint FlexResponse ............................................... 1915
About deploying Endpoint FlexResponse plug-ins on endpoints .......... 1915
Deploying Endpoint FlexResponse plug-ins using a silent installation
process ............................................................................ 1916
About the Endpoint FlexResponse utility ........................................ 1917
Deploying an Endpoint FlexResponse plug-in using the Endpoint
FlexResponse utility ............................................................ 1919
Enabling Endpoint FlexResponse on the Enforce Server ................... 1920
Uninstalling an Endpoint FlexResponse plug-in using the Endpoint
FlexResponse utility ............................................................ 1920
Retrieving an Endpoint FlexResponse plug-in from a specific
endpoint ............................................................................ 1921
Retrieving a list of Endpoint FlexResponse plug-ins from an
endpoint ............................................................................ 1922

Chapter 82 Using Endpoint tools ....................................................... 1923

About Endpoint tools .................................................................. 1923
Using Endpoint tools with Windows 7/8/8.1 .............................. 1925
Shutting down the agent and the watchdog services on Windows
endpoints .................................................................... 1926
Using Endpoint tools with macOS .......................................... 1926
Shutting down the agent service on Mac endpoints .................... 1927
Inspecting the database files accessed by the agent .................. 1927
Viewing extended log files .................................................... 1928
About the Device ID utilities .................................................. 1930
Starting DLP Agents that run on Mac endpoints ........................ 1933
 Contents 55

Section 10 Monitoring data loss in cloud

applications ........................................................... 1935
Chapter 83 Working with Application Detection ............................ 1936
About Application Detection ........................................................ 1936
Managing Application Detection ................................................... 1937

Section 11 Monitoring data loss using DLP

Appliances .............................................................. 1942
Chapter 84 Implementing and working with DLP
Appliances ................................................................... 1943
About DLP Appliances ............................................................... 1943
About obtaining the appliance activation file and licenses .................. 1944
Obtaining activation and license files for the virtual
appliance .................................................................... 1944
Obtaining license files for the DLP S500-10 Hardware
Appliance .................................................................... 1946
About the Command Line Interface (CLI) ....................................... 1947
About performance tuning and sizing for appliances ......................... 1947

Chapter 85 Deploying DLP Appliances ............................................. 1948

Deployment overview for the virtual appliance ................................. 1948
Setting up the virtual appliance .................................................... 1950
Deployment overview for the DLP-S500 hardware appliance .............. 1952
Setting up the DLP-S500 Appliance .............................................. 1953
Adding an appliance .................................................................. 1955
Configuring the API Detection for Developer Apps Appliance ............. 1956

Chapter 86 Post-deployment tasks ................................................... 1957

Unbinding or resetting a DLP appliance ......................................... 1957
Updating appliance software ....................................................... 1958
Log files and logging for appliances .............................................. 1959

Index ................................................................................................................. 1960

 Section 1
Getting started

■ Chapter 1. Introducing Symantec Data Loss Prevention

■ Chapter 2. Getting started administering Symantec Data Loss Prevention

■ Chapter 3. Working with languages and locales

 Chapter 1
Introducing Symantec Data
Loss Prevention
This chapter includes the following topics:

■ About updates to the Symantec Data Loss Prevention Administration Guide

■ About Symantec Data Loss Prevention

■ About the Enforce platform

■ About Network Monitor and Prevent

■ About Network Discover/Cloud Storage Discover

■ About Network Protect

■ About Endpoint Discover

■ About Endpoint Prevent

About updates to the Symantec Data Loss Prevention

Administration Guide
This guide is occasionally updated as new information becomes available. You can find the
latest version of the Symantec Data Loss Prevention Administration Guide at the following link
to the Symantec Support Center article: http://www.symantec.com/docs/DOC9261.
Subscribe to the article at the Support Center to be notified when there are updates.
The following table provides the history of updates to this version of the Symantec Data Loss
Prevention Administration Guide:
 Introducing Symantec Data Loss Prevention 58
About Symantec Data Loss Prevention

Table 1-1 Change history for the Symantec Data Loss Prevention Administration Guide

Date Description

13 March 2018 Minor formatting changes.

7 March 2018 Updated documentation related to Grid Scanning feature.

Changed suggested load balancer setting to Source IP persistence to optimize

communications with Endpoint Servers and reduce bandwidth during SSL
handshake between the Endpoint Server and the DLP Agent.

Replaced references to Symantec Web Security Service (WSS) support.

Corrected description of remediation process for Symantec CloudSOC
incidents.

Updated Napatech installation instructions for the latest supported Napatech

network adapters and drivers.

Added details about acquiring activation and license files for the DLP Virtual
Appliance and the DLP Hardware Appliance.

23 October 2017 Corrected description of remediation process for Symantec CloudSOC

incidents.

Added a link to OCR Server system requirements and OCR Server Sizing
Estimator spreadsheet Symantec Support Center article.

Made minor updates to DLP Appliance content.

20 September 2017 Updated the description for the

NetworkMonitor.APPLY_TYPE_PREFILTERS_TO_FPR.int advanced agent
setting to provide filtering details that help prevent browser performance
degradation.

Updated the scan details summary (in the topic "About Discover scan details")
to match results for multiple Discover products.

About Symantec Data Loss Prevention

Symantec Data Loss Prevention enables you to:
■ Discover and locate confidential information in cloud storage repositories, on file and web
servers, in databases, and on endpoints (desk and laptop systems)
■ Protect confidential information through quarantine
■ Monitor network traffic for transmission of confidential data
■ Monitor the use of sensitive data on endpoints
■ Prevent transmission of confidential data to outside locations
 Introducing Symantec Data Loss Prevention 59
About Symantec Data Loss Prevention

■ Automatically enforce data security and encryption policies

Symantec Data Loss Prevention includes the following components:
■ Enforce Server
See “About the Enforce platform” on page 60.
See “About Symantec Data Loss Prevention administration” on page 65.
See “About the Enforce Server administration console” on page 66.
■ Network Discover/Cloud Storage Discover
See “About Network Discover/Cloud Storage Discover” on page 62.
■ Network Protect
See “About Network Protect” on page 63.
■ Network Monitor
See “About Network Monitor and Prevent” on page 61.
■ Network Prevent
See “About Network Monitor and Prevent” on page 61.
■ Endpoint Discover
See “About Endpoint Discover” on page 63.
■ Endpoint Prevent
See “About Endpoint Prevent” on page 64.
The Discover, Protect, Monitor, and Prevent modules can be deployed as stand-alone products
or in combination. Regardless of which stand-alone products you deploy, the Enforce Server
is always provided for central management. Note that the Network Protect module requires
the Network Discover/Cloud Storage Discover module.
Associated with each product module are corresponding detection servers and cloud detectors:
■ Network Discover/Cloud Storage Discover Server locates the exposed confidential data
on a broad range of enterprise data repositories including:
■ Box cloud storage
■ File servers
■ Databases
■ Microsoft SharePoint
■ IBM/Lotus Notes
■ EMC Documentum
■ Livelink
■ Microsoft Exchange
 Introducing Symantec Data Loss Prevention 60
About the Enforce platform

■ Web servers
■ Other data repositories
If you are licensed for Network Protect, this server also copies and quarantines sensitive
data on file servers and in Box cloud storage, as specified in your policies.
See “About Network Discover/Cloud Storage Discover” on page 62.
■ Network Monitor Server monitors the traffic on your network.
See “About Network Monitor and Prevent” on page 61.
■ Network Prevent for Email Server blocks emails that contain sensitive data.
See “About Network Monitor and Prevent” on page 61.
■ Network Prevent for Web Server blocks HTTP postings and FTP transfers that contain
sensitive data.
See “About Network Monitor and Prevent” on page 61.
■ Endpoint Server monitors and prevents the misuse of confidential data on endpoints.
See “About Endpoint Discover” on page 63.
See “About Endpoint Prevent” on page 64.
The distributed architecture of Symantec Data Loss Prevention allows organizations to:
■ Perform centralized management and reporting.
■ Centrally manage data security policies once and deploy immediately across the entire
Symantec Data Loss Prevention suite.
■ Scale data loss prevention according to the size of your organization.

About the Enforce platform

The Symantec Data Loss Prevention Enforce Server is the central management platform that
enables you to define, deploy, and enforce data loss prevention and security policies. The
Enforce Server administration console provides a centralized, web-based interface for deploying
detection servers, authoring policies, remediating incidents, and managing the system.
See “About Symantec Data Loss Prevention” on page 58.
The Enforce platform provides you with the following capabilities:
■ Build and deploy accurate data loss prevention policies. You can choose among various
detection technologies, define rules, and specify actions to include in your data loss
prevention policies. Using provided regulatory and best-practice policy templates, you can
meet your regulatory compliance, data protection and acceptable-use requirements, and
address specific security threats.
See “About Data Loss Prevention policies” on page 327.
See “Detecting data loss” on page 340.
 Introducing Symantec Data Loss Prevention 61
About Network Monitor and Prevent

■ Automatically deploy and enforce data loss prevention policies. You can automate policy
enforcement options for notification, remediation workflow, blocking, and encryption.
■ Measure risk reduction and demonstrate compliance. The reporting features of the Enforce
Server enables you to create actionable reports identifying risk reduction trends over time.
You can also create compliance reports to address conformance with regulatory
requirements.
See “About Symantec Data Loss Prevention reports” on page 1352.
See “About incident reports” on page 1354.
■ Empower rapid remediation. Based on incident severity, you can automate the entire
remediation process using detailed incident reporting and workflow automation. Role-based
access controls empower individual business units and departments to review and remediate
those incidents that are relevant to their business or employees.
See “About incident remediation” on page 1294.
See “Remediating incidents” on page 1297.
■ Safeguard employee privacy. You can use the Enforce Server to review incidents without
revealing the sender identity or message content. In this way, multi-national companies
can meet legal requirements on monitoring European Union employees and transferring
personal data across national boundaries.
See “About role-based access control” on page 93.

About Network Monitor and Prevent

The Symantec Data Loss Prevention network data monitoring and prevention products include:
■ Network Monitor
Network Monitor captures and analyzes traffic on your network. It detects confidential data
and significant traffic metadata over the protocols that you specify. For example, SMTP,
FTP, HTTP, and various IM protocols. You can configure a Network Monitor Server to
monitor custom protocols and to use a variety of filters (per protocol) to filter out low-risk
traffic.
■ Network Prevent for Email
Network Prevent for Email integrates with standard MTAs and hosted email services to
provide in-line active SMTP email management. Policies that are deployed on in-line
Network Prevent for Email Server direct the next-hop mail server to block, reroute, or tag
email messages. These blocks are based on specific content and other message attributes.
Communication between MTAs and Network Prevent for Email Server can be secured as
necessary using TLS.
Implement Network Monitor, review the incidents it captures, and refine your policies
accordingly before you implement Network Prevent for Email.
See the Symantec Data Loss Prevention MTA Integration Guide for Network Prevent for
Email.
 Introducing Symantec Data Loss Prevention 62
About Network Discover/Cloud Storage Discover

■ Network Prevent for Web

For in-line active web request management, Network Prevent for Web integrates with an
HTTP, HTTPS, or FTP proxy server. This integration uses the Internet Content Adaptation
Protocol (ICAP) . The Network Prevent for Web Server detects confidential data in HTTP,
HTTPS, or FTP content. When it does, it causes the proxy to reject requests or remove
HTML content as specified by the governing policies.

About Network Discover/Cloud Storage Discover

Network Discover/Cloud Storage Discover scans cloud storage repositories, networked file
shares, web content servers, databases, document repositories, and endpoint systems at high
speeds to detect exposed data and documents. Network Discover/Cloud Storage Discover
enables companies to understand exactly where confidential data is exposed and helps
significantly reduce the risk of data loss.
Network Discover/Cloud Storage Discover gives organizations the following capabilities:
■ Pinpoint unprotected confidential data. Network Discover/Cloud Storage Discover helps
organizations accurately locate at risk data that is stored on their networks. You can then
inform shared file server owners to protect the data.
■ Reduce proliferation of confidential data. Network Discover/Cloud Storage Discover helps
organizations to detect the spread of sensitive information throughout the company and
reduce the risk of data loss.
■ Automate investigations and audits. Network Discover/Cloud Storage Discover streamlines
data security investigations and compliance audits. It accomplishes this task by enabling
users to scan for confidential data automatically, as well as review access control and
encryption policies.
■ During incident remediation, Veritas Data Insight helps organizations solve the problem of
identifying data owners and responsible parties for information due to incomplete or
inaccurate metadata or tracking information.
See the Symantec Data Loss Prevention Data Insight Implementation Guide.
■ To provide additional flexibility in remediating Network Discover/Cloud Storage Discover
incidents, use the FlexResponse application programming interface (API), or the
FlexResponse plug-ins that are available.
See the Symantec Data Loss Prevention FlexResponse Platform Developers Guide, or
contact Symantec Professional Services for a list of plug-ins.
See “About Symantec Data Loss Prevention” on page 58.
 Introducing Symantec Data Loss Prevention 63
About Network Protect

About Network Protect

Network Protect reduces your risk by removing exposed confidential data, intellectual property,
and classified information from open file shares on network servers or desktop computers.
Note that there is no separate Network Protect server; the Network Protect product module
adds protection functionality to the Network Discover Server.
Network Protect gives organizations the following capabilities:
■ Apply visual tags to content in Box cloud storage. Network Protect can apply a text tag to
files that violate policies that are store in Box cloud storage.
■ Quarantine exposed files. Network Protect can automatically move those files that violate
policies to a quarantine area that re-creates the source file structure for easy location.
Optionally, Symantec Data Loss Prevention can place a marker text file in the original
location of the offending file. The marker file can explain why and where the original file
was quarantined.
■ Copy exposed or suspicious files. Network Protect can automatically copy those files that
violate policies to a quarantine area. The quarantine area can re-create the source file
structure for easy location, and leave the original file in place.
■ Quarantine file restoration. Network Protect can easily restore quarantined files to their
original or a new location.
■ Enforce access control and encryption policies. Network Protect proactively ensures
workforce compliance with existing access control and encryption policies.
See “About Symantec Data Loss Prevention” on page 58.
See “Configuring Network Protect for file shares” on page 1619.

About Endpoint Discover

Endpoint Discover detects sensitive data on your desktop or your laptop endpoints. It consists
of at least one Endpoint Server and at least one Symantec DLP Agent that runs on an endpoint.
You can have many Symantec DLP Agents connected to a single Endpoint Server. Symantec
DLP Agents:
■ Detect sensitive data in the endpoint file system.
■ Collect data on that activity.
■ Send incidents to the Endpoint Server.
■ Send the data to the associated Endpoint Server for analysis, if necessary.
See “About Endpoint Prevent” on page 64.
See “About Symantec Data Loss Prevention” on page 58.
 Introducing Symantec Data Loss Prevention 64
About Endpoint Prevent

About Endpoint Prevent

Endpoint Prevent detects and prevents sensitive data from leaving from your desktop or your
laptop endpoints. It consists of at least one Endpoint Server and all the Symantec DLP Agents
running on the endpoint systems that are connected to it. You can have many Symantec DLP
Agents connected to a single Endpoint Server. Endpoint Prevent detects on the following data
transfers:
■ Application monitoring
■ CD/DVD
■ Clipboard
■ Email/SMTP
■ eSATA removable drives
■ FTP
■ HTTP/HTTPS
■ IM
■ Network shares
■ Print/Fax
■ USB removable media devices
See “About Endpoint Discover” on page 63.
See “About Symantec Data Loss Prevention” on page 58.
 Chapter 2
Getting started
administering Symantec
Data Loss Prevention
This chapter includes the following topics:

■ About Symantec Data Loss Prevention administration

■ About the Enforce Server administration console

■ Logging on and off the Enforce Server administration console

■ About the administrator account

■ Performing initial setup tasks

■ Changing the administrator password

■ Adding an administrator email account

■ Editing a user profile

■ Changing your password

About Symantec Data Loss Prevention administration

The Symantec Data Loss Prevention system consists of one Enforce Server and one or more
detection servers.
The Enforce Server stores all system configuration, policies, saved reports, and other Symantec
Data Loss Prevention information and manages all activities.
 Getting started administering Symantec Data Loss Prevention 66
About the Enforce Server administration console

System administration is performed from the Enforce Server administration console, which is
accessed by a Firefox or Internet Explorer Web browser. The Enforce console is displayed
after you log on.
See “About the Enforce Server administration console” on page 66.
After completing the installation steps in the Symantec Data Loss Prevention Installation Guide,
you must perform initial configuration tasks to get Symantec Data Loss Prevention up and
running for the first time. These are essential tasks that you must perform before the system
can begin monitoring data on your network.
See “Performing initial setup tasks” on page 68.

About the Enforce Server administration console

You administer the Symantec Data Loss Prevention system through the Enforce Server
administration console.
The Administrator user can see and access all parts of the administration console. Other users
can see only the parts to which their roles grant them access. The user account under which
you are currently logged on appears at the top right of the screen.
When you first log on to the administration console, the default Home page is displayed. You
and your users can change the default Home page using the Home page selection button.
See Table 2-1 on page 66.
To navigate through the system, select items from one of the four menu clusters (Home,
Incidents, Manage, and System).
Located in the upper-right portion of the administration console are the following navigation
and operation icons:

Table 2-1 Administration console navigation and operation icons

Icon Description

Help. Click this icon to access the context-sensitive online help for your current page.

Select this page as your Home page. If the current screen cannot be selected as
your Home page, this icon is unavailable.

Back to previous screen. Symantec recommends using this Back button rather than
your browser Back button. Use of your browser Back button may lead to
unpredictable behavior and is not recommended.

Screen refresh. Symantec recommends using this Refresh button rather than your
browser Reload or Refresh button. Use of your browser buttons may lead to
unpredictable behavior and is not recommended.
 Getting started administering Symantec Data Loss Prevention 67
Logging on and off the Enforce Server administration console

Table 2-1 Administration console navigation and operation icons (continued)

Icon Description

Print the current report. If the current screen contents cannot be sent to the printer,
this icon is unavailable.

Email the current report to one or more recipients. If the current screen contents
cannot be sent as an email, this icon is unavailable.

See “Logging on and off the Enforce Server administration console” on page 67.

Logging on and off the Enforce Server administration

console
If you are assigned more than one role, you can only log on under one role at a time. You must
specify the role name and user name at logon.
To log on to the Enforce Server
1 On the Enforce Server host, open a browser and point it to the URL for your server (as
provided by the Symantec Data Loss Prevention administrator).
2 On the Symantec Data Loss Prevention logon screen, enter your user name in the
Username field. For the administrator role, this user name is always Administrator.
Users with multiple roles should specify the role name and the user name in the format
role\user (for example, ReportViewer\bsmith). If they do not, Symantec Data Loss
Prevention assigns the user a role upon logon.
See “Configuring roles” on page 98.
3 In the Password field, type the password. For the administrator at first logon, this password
is the password you created during the installation.
For installation details, see the appropriate Symantec Data Loss Prevention Installation
Guide.
4 Click login.
The Enforce Server administration console appears. The administrator can access all
parts of the administration console, but another user can see only those parts that are
authorized for that particular role.
To log out of the Enforce Server
1 Click logout at the top right of the screen.
2 Click OK to confirm.
Symantec Data Loss Prevention displays a message confirming the logout was successful.
 Getting started administering Symantec Data Loss Prevention 68
About the administrator account

See “Editing a user profile” on page 70.

About the administrator account

The Symantec Data Loss Prevention system is preconfigured with a permanent administrator
account. Note that the name is case sensitive and cannot be changed. You configured a
password for the administrator account during installation.
Refer to the Symantec Data Loss Prevention Installation Guide for more information.
Only the administrator can see or modify the administrator account. Role options do not appear
on the administrator configure screen, because the administrator always has access to
every part of the system.
See “Changing the administrator password” on page 69.
See “Adding an administrator email account” on page 69.

Performing initial setup tasks

After completing the installation steps in the Symantec Data Loss Prevention Installation Guide,
you must perform initial configuration tasks to get Symantec Data Loss Prevention up and
running for the first time. These are essential tasks that you must perform before the system
can begin monitoring data on your network.
■ Change the Administrator's password to a unique password only you know, and add an
email address for the Administrator user account so you can be notified of various system
events.
See “About the administrator account” on page 68.
■ Add and configure your detection servers.
See “Adding a detection server” on page 234.
See “Server configuration—basic” on page 213.
■ Add any user accounts you need in addition to those supplied by your Symantec Data Loss
Prevention solution pack.
■ Review the policy templates provided with your Symantec Data Loss Prevention solution
pack to familiarize yourself with their content and data requirements. Revise the polices or
create new ones as needed.
■ Add the data profiles that you plan to associate with policies.
Data profiles are not always required. This step is necessary only if you are licensed for
data profiles and if you intend to use them in policies.
 Getting started administering Symantec Data Loss Prevention 69
Changing the administrator password

Changing the administrator password

During installation, you created a generic administrator password. When you log on for the
first time, you should change this password to a unique, secret password.
See the Symantec Data Loss Prevention Installation Guide for more information.
Passwords are case-sensitive and they must contain at least eight characters.
Note that you can configure Symantec Data Loss Prevention to require strong passwords.
Strong passwords are passwords specifically designed to be difficult to break. Password policy
is configured from the System > Settings > General > Configure screen.
When your password expires, Symantec Data Loss Prevention displays the Password Renewal
window at the next logon. When the Password Renewal window appears, type your old
password, and then type your new password and confirm it.
See “Configuring user accounts” on page 105.
To change the administrator password
1 Log on as administrator.
2 Click Profile in the upper-right corner of the administration console.
3 On the Edit Profile screen:
■ Enter your new password in the New Password field.
■ Re-enter your new password in the Re-enter New Password field. The two new
passwords must be identical.
Note that passwords are case-sensitive.
4 Click Save.
See “About the administrator account” on page 68.
See “About the Enforce Server administration console” on page 66.
See “About the Overview screen” on page 239.

Adding an administrator email account

You can specify an email address to receive administrator account related messages.
 Getting started administering Symantec Data Loss Prevention 70
Editing a user profile

To add or change an administrator email account

1 Click Profile in the upper-right corner of the administration console.
2 Type the new (or changed) administrator email address in the email Address field.
The email addresses must include a fully qualified domain name. For example:
my_name@acme.com.

3 Click Save.
See “About the administrator account” on page 68.
See “About the Enforce Server administration console” on page 66.
See “About the Overview screen” on page 239.

Editing a user profile

System users can use the Profile screen to configure their profile passwords, email addresses,
and languages.
Users can also specify their report preferences at the Profile screen.
To display the Profile screen, click the drop-down list at the top-right of the Enforce Server
administration console, then select Profile.
The Profile screen is divided into the following sections:
■ Authentication. Use this section to change your password, or select certificate
authentication, if available.
■ General. Use this section to specify your email address, choose a language preference,
and view your selected home page.
■ Report Preferences. Use this section to specify your preferred text encoding, CSV delimiter,
and XML export preferences.
■ Roles This section displays your role. Note that this section is not displayed for the
administrator because the administrator is authorized to perform all roles.

The Authentication section:

To change your password
1 Enter your new password in the New Password field.
2 Re-enter your new password in the Re-enter New Password field.
3 Click Save.
 Getting started administering Symantec Data Loss Prevention 71
Editing a user profile

To use certificate authentication

1 If certificate authentication is available to you, select Use Certificate authentication.
2 Enter your LDAP common name (CN) in the Common Name (CN) field.
3 Click Save.

The General section:

The next time you log on, you must use your new password.
See “Changing your password” on page 72.
To specify a new personal email address
1 In the Email Address field enter your personal email address.
2 Click Save.
Individual Symantec Data Loss Prevention users can choose which of the available languages
and locales they want to use.
To choose a language for individual use
1 Click the option next to your language choice.
2 Click Save.
The Enforce Server administration console is re-displayed in the new language.
Choosing a language profile has no effect on the detection of policy violations. Detection is
performed on all content that is written in any supported language regardless of the language
you choose for your profile.
See “About support for character sets, languages, and locales” on page 74.
The languages available to you are determined when the product is installed and the later
addition of language packs for Symantec Data Loss Prevention. The effect of choosing a
different language varies as follows:
■ Locale only. If the language you choose has the notice Translations not available, dates
and numbers are displayed in formats appropriate for the language. Reports and lists are
sorted in accordance with that language. But the administration console menus, labels,
screens, and Help system are not translated and remain in English.
See “About locales” on page 79.
■ Translated. The language you choose may not display the notice Translations not available.
In this case, in addition to the number and date format, and sort order, the administration
console menus, labels, screens, and in some cases the Help system, are translated into
the chosen language.
See “About Symantec Data Loss Prevention language packs” on page 78.
 Getting started administering Symantec Data Loss Prevention 72
Changing your password

The Report Preferences section:

To select your text encoding
1 Select a text encoding option:
■ Use browser default encoding. Check this box to specify that text files use the same
encoding as your browser.
■ Pull down menu. Click on an encoding option in the pull down menu to select it.

2 Click Save.
The new text encoding is applied to CSV exported files. This encoding lets you select a
text encoding that matches the encoding that is expected by CSV applications.
To select a CSV delimiter
1 Choose one of the delimiters from the pull-down menu.
2 Click Save.
The new delimiter is applied to the next comma-separated values (CSV) list that you
export.
See “About incident reports” on page 1354.
See “Exporting incident reports” on page 1373.
To select XML export details
1 Include Incident Violations in XML Export. If this box is checked, reports exported to
XML include the highlighted matches on each incident snapshot.
2 Include Incident History in XML Export. If this box is checked, reports exported to XML
include the incident history data that is contained in the History tab of each incident
snapshot.
3 Click Save.
Your selections are applied to the next report you export to XML.
If neither box is checked, the exported XML report contains only the basic incident information.
See “About incident reports” on page 1354.
See “Exporting incident reports” on page 1373.

Changing your password

When your password expires, Symantec Data Loss Prevention displays the Password Renewal
window at the next logon. When the Password Renewal window appears, enter your new
password and confirm it.
 Getting started administering Symantec Data Loss Prevention 73
Changing your password

When your password expires, the system requires you to specify a new one the next time you
attempt to log on. If you are required to change your password, the Password Renewal window
appears.
To change your password from the Password Renewal window
1 Enter your old password in the Old password field of the Password Renewal window.
2 Enter your new password in the New Password field of the Password Renewal window.
3 Re-enter your new password in the Re-enter New Password field of the Password
Renewal window.
The next time you log on, you must use your new password.
You can also change your password at any time from the Profile screen.
See “Editing a user profile” on page 70.
See “About the administrator account” on page 68.
See “Logging on and off the Enforce Server administration console” on page 67.
 Chapter 3
Working with languages
and locales
This chapter includes the following topics:

■ About support for character sets, languages, and locales

■ Supported languages for detection

■ Working with international characters

■ About Symantec Data Loss Prevention language packs

■ About locales

■ Using a non-English language on the Enforce Server administration console

■ Using the Language Pack Utility

About support for character sets, languages, and

locales
Symantec Data Loss Prevention fully supports international deployments by offering a large
number of languages and localization options:
■ Policy creation and violation detection across many languages.
The supported languages can be used in keywords, data identifiers, regular expressions,
exact data profiles (EDM) and document profiles (IDM).
See “Supported languages for detection” on page 75.
■ Operation on localized and Multilingual User Interface (MUI) versions of Windows operating
systems.
 Working with languages and locales 75
Supported languages for detection

■ International character sets. To view and work with international character sets, the system
on which you are viewing the Enforce Server administration console must have the
appropriate capabilities.
See “Working with international characters” on page 77.
■ Locale-based date and number formats, as well as sort orders for lists and reports.
See “About locales” on page 79.
■ Localized user interface (UI) and Help system. Language packs for Symantec Data Loss
Prevention provide language-specific versions of the Enforce Server administration console.
They may also provide language-specific versions of the online Help system.

Note: These language packs are added separately following initial product installation.

■ Localized product documentation.

■ Language-specific notification pop-ups. Endpoint notification pop-ups appear in the display
language that is selected on the endpoint instead of the system locale language. For
example, if the system locale is set to English and the user sets the display language to
German, the notification pop-up appears in German.

Note: A mixed language notification pop-up displays if the user locale language does not
match the language used in the response rule.

Supported languages for detection

Symantec Data Loss Prevention supports a large number of languages for detection. Policies
can be defined that accurately detect and report on the violations that are found in content in
these languages.

Table 3-1 Languages supported by Symantec Data Loss Prevention

Language Version 14.x Version 14.6 Version 15.0

Arabic Yes Yes Yes

Brazilian Portuguese Yes Yes Yes

Chinese (traditional) Yes Yes Yes

Chinese (simplified) Yes Yes Yes

Czech Yes Yes Yes

 Working with languages and locales 76
Supported languages for detection

Table 3-1 Languages supported by Symantec Data Loss Prevention

(continued)

Language Version 14.x Version 14.6 Version 15.0

Danish Yes Yes Yes

Dutch Yes Yes Yes

English Yes Yes Yes

Finnish Yes Yes Yes

French Yes Yes Yes

German Yes Yes Yes

Greek Yes Yes Yes

Hebrew Yes Yes Yes

Hungarian Yes Yes Yes

Italian Yes Yes Yes

Japanese Yes Yes Yes

Korean Yes Yes Yes

Norwegian Yes Yes Yes

Polish Yes Yes Yes

Portuguese Yes Yes Yes

Romanian Yes Yes Yes

Russian Yes Yes Yes

Spanish Yes Yes Yes

Swedish Yes Yes Yes

Turkish Yes* Yes* Yes*

*Symantec Data Loss Prevention cannot be installed on a Windows operating system that is
localized for the Turkish language, and you cannot choose Turkish as an alternate locale.
For additional information about specific languages, see the Symantec Data Loss Prevention
Release Notes.
A number of capabilities are not implied by this support:
 Working with languages and locales 77
Working with international characters

■ Technical support provided in a non-English language. Because Symantec Data Loss

Prevention supports a particular language does not imply that technical support is delivered
in that language.
■ Localized administrative user interface (UI) and documentation. Support for a language
does not imply that the UI or product documentation has been localized into that language.
However, even without a localized UI, user-defined portions of the UI such as pop-up
notification messages on the endpoint can still be localized into any language by entering
the appropriate text in the UI.
■ Localized content. Keywords are used in a number of areas of the product, including policy
templates and data identifiers. Support for a language does not imply that these keywords
have been translated into that language. Users may, however, add keywords in the new
language through the Enforce Server administration console.
■ New file types, protocols, applications, or encodings. Support for a language does not imply
support for any new file types, protocols, applications, or encodings that may be prevalent
in that language or region other than what is already supported in the product.
■ Language-specific normalization. An example of normalization is to treat accented and
unaccented versions of a character as the same. The product already performs a number
of normalizations, including standard Unicode normalization that should cover the vast
majority of cases. However, it does not mean that all potential normalizations are included.
■ Region-specific normalization and validation. An example of this is the awareness that the
product has of the format of North American phone numbers, which allows it to treat different
versions of a number as the same, and to identify invalid numbers in EDM source files.
Support for a language does not imply this kind of functionality for that language or region.
Items in these excluded categories are tracked as individual product enhancements on a
language- or region-specific basis. Contact Symantec Technical Support for additional
information on language-related enhancements or plans for the languages not listed.
See “About support for character sets, languages, and locales” on page 74.

Working with international characters

You can use a variety of languages in Symantec Data Loss Prevention, based on:
■ The operating system-based character set installed on the computer from which you view
the Enforce Server administration console
■ The capabilities of your browser
For example, an incident report on a scan of Russian-language data would contain Cyrillic
characters. To view that report, the computer and browser you use to access the Enforce
Server administration console must be capable of displaying these characters. Here are some
general guidelines:
 Working with languages and locales 78
About Symantec Data Loss Prevention language packs

■ If the computer you use to access the Enforce Server administration console has an
operating system localized for a particular language, you should be able to view and use
a character set that supports that language.
■ If the operating system of the computer you use to access the administration console is
not localized for a particular language, you may need to add supplemental language support.
This supplemental language support is added to the computer you use to access the
administration console, not on the Enforce Server.
■ On a Windows system, you add supplemental language support using the Control
Panel > Regional and Language Options > Languages (tab) - Supplemental
Language Support to add fonts for some character sets.

■ It may also be necessary to set your browser to accommodate the characters you want to
view and enter.

Note: The Enforce Server administration console supports UTF-8 encoded data.

■ On a Windows system, it may also be necessary to use the Languages – Supplemental

Language Support tab under Control Panel > Regional and Language Options to add
fonts for some character sets.
See the Symantec Data Loss Prevention Release Notes for known issues regarding specific
languages.
See “About support for character sets, languages, and locales” on page 74.

About Symantec Data Loss Prevention language packs

Language packs for Symantec Data Loss Prevention localize the product for a particular
language on Windows-based systems. After a language pack has been added to Symantec
Data Loss Prevention, administrators can specify it as the system-wide default. If multiple
language packs have been made available by the administrator for use, individual users can
choose the language they want to work in.
See “Using a non-English language on the Enforce Server administration console” on page 79.
Language pack selection results in the following:
■ Its locale becomes available to administrators and end users in Enforce Server
Configuration screen.
■ Enforce Server screens, menu items, commands, and messages appear in the language.
■ The Symantec Data Loss Prevention Help system may be displayed in the language.
Language packs for Symantec Data Loss Prevention are available from Symantec File Connect.
 Working with languages and locales 79
About locales

Caution: When you install a new version of Symantec Data Loss Prevention, any language
packs you have installed are deleted. For a new, localized version of Symantec Data Loss
Prevention, you must upgrade to a new version of the language pack.

See “About locales” on page 79.

See “About support for character sets, languages, and locales” on page 74.

About locales
A locale provides the following:
■ Displays dates and numbers in formats appropriate for that locale.
■ Sorts lists and reports based on text columns, such as "policy name" or "file owner,"
alphabetically according to the rules of the locale.
Locales are installed as part of a language pack.
An administrator can also configure an additional locale for use by individual users. This
additional locale need only be supported by the required version of Java.
For a list of these locales, see
http://www.oracle.com/technetwork/java/javase/javase7locales-334809.html.

The locale can be specified at product installation time, as described in the Symantec Data
Loss Prevention Installation Guide. It can also be configured at a later time using the Language
Pack Utility.
See “Using a non-English language on the Enforce Server administration console” on page 79.
See “About support for character sets, languages, and locales” on page 74.

Using a non-English language on the Enforce Server

administration console
The use of locales and languages is specified through the Enforce Server administration
console by the following roles:
■ Symantec Data Loss Prevention administrator. Specifies that one of the available languages
be the default system-wide language and sets the locale.
■ Individual Symantec Data Loss Prevention user. Chooses which of the available locales
to use.
 Working with languages and locales 80
Using the Language Pack Utility

Note: The addition of multiple language packs could slightly affect Enforce Server performance,
depending on the number of languages and customizations present. This results because an
additional set of indexes has to be built and maintained for each language.

Warning: Do not modify the Oracle database NLS_LANGUAGE and NLS_TERRITORY settings.

See “About Symantec Data Loss Prevention language packs” on page 78.
See “About locales” on page 79.
A Symantec Data Loss Prevention administrator specifies which of the available languages
is the default system-wide language.
To choose the default language for all users
1 On the Enforce Server, go to System > Settings > General and click Configure.
The Edit General Settings screen is displayed.
2 Scroll to the Language section of the Edit General Settings screen, and click the button
next to the language you want to use as the system-wide default.
3 Click Save.
Individual Symantec Data Loss Prevention users can choose which of the available languages
and locales they want to use by updating their profiles.
See “Editing a user profile” on page 70.
Administrators can use the Language Pack Utility to update the available languages.
See “Using the Language Pack Utility” on page 80.
See “About support for character sets, languages, and locales” on page 74.

Note: If the Enforce Server runs on a Linux host, you must install language fonts on the host
machine using the Linux Package Manager application. Language font packages begin with
fonts-<language_name>. For example, fonts-japanese-0.20061016-4.el5.noarch

Using the Language Pack Utility

To make a specific locale available for Symantec Data Loss Prevention, you add language
packs through the Language Pack Utility.
You run the Language Pack Utility from the command line. Its executable,
LanguagePackUtility.exe, resides in the \SymantecDLP\Protect\bin directory.
 Working with languages and locales 81
Using the Language Pack Utility

To use the Language Pack Utility, you must have Read, Write, and Execute permissions on
all of the \SymantecDLP folders and subfolders.
To display help for the utility, such as the list of valid options and their flags, enter
LanguagePackUtility without any flags.

Note: Running the Language Pack Utility causes the VontuManager and
VontuIncidentPersister services to stop for as long as 20 seconds. Any users who are
logged on to the Enforce Server administration console will be logged out automatically. When
finished making its updates, the utility restarts the services automatically, and users can log
back on to the administration console.

Language packs for Symantec Data Loss Prevention can be obtained from Symantec File
Connect.
To add a language pack (Windows)
1 Advise other users that anyone currently using the Enforce Server administration console
must save their work and log off.
2 Run the Language Pack Utility with the -a flag followed by the name of the ZIP file for
that language pack. Enter:

LanguagePackUtility -a filename

where filename is the fully qualified path and name of the language pack ZIP file.
For example, if the Japanese language pack ZIP file is stored in c:\temp, add it by entering:

LanguagePackUtility -a c:\temp\Symantec_DLP_15.0_Japanese.zip

To add multiple language packs during the same session, specify multiple file names,
separated by spaces, for example:

LanguagePackUtility -a
c:\temp\Symantec_DLP_15.0_Japanese.zip
Symantec_DLP_15.0_Chinese.zip

3 Log on to the Enforce Server administration console and confirm that the new language
option is available on the Edit General Settings screen. To do this, go to System >
Settings > General > Configure > Edit General Settings.
 Working with languages and locales 82
Using the Language Pack Utility

To add a language pack (Linux)

1 Advise other users that anyone currently using the Enforce Server administration console
must save their work and log off.
2 Open a terminal session to the Enforce Server host and switch to the DLP_system_account
by running the following command:
su - DLP_system_account

3 Run the following command:

DLP_home/Protect/bin/LanguagePackUtility -a <path to language pack zip
file>

4 Log on to the Enforce Server administration console and confirm that the new language
option is available on the Edit General Settings screen. To do this, go to System >
Settings > General > Configure > Edit General Settings.
To remove a language pack
1 Advise users that anyone currently using the Enforce Server administration console must
save their work and log off.
2 Run the Language Pack Utility with the -r flag followed by the Java locale code of the
language pack you want to remove. Enter:

LanguagePackUtility -r locale

where locale is a valid Java locale code corresponding to a Symantec Data Loss Prevention
language pack.
For example, to remove the French language pack enter:

LanguagePackUtility -r fr_FR

To remove multiple language packs during the same session, specify multiple file names,
separated by spaces.
3 Log on to the Enforce Server administration console and confirm that the language pack
is no longer available on the Edit General Settings screen. To do this, go to System >
Settings > General > Configure > Edit General Settings.
Removing a language pack has the following effects:
■ Users can no longer select the locale of the removed language pack for individual use.

Note: If the locale of the language pack is supported by the version of Java required for
running Symantec Data Loss Prevention, the administrator can later specify it as an alternate
locale for any users who need it.
 Working with languages and locales 83
Using the Language Pack Utility

■ The locale reverts to the system-wide default configured by the administrator.

■ If the removed language was the system-wide default locale, the system locale reverts to
English.
To change or add a locale
1 Advise users that anyone currently using the Enforce Server administration console must
save their work and log off.
2 Run the Language Pack Utility using the -c flag followed by the Java locale code for the
locale that you want to change or add. Enter:

LanguagePackUtility -c locale

where locale is a valid locale code recognized by Java, such as pt_PT for Portuguese.
For example, to change the locale to Brazilian Portuguese enter:

LanguagePackUtility -c pt_BR

3 Log on to the Enforce Server administration console and confirm that the new alternate
locale is now available on the Edit General Settings screen. To do this, go to System >
Settings > General > Configure > Edit General Settings.
If you specify a locale for which there is no language pack, "Translations not available"
appears next to the locale name. This means that formatting and sort order are appropriate
for the locale, but the Enforce Server administration console screens and online Help are
not translated.

Note: Administrators can only make one additional locale available for users that is not based
on a previously installed Symantec Data Loss Prevention language pack.

See “About support for character sets, languages, and locales” on page 74.
 Section 2
Managing the Enforce Server
platform

■ Chapter 4. Managing Enforce Server services and settings

■ Chapter 5. Managing roles and users

■ Chapter 6. Connecting to group directories

■ Chapter 7. Managing stored credentials

■ Chapter 8. Managing system events and messages

■ Chapter 9. Managing the Symantec Data Loss Prevention database

■ Chapter 10. Working with Symantec Information Centric Encryption

■ Chapter 11. Adding a new product module

 Chapter 4
Managing Enforce Server
services and settings
This chapter includes the following topics:

■ About Symantec Data Loss Prevention services

■ About starting and stopping services on Windows

■ Starting and stopping services on Linux

About Symantec Data Loss Prevention services

The Symantec Data Loss Prevention services may need to be stopped and started periodically.
This section provides a brief description of each service and how to start and stop the services
on supported platforms.
The Symantec Data Loss Prevention services for the Enforce Server are described in the
following table:

Table 4-1 Symantec Data Loss Prevention services

Service Name Description

Vontu Manager Provides the centralized reporting and management services for Symantec
Data Loss Prevention.

Vontu Detection Server Controls the detection servers.

Controller

Vontu Notifier Provides the database notifications.

Vontu Incident Persister Writes the incidents to the database.

Vontu Update Installs the Symantec Data Loss Prevention system updates.
 Managing Enforce Server services and settings 86
About starting and stopping services on Windows

See “About starting and stopping services on Windows” on page 86.

About starting and stopping services on Windows

The procedures for starting and stopping services vary according to installation configurations
and between Enforce and detection servers.
■ See “Starting an Enforce Server on Windows” on page 86.
■ See “Stopping an Enforce Server on Windows” on page 86.
■ See “Starting a Detection Server on Windows” on page 87.
■ See “Stopping a Detection Server on Windows” on page 87.
■ See “Starting services on single-tier Windows installations” on page 88.
■ See “Stopping services on single-tier Windows installations” on page 88.

Starting an Enforce Server on Windows

Use the following procedure to start the Symantec Data Loss Prevention services on a Windows
Enforce Server.
To start the Symantec Data Loss Prevention services on a Windows Enforce Server
1 On the computer that hosts the Enforce Server, navigate to Start > All Programs >
Administrative Tools > Services to open the Windows Services menu.
2 Start the Symantec Data Loss Prevention services in the following order:
■ VontuNotifier

■ VontuManager

■ VontuIncidentPersister

■ VontuMonitorController (if applicable)

■ VontuUpdate (if necessary)

Note: Start the VontuNotifier service first before starting other services.

See “Stopping an Enforce Server on Windows” on page 86.

Stopping an Enforce Server on Windows

Use the following procedure to stop the Symantec Data Loss Prevention services on a Windows
Enforce Server.
 Managing Enforce Server services and settings 87
About starting and stopping services on Windows

To stop the Symantec Data Loss Prevention Services on a Windows Enforce Server
1 On the computer that hosts the Enforce Server, navigate to Start > All Programs >
Administrative Tools > Services to open the Windows Services menu.
2 From the Services menu, stop all running Symantec Data Loss Prevention services in the
following order:
■ VontuMonitorController (if applicable)

■ VontuIncidentPersister

■ VontuManager

■ VontuNotifier

■ VontuUpdate (if necessary)

See “Starting an Enforce Server on Windows” on page 86.

Starting a Detection Server on Windows

To start the Symantec Data Loss Prevention services on a Windows detection server
1 On the computer that hosts the detection server, navigate to Start > All Programs >
Administrative Tools > Services to open the Windows Services menu.
2 Start the Symantec Data Loss Prevention services, which might include the following
services:
■ VontuMonitor

■ VontuUpdate

See “Stopping a Detection Server on Windows” on page 87.

Stopping a Detection Server on Windows

Use the following procedure to stop the Symantec Data Loss Prevention services on a Windows
detection server.
To stop the Symantec Data Loss Prevention Services on a Windows detection server
1 On the computer that hosts the detection server, navigate to Start > All Programs >
Administrative Tools > Services to open the Windows Services menu.
2 From the Services menu, stop all running Symantec Data Loss Prevention services,
which might include the following services:
■ VontuUpdate

■ VontuMonitor
 Managing Enforce Server services and settings 88
About starting and stopping services on Windows

See “Starting a Detection Server on Windows” on page 87.

Starting services on single-tier Windows installations

Use the following procedure to start the Symantec Data Loss Prevention services on a single-tier
installation on Windows.
To start the Symantec Data Loss Prevention services on a single-tier Windows installation
1 On the computer that hosts the Symantec Data Loss Prevention server applications,
navigate to Start > All Programs > Administrative Tools > Services to open the Windows
Services menu.
2 Start the Symantec Data Loss Prevention in the following order:
■ VontuNotifier

■ VontuManager

■ VontuIncidentPersister

■ VontuMonitorController (if applicable)

■ VontuMonitor

■ VontuUpdate (if necessary)

Note: Start the VontuNotifier service before starting other services.

See “Stopping services on single-tier Windows installations” on page 88.

Stopping services on single-tier Windows installations

Use the following procedure to stop the Symantec Data Loss Prevention services on a single-tier
installation on Windows.
To stop the Symantec Data Loss Prevention services on a single-tier Windows installation
1 On the computer that hosts the Symantec Data Loss Prevention server applications,
navigate to Start > All Programs > Administrative Tools > Services to open the Windows
Services menu.
2 From the Services menu, stop all running Symantec Data Loss Prevention services in the
following order:
■ VontuMonitor

■ VontuMonitorController (if applicable)

■ VontuIncidentPersister
 Managing Enforce Server services and settings 89
Starting and stopping services on Linux

■ VontuManager

■ VontuNotifier

■ VontuUpdate (if necessary)

See “Starting services on single-tier Windows installations” on page 88.

Starting and stopping services on Linux

The procedures for starting and stopping services vary according to installation configurations
and between Enforce and detection servers.
■ See “Starting an Enforce Server on Linux” on page 89.
■ See “Stopping an Enforce Server on Linux” on page 90.
■ See “Starting a detection server on Linux” on page 90.
■ See “Stopping a detection server on Linux” on page 90.
■ See “Starting services on single-tier Linux installations” on page 91.
■ See “Stopping services on single-tier Linux installations” on page 91.

Starting an Enforce Server on Linux

Use the following procedure to start the Symantec Data Loss Prevention services on a Linux
Enforce Server.
To start the Symantec Data Loss Prevention services on a Linux Enforce Server
1 On the computer that hosts the Enforce Server, log on as root.
2 Change directory to /opt/SymantecDLP/Protect/bin.
3 Before starting other Symantec Data Loss Prevention services, to start the Vontu Notifier
service, enter:

./VontuNotifier.sh start

4 To start the remaining Symantec Data Loss Prevention services, enter:

./VontuManager.sh start
./VontuIncidentPersister.sh start
./VontuUpdate.sh start
./VontuMonitorController.sh start

See “Stopping an Enforce Server on Linux” on page 90.

 Managing Enforce Server services and settings 90
Starting and stopping services on Linux

Stopping an Enforce Server on Linux

Use the following procedure to stop the Symantec Data Loss Prevention services on a Linux
Enforce Server.
To stop the Symantec Data Loss Prevention services on a Linux Enforce Server
1 On the computer that hosts the Enforce Server, log on as root.
2 Change directory to /opt/SymantecDLP/Protect/bin.
3 To stop all running Symantec Data Loss Prevention services, enter:

./VontuUpdate.sh stop
./VontuIncidentPersister.sh stop
./VontuManager.sh stop
./VontuMonitorController.sh stop
./VontuNotifier.sh stop

See “Starting an Enforce Server on Linux” on page 89.

Starting a detection server on Linux

Use the following procedure to start the Symantec Data Loss Prevention services on a Linux
detection server.
To start the Symantec Data Loss Prevention services on a Linux detection server
1 On the computer that hosts the detection server, log on as root.
2 Change directory to /opt/SymantecDLP/Protect/bin.
3 To start the Symantec Data Loss Prevention services, enter:

./VontuMonitor.sh start
./VontuUpdate.sh start

See “Stopping a detection server on Linux” on page 90.

Stopping a detection server on Linux

Use the following procedure to stop the Symantec Data Loss Prevention services on a Linux
detection server.
 Managing Enforce Server services and settings 91
Starting and stopping services on Linux

To stop the Symantec Data Loss Prevention services on a Linux detection server
1 On the computer that hosts the detection server, log on as root.
2 Change directory to /opt/SymantecDLP/Protect/bin.
3 To stop all running Symantec Data Loss Prevention services, enter:

./SyamantecDLPUpdate.sh stop
./VontuMonitor.sh stop

See “Starting a detection server on Linux” on page 90.

Starting services on single-tier Linux installations

Use the following procedure to start the Symantec Data Loss Prevention services on a single-tier
installation on Linux.
To start the Symantec Data Loss Prevention services on a single-tier Linux installation
1 On the computer that hosts the Symantec Data Loss Prevention server applications, log
on as root.
2 Change directory to /opt/SymantecDLP/Protect/bin.
3 Before starting other Symantec Data Loss Prevention services, to start the Vontu Notifier
service, enter:

./VontuNotifier.sh start

4 To start the remaining Symantec Data Loss Prevention services, enter:

./VontuManager.sh start
./VontuMonitor.sh start
./VontuIncidentPersister.sh start
./VontuUpdate.sh start
./VontuMonitorController.sh start

See “Stopping services on single-tier Linux installations” on page 91.

Stopping services on single-tier Linux installations

Use the following procedure to stop the Symantec Data Loss Prevention services on a single-tier
installation on Linux.
 Managing Enforce Server services and settings 92
Starting and stopping services on Linux

To stop the Symantec Data Loss Prevention services on a single-tier Linux installation
1 On the computer that hosts the Symantec Data Loss Prevention servers, log on as root.
2 Change directory to /opt/SymantecDLP/Protect/bin.
3 To stop all running Symantec Data Loss Prevention services, enter:

./VontuUpdate.sh stop
./VontuIncidentPersister.sh stop
./VontuManager.sh stop
./VontuMonitor.sh stop
./VontuMonitorController.sh stop
./VontuNotifier.sh stop

See “Starting services on single-tier Linux installations” on page 91.

 Chapter 5
Managing roles and users
This chapter includes the following topics:

■ About role-based access control

■ About configuring roles and users

■ About recommended roles for your organization

■ Roles included with solution packs

■ Configuring roles

■ Configuring user accounts

■ Configuring password enforcement settings

■ Resetting the Administrator password

■ Manage and add roles

■ Manage and add users

■ About authenticating users

■ Configuring user authentication

■ Integrating Active Directory for user authentication

■ About certificate authentication configuration

About role-based access control

Symantec Data Loss Prevention provides role-based access control to govern how users
access product features and functionality. For example, a role might let users view reports,
but prevent users from creating policies or deleting incidents. Or, a role might let users author
policy response rules but not detection rules.
 Managing roles and users 94
About configuring roles and users

Roles determine what a user can see and do in the Enforce Server administration console.
For example, the Report role is a specific role that is included in most Symantec Data Loss
Prevention solution packs. Users in the Report role can view incidents and create policies,
and configure Discover targets (if you are running a Discover Server). However, users in the
Report role cannot create Exact Data or Document Profiles. Also, users in the Report role
cannot perform system administration tasks. When a user logs on to the system in the Report
role, the Manage > Data Profiles and the System > Login Management modules in the
Enforce Server administration console are not visible to this user.
You can assign a user to more than one role. Membership in multiple roles allows a user to
perform different kinds of work in the system. For example, you grant the information security
manager user (InfoSec Manager) membership in two roles: ISR (information security first
responder) and ISM (information security manager). The InfoSec Manager can log on to the
system as either a first responder (ISR) or a manager (ISM), depending on the task(s) to
perform. The InfoSec Manager only sees the Enforce Server components appropriate for those
tasks.
You can also combine roles and policy groups to limit the policies and detection servers that
a user can configure. For example, you associate a role with the European Office policy group.
This role grants access to the policies that are designed only for the European office.
See “Policy deployment” on page 332.
Users who are assigned to multiple roles must specify the desired role at log on. Consider an
example where you assign the user named "User01" to two roles, "Report" and "System
Admin." If "User01" wanted to log on to the system to administer the system, the user would
log on with the following syntax: Login: System Admin\User01
See “Logging on and off the Enforce Server administration console” on page 67.
The Administrator user (created during installation) has access to every part of the system
and therefore is not a member of any access-control role.
See “About the administrator account” on page 68.

About configuring roles and users

When you install the Enforce Server, you create a default Administrator user that has access
to all roles. If you import a solution pack to the Enforce Server, the solution pack includes
several roles and users to get you started.
See “About the administrator account” on page 68.
You may want to add roles and users to the Enforce Server. When adding roles and users,
consider the following guidelines:
■ Understand the roles necessary for your business users and for the information security
requirements and procedures of your organization.
 Managing roles and users 95
About recommended roles for your organization

See “About recommended roles for your organization” on page 95.

■ Review the roles that created when you installed a solution pack. You can likely use several
of them (or modified versions of them) for users in your organization.
See “Roles included with solution packs” on page 96.
■ If necessary, modify the solution-pack roles and create any required new roles.
See “Configuring roles” on page 98.
■ Create users and assign each of them to one or more roles.
See “Configuring user accounts” on page 105.
■ Manage roles and users and remove those not being used.
See “Manage and add roles” on page 110.
See “Manage and add users” on page 110.

About recommended roles for your organization

To determine the most useful roles for your organization, review your business processes and
security requirements.
Most businesses and organizations find the following roles fundamental when they implement
the Symantec Data Loss Prevention system:
■ System Administrator
This role provides access to the System module and associated menu options in the
Enforce Server administration console. Users in this role can monitor and manage the
Enforce Server and detection servers(s). Users in this role can also deploy detection servers
and run Discover scans. However, users in this role cannot view detailed incident information
or author policies. All solution packs create a "Sys Admin" role that has system administrator
privileges.
■ User Administrator
This role grants users the right to manage users and roles. Typically this role grants no
other access or privileges. Because of the potential for misuse, it is recommended that no
more than two people in the organization be assigned this role (primary and backup).
■ Policy Admininistrator
This role grants users the right to manage policies and response rules. Typically this role
grants no other access or privileges. Because of the potential for misuse, it is recommended
that no more than two people in the organization be assigned this role (primary and backup).
■ Policy Author
This role provides access to the Policies module and associated menu options in the
Enforce Server administration console. This role is suited for information security managers
who track incidents and respond to risk trends. An information security manager can author
 Managing roles and users 96
Roles included with solution packs

new policies or modifying existing policies to prevent data loss. All solution packs create
an "InfoSec Manager" (ISM) role that has policy authoring privileges.
■ Incident Responder
This role provides access to the Incidents module and associated menu options in the
Enforce Server administration console. Users in this role can track and remediate incidents.
Businesses often have at least two incident responder roles that provide two levels of
privileges for viewing and responding to incidents.
A first-level responder may view generic incident information, but cannot access incident
details (such as sender or recipient identity). In addition, a first-level responder may also
perform some incident remediation, such as escalating an incident or informing the violator
of corporate security policies. A second-level responder might be escalation responder
who has the ability to view incident details and edit custom attributes. A third-level responder
might be an investigation responder who can create response rules, author policies, and
create policy groups.
All solution packs create an "InfoSec Responder" (ISR) role. This role serves as a first-level
responder. You can use the ISM (InfoSec Manager) role to provide second-level responder
access.
Your business probably requires variations on these roles, as well as other roles. For more
ideas about these and other possible roles, see the descriptions of the roles that are imported
with solution packs.
See “Roles included with solution packs” on page 96.

Roles included with solution packs

The various solution packs offered with Symantec Data Loss Prevention create roles and users
when installed. For all solution packs there is a standard set of roles and users. You may see
some variation in those roles and users, depending on the solution pack you import.
The following table summarizes the Financial Services Solution Pack roles. These roles are
largely the same as the roles that are found in other Symantec Data Loss Prevention solution
packs.
See Table 5-1 on page 97.
 Managing roles and users 97
Roles included with solution packs

Table 5-1 Financial Services Solution Pack roles

Role Name Description

Compliance Compliance Officer:

■ Users in this role can view, remediate, and delete incidents; look up attributes;
and edit all custom attributes.
■ This comprehensive role provides users with privileges to ensure that
compliance regulations are met. It also allows users to develop strategies for
risk reduction at a business unit (BU) level, and view incident trends and risk
scorecards.

Exec Executive:

■ Users in this role can view, remediate, and delete incidents; look up attributes;
and view all custom attributes.
■ This role provides users with access privileges to prevent data loss risk at the
macro level. Users in this role can review the risk trends and performance
metrics, as well as incident dashboards.

HRM HR Manager:

■ Users in this role can view, remediate, and delete incidents; look up attributes;
and edit all custom attributes.
■ This role provides users with access privileges to respond to the security
incidents that are related to employee breaches.

Investigator Incident Investigator:

■ Users in this role can view, remediate, and delete incidents; look up attributes;
and edit all custom attributes.
■ This role provides users with access privileges to research details of incidents,
including forwarding incidents to forensics. Users in this role may also
investigate specific employees.

ISM InfoSec Manager:

■ Users in this role can view, remediate, and delete incidents. They can look
up attributes, edit all custom attributes, author policies and response rules.
■ This role provides users with second-level incident response privileges. Users
can manage escalated incidents within information security team.

ISR InfoSec Responder:

■ Users in this role can view, remediate, and delete incidents; look up attributes;
and view or edit some custom attributes. They have no access to sender or
recipient identity details.
■ This role provides users with first-level incident response privileges. Users
can view policy incidents, find broken business processes, and enlist the
support of the extended remediation team to remediate incidents.
 Managing roles and users 98
Configuring roles

Table 5-1 Financial Services Solution Pack roles (continued)

Role Name Description

Report Reporting and Policy Authoring:

■ Users in this role can view and remediate incidents, and author policies. They
have no access to incident details.
■ This role provides a single role for policy authoring and data loss risk
management.

Sys Admin System administrator:

■ Users in this role can administer the system and the system users, and can
view incidents. They have no access to incident details.

Configuring roles
Each Symantec Data Loss Prevention user is assigned to one or more roles that define the
privileges and rights that user has within the system. A user’s role determines system
administration privileges, policy authoring rights, incident access, and more. If a user is a
member of multiple roles, the user must specify the role when logging on, for example: Login:
Sys Admin/sysadmin01.

See “About role-based access control” on page 93.

See “About configuring roles and users” on page 94.
To configure a role
1 Navigate to the System > Login Management > Roles screen.
2 Click Add Role.
The Configure Role screen appears, displaying the following tabs: General, Incident
Access, Policy Management, and Users.
3 In the General tab:
■ Enter a unique Name for the role. The name field is case-sensitive and is limited to
30 characters. The name you enter should be short and self-describing. Use the
Description field to annotate the role name and explain its purpose in more details.
The role name and description appear in the Role List screen.
■ In the User Privileges section, you grant user privileges for the role.
System privileges(s):

User Select the User Administration option to enable users to create

Administration additional roles and users in the Enforce Server.
(Superuser)
 Managing roles and users 99
Configuring roles

Server Select the Server Administration option to enable users to perform the
Administration following functions:
■ Configure detection servers.
■ Create and manage Data Profiles for Exact Data Matching (EDM),
Form Recognition, Indexed Document Matching (IDM), and Vector
Machine Learning (VML).
■ Configure and assign incident attributes.
■ Configure system settings.
■ Configure response rules.
■ Create policy groups.
■ Configure recognition protocols.
■ View system event and traffic reports.
■ Import policies.
Note: Selecting Server Administration also provides Agent Management
privileges.

Agent Management Select the Agent Management option to enable users to perform the
following functions:
■ Review agent status
■ Review agent events
■ Manage agents and perform troubleshooting tasks
■ Delete, restart, and shut down agents
■ Change the Endpoint Server to which agents connect
■ Pull agent logs
■ Access agent summary reports
■ Add and update agent configurations
■ Manage and create agent groups
■ View agent group conflicts
■ Review server logs
■ Manage server logs, including canceling log collection, configuring
logs, and downloading and deleting logs

People privilege:

User Select the User Reporting option to enable users to view the user risk summary.
Reporting
Note: The Incident > View privilege is automatically enabled for all incident
(Risk
types for users with the User Reporting privilege.
Summary,
User See “About user risk” on page 1421.
Snapshot)
 Managing roles and users 100
Configuring roles

■ In the Incidents section, you grant users in this role the following incident privilege(s).
These settings apply to all incident reports in the system, including the Executive
Summary, Incident Summary, Incident List, and Incident Snapshots.

View Select the View option to enable users in this role to view policy violation
incidents.
You can customize incident viewing access by selecting various Actions
and Display Attribute options as follows:
■ By default the View option is enabled (selected) for all types of
incidents: Network Incidents, Discover Incidents, and Endpoint
Incidents.
■ To restrict viewing access to only certain incident types, select
(highlight) the type of incident you want to authorize this role to view.
(Hold down the Ctrl key to make multiple selections.) If a role does
not allow a user to view part of an incident report, the option is
replaced with "Not Authorized" or is blank.
Note: If you revoke an incident-viewing privilege for a role, the system
deletes any saved reports for that role that rely on the revoked privilege.
For example, if you revoke (deselect) the privilege to view network
incidents, the system deletes any saved network incident reports
associated with the role.
 Managing roles and users 101
Configuring roles

Actions Select among the following Actions to customize the actions a user can
perform when an incident occurs:
■ Remediate Incidents
This privilege lets users change the status or severity of an incident,
set a data owner, add a comment to the incident history, set the Do
Not Hide and Allow Hiding options, and execute response rule
actions. In addition, if you are using the Incident Reporting and Update
API, select this privilege to remediate the location and status attributes.
■ Smart Response Rules to execute
You specify which Smart Response Rules that can be executed on
a per role basis. Configured Smart Response Rules are listed in the
"Available" column on the left. To expose a Smart Response Rule
for execution by a user of this role, select it and click the arrow to add
it to the right-side column. Use the CTRL key to select multiple rules.
■ Perform attribute lookup
Lets users look up incident attributes from external sources and
populate their values for incident remediation.
■ Delete incidents
Lets users delete an incident.
■ Hide incidents
Lets users hide an incident.
■ Unhide incidents
Lets users restore previously hidden incidents.
■ Export Web archive
Lets users export a report that the system compiles from a Web
archive of incidents.
■ Export XML
Lets users export a report of incidents in XML format.
■ Email incident report as CSV attachment
Lets users email as an attachment a report containing a
comma-separated listing of incident details.

Incident Reporting Select among the following user privileges to enable access for Web
and Update API Services clients that use the Incident Reporting and Update API or the
deprecated Reporting API:
■ Incident Reporting
Enables Web Services clients to retrieve incident details.
■ Incident Update
Enables Web Services clients to update incident details. (Does not
apply to clients that use the deprecated Reporting API.)

See the Symantec Data Loss Prevention Incident Reporting and Update
API Developers Guide for more information.
 Managing roles and users 102
Configuring roles

Display Attributes Select among the following Display Attributes to customize what
attributes appear in the Incidents view for the policy violations that users
of the role can view.

Shared attributes are common to all types of incidents:

■ Matches
The highlighted text of the message that violated the policy appears
on the Matches tab of the Incident Snapshot screen.
■ History
The incident history.
■ Body
The body of the message.
■ Attachments
The names of any attachments or files.
■ Sender
The message sender.
■ Recipients
The message recipients.
■ Subject
The subject of the message.
■ Original Message
Controls whether or not the original message that caused the policy
violation incident can be viewed.
Note: To view an attachment properly, both the "Attachment" and the
"Original Message" options must be checked.

Endpoint attributes are specific to Endpoint incidents:

■ Username
The name of the Endpoint user.
■ Machine name
The name of the computer where the Endpoint Agent is installed.
Discover attributes are specific to Discover incidents:
■ File Owner
The name of the owner of the file being scanned.
■ Location
The location of the file being scanned.
 Managing roles and users 103
Configuring roles

Custom Attributes The Custom Attributes list includes all of the custom attributes
configured by your system administrator, if any.
■ Select View All if you want users to be able to view all custom attribute
values.
■ Select Edit All if you want users to edit all custom attribute values.
■ To restrict the users to certain custom attributes, clear the View All
and Edit All check boxes and individually select the View and/or Edit
check box for each custom attribute you want viewable or editable.
Note: If you select Edit for any custom attribute, the View check box is
automatically selected (indicated by being grayed out). If you want the
users in this role to be able to view all custom attribute values, select
View All.

■ In the Discover section, you grant users in this role the following privileges:

Folder Risk Reporting This privilege lets users view Folder Risk Reports. Refer to the Symantec
Data Loss Prevention Data Insight Implementation Guide.
Note: This privilege is only available for Symantec Data Loss Prevention
Data Insight licenses.

Content Root This privilege lets users configure and run Content Root Enumeration
Enumeration scans. For more information about Content Root Enumeration scans, See
“Working with Content Root Enumeration scans” on page 1603.

4 In the Incident Access tab, configure any conditions (filters) on the types of incidents
that users in this role can view.

Note: You must select the View option on the General tab for settings on the Incident
Access tab to have any effect.

To add an Incident Access condition:

■ Click Add Condition.
■ Select the type of condition and its parameters from left to right, as if writing a sentence.
(Note that the first drop-down list in a condition contains the alphabetized
system-provided conditions that are associated with any custom attributes.)
For example, select Policy Group from the first drop-down list, select Is Any Of from
the second list, and then select Default Policy Group from the final listbox. These
settings would limit users to viewing only those incidents that the default policy group
detected.

5 In the Policy Management tab, select one of the following policy privileges for the role:
 Managing roles and users 104
Configuring roles

■ Import Policies
This privilege lets users import policy files that have been exported from an Enforce
Server.
To enable this privilege, the role must also have the Server Administration, Author
Policies, Author Response Rules, and All Policy Groups privileges.
■ Author Policies
This privilege lets users add, edit, and delete policies within the policy groups that are
selected.
It also lets users modify system data identifiers, and create custom data identifiers.
It also lets users create and modify User Groups.
This privilege does not let users create or manage Data Profiles. This activity requires
Enforce Server administrator privileges.
■ Discover Scan Control
Lets the users in this role create Discover targets, run scans, and view Discover
Servers.
■ Credential Management
Lets users create and modify the credentials that the system requires to access target
systems and perform Discover scans.
■ Policy Groups
Select All Policy Groups only if users in this role need access to all existing policy
groups and any that will be created in the future.
Otherwise you can select individual policy groups or the Default Policy Group.

Note: These options do not grant the right to create, modify, or delete policy groups.
Only the users whose role includes the Server Administration privilege can work with
policy groups.

■ Author Response Rules

Enables users in this role to create, edit, and delete response rules.

Note: Users cannot edit or author response rules for policy remediation unless you
select the Author Response Rules option.

Note: Preventing users from authoring response rules does not prevent them from executing
response rules. For example, a user with no response-rule authoring privileges can still
execute smart response rules from an incident list or incident snapshot.
 Managing roles and users 105
Configuring user accounts

6 In the Users tab, select any users to which to assign this role. If you have not yet configured
any users, you can assign users to roles after you create the users.
7 Click Save to save your newly created role to the Enforce Server database.

Configuring user accounts

User accounts are the means by which users log onto the system and perform tasks. The role
that the user account belongs to limits what the user can do in the system.
To configure a user account:
1 In the Enforce Server Administration Console, select System > Login Management >
DLP Users to create a new user account or to reconfigure an existing user account. Or,
click Profile to reconfigure the user account to which you are currently logged on.
2 Click Add DLP User to add a new user, or click the name of an existing user to modify
that user's configuration.
3 Enter a name for a new user account in the Name field.
■ The user account name must be between 8 and 30 characters long, is case-sensitive
, and cannot contain backslashes (\).
■ If you use certificate authentication, the Name field value does not have to match the
user's Common Name (CN). However, you may choose to use the same value for
both the Name and Common Name (CN) so that you can easily locate the configuration
for a specific CN. The Enforce Server administration console shows only the Name
field value in the list of configured users.
■ If you are using Active Directory authentication, the user account name must match
the name of the Active Directory user account. Note that all Symantec Data Loss
Prevention user names are case-sensitive, even though Active Directory user names
are not. Active Directory users will need to enter the case-sensitive account name
when logging onto the Enforce Server administration console.
See “Integrating Active Directory for user authentication” on page 121.
 Managing roles and users 106
Configuring user accounts

4 Configure the Authentication section of the Configure User page. Only options that are
enabled are available on this page.

Option Instructions

Use Single Sign On If SAML authentication had been enabled, the user can sign on using Single Sign On Mapping
Mapping on the Configure User page.

Use Password Select this option to use password authentication and allow the user to sign on using the
access Enforce Server administration console log on page. This option is required if the user account
will be used for a Reporting API Web Service client.

If you select this option, also enter the user password in the Password and the Re-enter
Password fields. The password must be at least eight characters long and is case-sensitive.
For security purposes, the password is obfuscated and each character appears as an asterisk.

If you configure advanced password settings, the user must specify a strong password. In
addition, the password may expire at a certain date and the user has to define a new one
periodically.

See “Configuring password enforcement settings” on page 108.

You can choose password authentication even if you also use certificate authentication. If you
use certificate authentication, you can optionally disable sign on from the Enforce Server
administration console log on page.

See “Disabling password authentication and forms-based logon” on page 139.

Symantec Data Loss Prevention authenticates all Reporting API clients using password
authentication. If you configure Symantec Data Loss Prevention to use certificate authentication,
any user account that is used to access the Reporting API Web Service must have a valid
password. See the Symantec Data Loss Prevention Reporting API Developers Guide.
Note: If you configure Active Directory integration with the Enforce Server, users authenticate
using their Active Directory passwords. In this case the password field does not appear on
the Users screen.

See “Integrating Active Directory for user authentication” on page 121.

 Managing roles and users 107
Configuring user accounts

Option Instructions

Use Certificate Select this option to use certificate authentication and allow the user to automatically single
authentication sign-on with a certificate that is generated by a separate Private Key Infrastructure (PKI). This
option is available only if you have manually configured support for certificate authentication.

See “About authenticating users” on page 111.

See “About certificate authentication configuration” on page 125.

If you select this option, you must specify the common name (CN) value for the user in the
Common Name (CN) field. The CN value appears in the Subject field of the user's certificate,
which is generated by the PKI. Common names generally use the format, first_name
last_name identification_number.

The Enforce Server uses the CN value to map the certificate to this user account. If an
authenticated certificate contains the specified CN value, all other attributes of this user
account, such as the default role and reporting preferences, are applied when the user logs
on.
Note: You cannot specify the same Common Name (CN) value in multiple Enforce Server
user accounts.

Account Disabled Select this option to lock the user out of the Enforce Server administration console. This option
disables access for the user account regardless of which authentication mechanism you use.

For security, after a certain number of consecutive failed logon attempts, the system
automatically disables the account and locks out the user. In this case the Account Disabled
option is checked. To reinstate the user account and allow the user to log on to the system,
clear this option by unchecking it.

5 Optionally enter an Email Address and select a Language for the user in the General
section of the page. The Language selection depends on the language pack(s) you have
installed.
6 In the Report Preferences section of the Users screen you specify the preferences for
how this user is to receive incident reports, including Text File Encoding and CSV
Delimiter.
If the role grants the privilege for XML Export, you can select to include incident violations
and incident history in the XML export.
7 In the Roles section, select the roles that are available to this user to assign data and
incident access privileges.
You must assign the user at least one role to access the Enforce Server administration
console.
See “Configuring roles” on page 98.
 Managing roles and users 108
Configuring password enforcement settings

8 Select the Default Role to assign to this user at log on.

The default role is applied if no specific role is requested when the user logs on.
For example, the Enforce Server administration console uses the default role if the user
uses single sign-on with certificate authentication or uses the logon page.

Note: Individual users can change their default role by clicking Profile and selecting a
different option from the Default Role menu. The new default role is applied at the next
logon.

See “About authenticating users” on page 111.

9 Click Save to save the user configuration.

Note: Once you have saved a new user, you cannot edit the user name.

10 Manage users and roles as necessary.

See “Manage and add roles” on page 110.
See “Manage and add users” on page 110.

Configuring password enforcement settings

At the Systems > Settings > General screen you can require users to use strong passwords.
Strong passwords must contain at least eight characters, at least one number, and at least
one uppercase letter. Strong passwords cannot have more than two repeated characters in a
row. If you enable strong passwords, the effect is system-wide. Existing users without a strong
password must update their profiles at next logon.
You can also require users to change their passwords at regular intervals. In this case at the
end of the interval you specify, the system forces users to create a new password.
If you use Active Directory authentication, these password settings only apply to the
Administrator password. All other user account passwords are derived from Active Directory.
See “Integrating Active Directory for user authentication” on page 121.
 Managing roles and users 109
Resetting the Administrator password

To configure advanced authentication settings

1 Go to System > Settings > General and click Configure.
2 To require strong passwords, locate the DLP User Authentication section and select
Require Strong Passwords.
Symantec Data Loss Prevention prompts existing users who do not have strong passwords
to create one at next logon.
3 To set the period for which passwords remain valid, type a number (representing the
number of days) in the Password Rotation Period field.
To let passwords remain valid forever, type 0 (the character for zero).

Resetting the Administrator password

Symantec Data Loss Prevention provides the AdminPasswordReset utility to reset the
Administrator's password. There is no method to recover a lost password, but you can use
this utility to assign a new password. You can also use this utility if certificate authentication
mechanisms are disabled and you have not yet defined a password for the Administrator
account.
To use the AdminPasswordReset utility, you must specify the password to the Enforce Server
database. Use the following procedure to reset the password.
To reset the Administrator password for forms-based logon
1 Log on to the Enforce Server computer using the account that you created during Symantec
Data Loss Prevention installation.

Note: Do not change permissions or ownership on any configuration file from another
root or Administrator account.

2 Change directory to the /opt/SymantecDLP/Protect/bin (Linux) or

c:\SymantecDLP\Protect\bin (Windows) directory. If you installed Symantec Data Loss
Prevention into a different directory, substitute the correct path.
3 Execute the AdminPasswordReset utility using the following syntax:

AdminPasswordReset -dbpass oracle_password -newpass new_administrator_password

Replace oracle_password with the password to the Enforce Server database, and replace
new_administrator_password with the password you want to set.
 Managing roles and users 110
Manage and add roles

Manage and add roles

The System > Login Management > Roles screen displays an alphabetical list of the roles
that are defined for your organization.
Roles listed on this screen display the following information:
■ Name – The name of the role
■ Description – A brief description of the role
Assuming that you have the appropriate privileges, you can view, add, modify, or delete roles
as follows:
■ Add a new role, or modify an existing one.
Click Add Role to begin adding a new role to the system.
Click anywhere in a row or the pencil icon (far right) to modify that role
See “Configuring roles” on page 98.
■ Click the red X icon (far right) to delete the role; a dialog box confirms the deletion.
Before editing or deleting roles, note the following guidelines:
■ If you change the privileges for a role, users in that role who are currently logged on to the
system are not affected. For example, if you remove the Edit privilege for a role, users
currently logged on retain permission to edit custom attributes for that session. However,
the next time users log on, the changes to that role take effect, and those users can no
longer edit custom attributes.
■ If you revoke an incident-viewing privilege for a role, the Enforce Server automatically
deletes any saved reports that rely on the revoked privilege. For example, if you revoke
the privilege to view network incidents, the system deletes any saved network incident
reports associated with the newly restricted role.
■ Before you can delete a role, you must make sure there are no users associated with the
role.
■ When you delete a role, you delete all shared saved reports that a user in that role saved.
See “Manage and add users” on page 110.

Manage and add users

The System > Login Management > DLP Users screen lists all the active user accounts in
the system.
For each user account, the following information is listed:
■ User Name – The name the user enters to log on to the Enforce Server
■ Email – The email address of the user
 Managing roles and users 111
About authenticating users

■ Access – The role(s) in which the user is a member

Assuming that you have the appropriate privileges, you can add, edit, or delete user accounts
as follows:
■ Add a new user account, or modify an existing one.
Click Add to begin adding a new user to the system.
Click anywhere in a row or the pencil icon (far right) to view and edit that user account.
See “Configuring user accounts” on page 105.
■ Click the red X icon (far right) to delete the user account; a dialog box confirms the deletion.

Note: The Administrator account is created on install and cannot be removed from the
system.

Note: When you delete a user account, you also delete all private saved reports that are
associated with that user.

See “Manage and add roles” on page 110.

About authenticating users

Enforce Server administration console logon authentication options include SAML, forms-based,
Active Directory/Kerberos, and certificate.
Table 5-2 provides the descriptions of these mechanisms for authenticating users to the Enforce
Server administration console:
 Managing roles and users 112
About authenticating users

Table 5-2 Enforce Server authentication mechanisms

Authentication Sign-on mechanism Description

mechanism

SAML Single sign-on With SAML authentication, the Enforce Server administration console
authentication authenticates each user by validating the supplied email, user name,
or other user attributes that map to attributes the identity provider uses.

When SAML is enabled, users access the Enforce Server Admin console
URL and are redirected to the identity provider logon page, where they
enter their credentials. After they are authenticated with the identity
provider, their user attributes are sent to the Enforce Server. The
Enforce Server attempts to find a user with matching attributes. If the
user is found, they are logged on to the Enforce Server administration
console.

Configuration template file used:

springSecurityContext-SAML.xml

See “About SAML authentication” on page 115.

Password Forms-based sign-on With password authentication, the Enforce Server administration console
authentication authenticates each user. It determines if the supplied user name and
password combination matches an active user account in the Enforce
Server configuration. An active user account is authenticated if it has
been assigned a valid role.

Users enter their credentials into the Enforce Server administration

console's logon page and submit them over an HTTPS connection to
the Tomcat container that hosts the administration console.

With password authentication, you must configure the user name and
password of each user account directly in the Enforce Server
administration console. You must also ensure that each user account
has at least one assigned role.

Configuration template file used:

springSecurityContext-Form.xml

See “Manage and add users” on page 110.

 Managing roles and users 113
About authenticating users

Table 5-2 Enforce Server authentication mechanisms (continued)

Authentication Sign-on mechanism Description

mechanism

Active Directory Forms-based sign-on With Microsoft Active Directory authentication, the Enforce Server
authentication administration console first evaluates a supplied user name to determine
if the name exists in a configured Active Directory server. If the user
name exists in Active Directory, the supplied password for the user is
evaluated against the Active Directory password. Any password that is
configured in the Enforce Server configuration is ignored.

With Active Directory authentication, you must configure a user account

for each new Active Directory user in the Enforce Server administration
console. When you upgrade to Symantec Data Loss Prevention 15,
your existing users do not have to be set up again.

You do not have to enter a password for an Active Directory user

account. You can switch to Active Directory authentication after you
have already created user accounts in the system. However, only those
existing user names that match Active Directory user names remain
valid after the switch.

Configuration template file used:

springSecurityContext-Kerberos.xml

See “Verifying the Active Directory connection” on page 124.

 Managing roles and users 114
About authenticating users

Table 5-2 Enforce Server authentication mechanisms (continued)

Authentication Sign-on mechanism Description

mechanism

Certificate Single sign-on from Certificate authentication enables a user to automatically log on to the
authentication Public Key Infrastructure Enforce Server administration console using an X.509 client certificate.
(PKI) This certificate is generated by your public key infrastructure (PKI). To
use certificate-based single sign-on, you must first enable certificate
authentication as described in this section.

See “Configuring certificate authentication for the Enforce Server

administration console” on page 127.

The client certificate must be delivered to the Enforce Server when a

client's browser performs the SSL handshake with the Enforce Server
administration console. For example, you might use a smart card reader
and middleware with your browser to automatically present a certificate
to the Enforce Server. Or, you might obtain an X.509 certificate from a
certificate authority. Then you would upload the certificate to a browser
that is configured to send the certificate to the Enforce Server.

When a user accesses the Enforce Server administration console, the

PKI automatically delivers the user's certificate to the Tomcat container
that hosts the administration console. The Tomcat container validates
the client certificate using the certificate authorities that you have
configured in the Tomcat trust store.

Configuration template file used:

springSecurityContext-Certificate.xml

See “Adding certificate authority (CA) certificates to the Tomcat trust

store” on page 129.

The Enforce Server administration console uses the validated certificate

to determine whether the certificate has been revoked.

See “About certificate revocation checks” on page 133.

If the certificate is valid and has not been revoked, then the Enforce
Server uses the common name (CN) in the certificate to determine if
that CN is mapped to an active user account with a role in the Enforce
Server configuration. For each user that accesses the Enforce Server
administration console using certificate-based single sign-on, you must
create a user account in the Enforce Server that defines the
corresponding user's CN value. You must also assign one or more valid
roles to the user account.

Here are some important things to note when you set up SAML authentication.
■ You must restart the manager when you change the way you authenticate users in SAML.
Changing this mapping criteria in the springSecurityContext file for SAML without
 Managing roles and users 115
Configuring user authentication

restarting the manager results in users that are out of sync, as the system continues to use
previous version of the file. For example, if you change the mapping criteria from user name
to email address, you must restart the manager.
■ You must remap each user when you change the way you map users in SAML. Changing
mapping criteria invalidates the existing user's mapping.
■ You must validate the XML syntax before you restart the manager. Some characters such
as "&" that can be part of a user attribute make the XML invalid. You need to replace these
characters with their XML escape string. For example, instead of "&" use "&amp".
■ Do not delete any XML nodes in the XML files.
■ Attribute names in XML must exactly match (including case) attribute names in the identity
provider.
■ When switching from forms-based to SAML authentication, you must go through each user
and disable password access for non-Web Services users.
■ When switching from Certificate authentication to SAML authentication, make sure that the
ClientAuth value in server.xml is set to false.

See “Configuring user authentication” on page 115.

Configuring user authentication

About SAML authentication
SAML (Security Assertion Markup Language) user authentication is now available for logging
on to the Enforce Server administration console. SAML is an XML-based open standard data
format for exchanging authentication and authorization data between service providers and
identity providers. DLP is the service provider.
Before using SAML, you must set up the service provider, the identity provider, and map the
user attributes to identify the user.
Three types of mapping are available: by email, by user name, and by custom user attributes.
When you use SAML, the ROLE\USERNAME logon for local users is not supported.
Symantec supports the following identity providers, both on-premises and cloud based:
■ SAM (Symantec Access Manager)
■ Okta
■ SSOCircle
See the Symantec Data Loss Prevention System Requirements Guide at
http://www.symantec.com/docs/doc10602 for updates on supported IdPs.
 Managing roles and users 116
Configuring user authentication

See “Setting up authentication” on page 116.

Setting up authentication
Table 5-3 shows a summary of the tasks for the setup with links to more information on each
step.

Table 5-3 Authentication configuration steps

Step Task More information

Step 1 Edit the Spring context file for the See “Set up and configure the
authentication method. authentication method”
on page 117.

Step 2 Set up the authentication For SAML:See “Set up the SAML

configuration. authentication configuration”
on page 119.

For Active Directory/Kerberos:

See “Configuring Active Directory

authentication” on page 121.

For Forms-based:

See “Configuring forms-based

authentication” on page 121.

For Certificate:

See “Configuring certificate

authentication” on page 121.

Step 3 Restart the Enforce Server. See “About Symantec Data Loss
Prevention services” on page 85.

Step 4 For SAML, generate and See “Generate or download

download the service provider Enforce (service providers) SAML
SAML metadata. The Enforce metadata” on page 120.
Server administration console is
the service provider.

Step 5 For SAML, configure Enforce as See “Configure the Enforce

a SAML service provider with the Server as a SAML service
identity provider. provider with the IdP (Create an
application in your identity
provider)” on page 120.
 Managing roles and users 117
Configuring user authentication

Table 5-3 Authentication configuration steps (continued)

Step Task More information

Step 6 For SAML, download the identity See “Export the IdP metadata to
provider metadata. DLP” on page 120.

Step 7 Complete the process by See “About Symantec Data Loss

restarting the Enforce Server. Prevention services” on page 85.

Step 8 Log on to the Enforce Server See “Administrator Bypass URL”

administration console using the on page 117.
Administrator Bypass URL.

Note: The Enforce Server administration console (the service provider in SAML) and the IdP
exchange messages using the settings in the configuration. Ensure that your settings match
with your IdP's configuration and capabilities. Unmatched settings break the system.
You must restart the Enforce Server twice: once after you set up the authentication configuration
in the springSecurityContext.xml file, and once after you download the IdP metadata file
and replace the contents of idp-metadata.xml in the Enforce install directory with the IdP
metadata.

See “Administrator Bypass URL” on page 117.

Administrator Bypass URL

The administrator bypass URL, https://<hostnameOrlp>/ProtectManager/admin/Logon
enables you to bypass SAML authentication. You can log on to the Enforce Server
administration console and use forms-based authentication to set up users. You must enter
this URL in your browser; you cannot navigate to this URL through the Enforce Server
administration console user interface.

Note: Only one active logon is available with the Bypass URL.

See “Set up and configure the authentication method” on page 117.

Set up and configure the authentication method

These steps present an overview of the common tasks for setting up and configuring all
authentication methods. Additional steps or changes for each method are explained in "Final
steps" following the initial template file configuration.
 Managing roles and users 118
Configuring user authentication

Note: The files that you must modify are commented with details to help you through the update
process.

To set up the authentication method

1 Delete (or rename) the springSecurityContext.xml file in the [your install
directory]/Protect/tomcat/webapps/ProtectManager/WEB-INF/.

2 Go to the [your install

directory}/Protect/tomcat/webapps/ProtectManager/security/template folder
and select the appropriate configuration template file for your authentication method:
■ SpringSecurityContext-SAML.xml for SAML authentication configurations

■ SpringSecurityContext-Form.xml for forms and client certificate-based authentication

configurations
■ SpringSecurityContext-Certificate.xmlfor client certificate-based authentication
only
■ springSecurityContext-Kerberos.xml for Active Directory/Kerberos authentication
configurations

3 Copy the file you selected into the [your install

directory]/Protect/tomcat/webapps/ProtectManager/WEB-INF/ folder.

4 Rename the file to springSecurityContext.xml.

5 Configure the springSecurityContext.xml file:
6 Final steps:
■ SAML: For instructions on how to set up the SAML authentication configuration, see
Set up the SAML authentication configuration.
■ Forms Based: If the template file that you copied is for forms-based authentication,
there are no additional settings to configure. The DLP User Authentication section
of the General Settings now indicates that your user authentication method is Forms
Based.
■ Client certificate: To enable client certificate authentication, set clientAuth to want
or true in <InstallDirectory>/Protect/tomcat/config/server.xml. The DLP
User Authentication section of the General Settings now indicates that your user
authentication method is Certificate.
■ Active Directory: To enable Active Directory authentication, replace the value for
krbConfLocation in
[your install
directory]/Protect/tomcat/webapps/ProtectManager/WEB-INF/springSecurityContext.xml
with the path to your krb5.ini file.
 Managing roles and users 119
Configuring user authentication

The DLP User Authentication section of the General Settings now indicates that
your user authentication method is Active Directory. You can configure the list of
domains in this DLP User Authentication section of the General Settings page

Note: You can no longer perform the initial setup of Active Directory through the Enforce
Server administration console.

See “Set up the SAML authentication configuration” on page 119.

Set up the SAML authentication configuration

Get the information about your IdP, such as its choice of authentication methods, available
user identifiers, available user attributes, and the required service provider metadata.
Open [your install directory]/Protect/tomcat/webapps/ProtectManager/WEB-INF/
and set the entityBaseURL property to your Enforce URL: https://<host name or
IP>/ProtectManager.

Note: Unless you only want to access the Enforce Server administration console from the host
machine, don't use localhost as the host name.

Set the property value of "nameID" by editing the property name ="nameID" value in the
Spring file to a name identifier such as emailAddress, WindowsDomainQualifiedName, or
another nameID that your IdP supports. Here's an example for email address:
<property name="nameID"
value=urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />

You may want to use a combination of user attributes returned from the IdP to identify a Data
Loss Prevention user. In this case you can set the userAttributes property. For example:

<bean id=userLookupService" class="com.vontu.login.spring.VontuSAMLUserDetailsService">

<!--
<property name="user Attributes">
<set>
<value>UserName</value>
<value>EmailAddress</value>
<value>EmployeeID</value>
</set>
</property>
 Managing roles and users 120
Configuring user authentication

Generate or download Enforce (service providers) SAML metadata

To download the Enforce SAML metadata
1 Restart the Enforce Server.
2 Log on as Administrator using the Bypass url. This Bypass URL is accessed directly; you
don't need to logon to the Enforce Server administration console to access this URL.
3 Go to System > Settings > General and navigate to the DLP User Authentication
section.
4 Click the link to the right of The SAML config file for your IdP is at to download the
metadata.
See “Configure the Enforce Server as a SAML service provider with the IdP (Create an
application in your identity provider)” on page 120.

Configure the Enforce Server as a SAML service provider with the

IdP (Create an application in your identity provider)
These steps vary depending on the IdP that you use. Here is a broad overview of the steps if
you use Symantec VIP Access Manager as your IdP:
To configure the Enforce Server as a SAML service provider with the IdP create an application
1 Log on to the VIP Access Manager administration console as administrator.
2 Click generic template.
3 Name the connector.
4 Select the access policy as SSO (single sign-on).
5 Configure your portal by selecting an icon for your site (this icon appears on the identity
provider's dashboard).
6 Upload the Enforce Server metadata.
See “Export the IdP metadata to DLP” on page 120.

Export the IdP metadata to DLP

Download the IdP metadata and replace the contents of the idp-metadata.xml file at
<installdirectory>/Protect/tomcat/webapps/ProtectManager/security/idp-metadata.xml
with the IdP metadata that you downloaded.
See “Configuring Active Directory authentication” on page 121.
 Managing roles and users 121
Integrating Active Directory for user authentication

Configuring Active Directory authentication

If the template file that you copied is for Active Directory/Kerberos authentication, open the
<InstallDirectory>/Protect/tomcat/webapps/ProtectManager/WEB-INF/springSecurityContext.xml
file in a text editor. This is the springSecurityContext-Kerberos.xml file that you previously
renamed to springSecurityContext.xml. Set the krbConfLocation value to your Kerberos
authentication file. For example:

<!--- Set krbConfLocation in System prooperties -->

<bean class="org.springframework.security.kerberos.authentication.sun.
GlobalJunJaasKerberosConfig">
<!-- krb5 configuration file location.
For example C:\SymantecDLP\Protect\config\krb5.ini on Windows
or
/opt/VontuProtect/config/krb5.conf on Linux
-->
property name="krbConfLocation" value="C:SymantecDLP\protect
\config\krb5.ini"/>
</bean>

See “Set up and configure the authentication method” on page 117.

See “Configuring forms-based authentication” on page 121.
See “Integrating Active Directory for user authentication” on page 121.

Configuring forms-based authentication

After you copy the template file for forms-based authentication, there are no additional settings
to configure.
See “Configuring certificate authentication” on page 121.

Configuring certificate authentication

After you copy the template file for client certificate-based authentication, go to the <Install
Directory>/Protect/tomcat/config/server.xml file and set the client auth value to
want or true.

See “Generate or download Enforce (service providers) SAML metadata” on page 120.

Integrating Active Directory for user authentication

You can configure the Enforce Server to use Microsoft Active Directory for user authentication.
 Managing roles and users 122
Integrating Active Directory for user authentication

After you switch to Active Directory authentication, you must still define users in the Enforce
Server administration console. If the user names you enter in the Administration Console match
Active Directory users, the system associates any new user accounts with Active Directory
passwords. You can switch to Active Directory authentication after you have already created
user accounts in the system. Only those existing user names that match Active Directory user
names remain valid after the switch.
Users must use their Active Directory passwords when they log on. Note that all Symantec
Data Loss Prevention user names remain case sensitive, even though Active Directory user
names are not. You can switch to Active Directory authentication after already having created
user names in Symantec Data Loss Prevention. However, users still have to use the
case-sensitive Symantec Data Loss Prevention user name when they log on.
To use Active Directory authentication
1 Verify that the Enforce Server host is time-synchronized with the Active Directory server.

Note: Ensure that the clock on the Active Directory host is synched to within five minutes
of the clock on the Enforce Server host.

2 (Linux only) Make sure that the following Red Hat RPMs are installed on the Enforce
Server host:
■ krb5-workstation

■ krb5-libs

■ pam_krb5

3 Create the krb5.ini (or krb5.conf for Linux) configuration file that gives the Enforce
Server information about your Active Directory domain structure and Active Directory
server addresses.
See “Creating the configuration file for Active Directory integration” on page 122.
4 Confirm that the Enforce Server can communicate with the Active Directory server.
See “Verifying the Active Directory connection” on page 124.
5 Configure Symantec Data Loss Prevention to use Active Directory authentication.

Creating the configuration file for Active Directory integration

You must create a krb5.ini configuration file (or krb5.conf on Linux) to give Symantec Data
Loss Prevention information about your Active Directory domain structure and server locations.
This step is required if you have more than one Active Directory domain. However, even if
your Active Directory structure includes only one domain, it is still recommended to create this
 Managing roles and users 123
Integrating Active Directory for user authentication

file. The kinit utility uses this file to confirm that Symantec Data Loss Prevention can
communicate with the Active Directory server.

Note: If you are running Symantec Data Loss Prevention on Linux, verify the Active Directory
connection using the kinit utility. You must rename the krb5.ini file as krb5.conf. The kinit
utility requires the file to be named krb5.conf on Linux. Symantec Data Loss Prevention
assumes that you use kinit to verify the Active Directory connection, and directs you to rename
the file as krb5.conf.

Symantec Data Loss Prevention provides a sample krb5.ini file that you can modify for use
with your own system. The sample file is stored in SymantecDLP\Protect\config (for example,
\SymantecDLP\Protect\config on Windows or /opt/SymantecDLP/Protect/config on
Linux). If you are running Symantec Data Loss Prevention on Linux, Symantec recommends
renaming the file to krb5.conf. The sample file, which is divided into two sections, looks like
this:

[libdefaults]
default_realm = TEST.LAB
[realms]
ENG.COMPANY.COM = {
kdc = engAD.eng.company.com
}
MARK.COMPANY.COM = {
kdc = markAD.eng.company.com
}
QA.COMPANY.COM = {
kdc = qaAD.eng.company.com
}

The [libdefaults] section identifies the default domain. (Note that Kerberos realms
correspond to Active Directory domains.) The [realms] section defines an Active Directory
server for each domain. In the previous example, the Active Directory server for
ENG.COMPANY.COM is engAD.eng.company.com.
 Managing roles and users 124
Integrating Active Directory for user authentication

To create the krb5.ini or krb5.conf file

1 Go to SymantecDLP\Protect\config and locate the sample krb5.ini file. For example,
locate the file in \SymantecDLP\Protect\config (on Windows) or
/opt/SymantecDLP/Protect/config (on Linux).

2 Copy the sample krb5.ini file to the c:\windows directory (on Windows) or the /etc
directory (on Linux). If you are running Symantec Data Loss Prevention on Linux, plan to
verify the Active Directory connection using the kinit command-line tool. Rename the file
as krb5.conf.
See “Verifying the Active Directory connection” on page 124.
3 Open the krb5.ini or krb5.conf file in a text editor.
4 Replace the sample default_realm value with the fully qualified name of your default
domain. (The value for default_realm must be all capital letters.) For example, modify
the value to look like the following:

default_realm = MYDOMAIN.LAB

5 Replace the other sample domain names with the names of your actual domains. (Domain
names must be all capital letters.) For example, replace ENG.COMPANY.COM with
ADOMAIN.COMPANY.COM.

6 Replace the sample kdc values with the host names or IP addresses of your Active
Directory servers. (Be sure to follow the specified format, in which opening brackets are
followed immediately by line breaks.) For example, replace engAD.eng.company.com with
ADserver.eng.company.com, and so on.

7 Remove any unused kdc entries from the configuration file. For example, if you have only
two domains besides the default domain, delete the unused kdc entry.
8 Save the file.

Verifying the Active Directory connection

kinit is a command-line tool you can use to confirm that the Active Directory server responds
to requests. It also verifies that the Enforce Server has access to the Active Directory server.
For Microsoft Windows installations, the utility is installed by the Symantec Data Loss Prevention
installer in the SymantecDLP\jre\bin directory. For Linux installations, the utility is part of the
Red Hat Enterprise Linux distribution, and is in the following location:
/usr/kerberos/bin/kinit. You can also download Java SE 6 and locate the kinit tool in
\java_home\jdk1.6.0\bin.
 Managing roles and users 125
About certificate authentication configuration

If you run the Enforce Server on Linux, use the kinit utility to test access from the Enforce
Server to the Active Directory server. Rename the krb5.ini file as krb5.conf. The kinit
utility requires the file to be named krb5.conf on Linux.
To test the connection to the Active Directory server
1 On the Enforce Server host, go to the command line and navigate to the directory where
kinit is located.

2 Issue a kinit command using a known user name and password as parameters. (Note
that the password is visible in clear text when you type it on the command line.) For
example, issue the following:

kinit kchatterjee mypwd10#

The first time you contact Active Directory you may receive an error that it cannot find the
krb5.ini or krb5.conf file in the expected location. On Windows, the error looks similar
to the following:

krb_error 0 Could not load configuration file c:\winnt\krb5.ini

(The system cannot find the file specified) No error.

In this case, copy the krb5.ini or krb5.conf file to the expected location and then rerun
the kinit command that is previously shown.
3 Depending on how the Active Directory server responds to the command, take one of the
following actions:
■ If the Active Directory server indicates it has successfully created a Kerberos ticket,
continue configuring Symantec Data Loss Prevention.
■ If you receive an error message, consult with your Active Directory administrator.

About certificate authentication configuration

Certificate authentication enables a user to automatically log on to the Enforce Server
administration console. The user logs on using a client certificate that your public key
infrastructure (PKI) generates. When a user accesses the Enforce Server administration
console, the PKI automatically delivers the user's certificate to the Tomcat container that hosts
the administration console. The Tomcat container validates the client certificate using the
certificate authorities that you have configured in the Tomcat trust store.
The client certificate is delivered to the Enforce Server computer when a client's browser
performs the SSL handshake with the Enforce Server. For example, some browsers might be
configured to operate with a smart card reader to present the certificate. Alternately, you can
upload the X.509 certificate to a browser and configure the browser to send the certificate to
the Enforce Server.
 Managing roles and users 126
About certificate authentication configuration

If the certificate is valid, the Enforce Server administration console may also determine if the
certificate was revoked.
See “About certificate revocation checks” on page 133.
If the certificate is valid, then the Enforce Server uses the common name (CN) in the certificate
to determine if that CN is mapped to an active user account with a role.

Note: Some browsers cache a user's client certificate, and automatically log the user on to the
Administration Console after the user has chosen to sign out. In this case, users must close
the browser window to complete the log out process.

The following table describes the steps necessary to use certificate authentication with
Symantec Data Loss Prevention.

Table 5-4 Steps to configure certificate authentication

Phase Action Description

1 Enable certificate authentication on the Enforce You can configure an existing Enforce Server
Server computer. to enable authentication. Enforce Servers have
form-based authentication by default.

See “Configuring certificate authentication for

the Enforce Server administration console”
on page 127.

2 Add certificate authority (CA) certificates to You can add CA certificates to the Tomcat trust
establish the trust chain. store with the Java keytool utility to manually
add certificates to an existing Enforce Server.

See “Adding certificate authority (CA) certificates

to the Tomcat trust store” on page 129.

3 (Optional) Change the Tomcat trust store
password.
The Symantec Data Loss Prevention installer
configures each new Enforce Server installation
with a default Tomcat trust store password.
Follow these instructions to configure a secure
password.

See “Changing the Tomcat trust store password”

on page 130.

4 Map certificate common name (CN) values to See “Mapping Common Name (CN) values to
Enforce Server user accounts. Symantec Data Loss Prevention user accounts”
on page 132.

5 Configure the Enforce Server to check for See “About certificate revocation checks”
certificate revocation. on page 133.
 Managing roles and users 127
About certificate authentication configuration

Table 5-4 Steps to configure certificate authentication (continued)

Phase Action Description

6 Verify Enforce Server access using See “Troubleshooting certificate authentication”

certificate-based single sign-on. on page 139.

7 (Optional) Disable forms-based logon. If you want to use certificate-based single

sign-on for all access to the Enforce Server,
disable forms-based logon.

See “Disabling password authentication and

forms-based logon” on page 139.

Configuring certificate authentication for the Enforce Server

administration console
Form-based authentication is available by default on the Enforce Server. You must add
certificate authentication manually. Follow this procedure to manually enable form and certificate
authentication on a Symantec Data Loss Prevention installation.
To enable form and certificate authentication for users of the Enforce Server administration
console
1 Log on to the Enforce Server computer using the account that you created during Symantec
Data Loss Prevention installation.

Note: Do not change permissions or ownership on any configuration file from another
root or Administrator account.

2 Copy the corresponding springSecurityContext.xml file into the Tomcat WEB-INF

directory.
3 Edit C:\SymantecDLP\Protect\tomcat\conf\server.xml (Windows) or
/opt/SymantecDLP/Protect/tomcat/conf/server.xml (Linux) and change the
ClientAuth value from false to want. Save the file.

4 Restart the Enforce Server. This change to the server.xml file that you edited in the
previous step enables the Use Certificate authentication check box in the Enforce Server
administration console user interface.
5 Logon to the Enforce Server administration console and go to System > Login
Management > DLP Users.
6 Check Use Certificate authentication and indicate the corresponding CN mapping.
 Managing roles and users 128
About certificate authentication configuration

7 Add the CA certificates to the Tomcat trust store using the Java keytool utility.
See “Adding certificate authority (CA) certificates to the Tomcat trust store” on page 129.
Ensure that you have installed all necessary certificates and that users can log on with
certificate authentication.
8 Now the user has both form-based authentication and certificate authentication.
About certificate revocation checks
Follow this procedure to enable certificate authentication on Symantec Data Loss Prevention.
To enable certificate authentication for users of the Enforce Server administration console
1 Log on to the Enforce Server computer using the account that you created during Symantec
Data Loss Prevention installation.

Note: Do not change permissions or ownership on any configuration file from another
root or Administrator account.

2 Copy the corresponding springSecurityContext.xml file into the Tomcat WEB-INF

directory.
3 Edit C:\SymantecDLP\Protect\tomcat\conf\server.xml (Windows) or
/opt/SymantecDLP/Protect/tomcat/conf/server.xml (Linux) and change the
ClientAuth value from false to want. Save the file.

4 Restart the Enforce Server. This change to the server.xml file that you edited in the
previous step enables the Use Certificate authentication check box in the Enforce Server
administration console user interface.
5 Logon to the Enforce Server administration console and go to System > Login
Management > DLP Users.
6 Check Use Certificate authentication and indicate the corresponding Common Name
(CN) mapping.
7 Add the CA certificates to the Tomcat trust store using the Java keytool utility.
See “Adding certificate authority (CA) certificates to the Tomcat trust store” on page 129.
Ensure that you have installed all necessary certificates and that users can log on with
certificate authentication.
 Managing roles and users 129
About certificate authentication configuration

8 For client authentication only, copy the springSecurityContext-Certificate.xml file

from C:\SymantecDLP\Protect\tomcat\webapps\ProtectManager\security\template
(Windows) or opt/SymantecDLP/Protect/tomcat/webapps/ProtectManager/WEB-INF
(Linux) and rename it to springSecurityContext.xml.
9 Edit the C:\SymantecDLP\Protect\tomcat\conf\server.xml (Windows) or
/opt/SymantecDLP/Protect/tomcat/conf/server.xml file and change the ClientAuth
value from want to true.
Restart the Enforce Server.
Now the user has certificate authentication only.

See “Adding certificate authority (CA) certificates to the Tomcat trust store” on page 129.

Adding certificate authority (CA) certificates to the Tomcat trust store

To use certificate authentication with Symantec Data Loss Prevention, you must add all of the
CA certificates that are required to authenticate users in your system to the Tomcat trust store.
For Symantec Data Loss Prevention 15.0 and later, CA certificates can only be imported to
the Enforce Server using the Java keytool utility. Each X.509 certificate must be provided in
Distinguished Encoding Rules (DER) format in a .cer file. If multiple CAs are required to
establish the certificate chain, then you must add multiple .cer files.
To add certificate CA certificates to the Tomcat trust store
1 Log on to the Enforce Server computer using the account that you created during Symantec
Data Loss Prevention installation.

Note: Do not change permissions or ownership on any configuration file from another
root or Administrator account.

2 Change directory to the /opt/SymantecDLP/Protect/tomcat/conf (Linux) or

c:\SymantecDLP\Protect\tomcat\conf (Windows) directory. If you installed Symantec
Data Loss Prevention to a different directory, substitute the correct path.
3 Copy all certificate files (.cer files) that you want to import to the conf directory on the
Enforce Server computer.
 Managing roles and users 130
About certificate authentication configuration

4 Use the keytool utility that is installed with Symantec Data Loss Prevention to add a
certificate to the Tomcat trust store. For Windows systems, enter:

c:\SymantecDLP\jre\bin\keytool -import -trustcacerts

-alias CA_CERT_1
-file certificate_1.cer
-keystore .\truststore.jks

For Linux systems, enter:

/opt/SymantecDLP/jre/bin/keytool -import -trustcacerts

-alias CA_CERT_1
-file certificate_1.cer
-keystore ./truststore.jks

In these commands, replace CA_CERT_1 with a unique alias for the certificate that you
import. Replace certificate_1.cer with the name of the certificate file you copied to the
Enforce Server computer.
5 Enter the password to the keystore at the keytool utility prompt. The default keystore
password is protect.
6 Repeat these steps to install all the certificate files that are necessary to complete the
certificate chain.
7 Stop and then restart the Vontu Manager service to apply your changes.
8 If you have not yet changed the default Tomcat keystore password, do so now.
See “Changing the Tomcat trust store password” on page 130.

Changing the Tomcat trust store password

When you install Symantec Data Loss Prevention, the Tomcat trust store uses protect as
the default password. Follow this procedure to assign a secure password to the Tomcat trust
store when you use certificate authentication.
 Managing roles and users 131
About certificate authentication configuration

To change the Tomcat trust store password

1 Log on to the Enforce Server computer using the account that you created during Symantec
Data Loss Prevention installation.

Note: Do not change permissions or ownership on any configuration file from another
root or Administrator account.

2 Change directory to the /opt/SymantecDLP/Protect/tomcat/conf (Linux) or

c:\SymantecDLP\Protect\tomcat\conf (Windows) directory. If you installed Symantec
Data Loss Prevention to a different directory, substitute the correct path.
3 Use the keytool utility that is installed with Symantec Data Loss Prevention to change
the Tomcat truststore password. For Windows systems, enter:

c:\SymantecDLP\jre\bin\keytool -storepasswd -new new_password -keystore ./truststore.jks

For Linux systems, enter:

/opt/SymantecDLP/jre/bin/keytool -storepasswd -new new_password -keystore ./truststore.jks

Replace new_password with a secure password.

4 Enter the current password to the keystore when the keytool utility prompts you to do
so. The default password is protect.
5 Change directory to the /opt/SymantecDLP/Protect/tomcat/conf (Linux) or
c:\SymantecDLP\Protect\tomcat\conf (Windows) directory. If you installed Symantec
Data Loss Prevention into a different directory, substitute the correct path.
6 Open the server.xml file with a text editor.
7 In the following line in the file, edit the truststorePass="protect" entry to specify your
new password:

<Connector URIEncoding="UTF-8" acceptCount="100" clientAuth="want"

debug="0" disableUploadTimeout="true" enableLookups="false"
keystoreFile="conf/.keystore" keystorePass="protect"
maxSpareThreads="75" maxThreads="150" minSpareThreads="25"
port="443" scheme="https" secure="true" sslProtocol="TLS"
truststoreFile="conf/truststore.jks" truststorePass="protect"/>

Replace protect with the new password that you defined in the keytool command.
8 Save your changes and exit the text editor.
 Managing roles and users 132
About certificate authentication configuration

9 Change directory to the /opt/SymantecDLP/Protect/config (Linux) or

c:\SymantecDLP\Protect\config (Windows) directory. If you installed Symantec Data
Loss Prevention into a different directory, substitute the correct path.
10 Open the Manager.properties file with a text editor.
Add the following line in the file to specify the new password:

com.vontu.manager.tomcat.truststore.password = password

Replace password with the new password. Do not enclose the password in quotation
marks.
11 Save your changes and exit the text editor.
12 Open the Protect.properties file with a text editor.
13 Edit (or if not present, add) the following line in the file to specify the new password:
com.vontu.manager.tomcat.truststore.password = password

Replace password with the new password. Do not enclose the password in quotation
marks.
14 Save your changes and exit the text editor.
15 Stop and then restart the Vontu Manager service to apply your changes.

Mapping Common Name (CN) values to Symantec Data Loss

Prevention user accounts
Each user that accesses the Enforce Server administration console using certificate-based
single sign-on must have an active user account in the Enforce Server configuration. The user
account associates the common name (CN) value from the user's client certificate to one or
more roles in the Enforce Server administration console. You can map a CN value to only one
Enforce Server user account.
The user account that you create does not require a separate Enforce Server administration
console password. You can optionally configure a password if you want to allow the user to
also log on from the Enforce Server administration console log-on page. If you enable password
authentication and the user does not provide a certificate when the browser asks for one, then
the Enforce Server displays the log-on page. A log-on failure is displayed if password
authentication is disabled and the user does not provide a certificate.
An active user account must identify a user's CN value and have a valid role assigned in the
Enforce Server to log on using single sign-on with certificate authentication. You can disable
or delete the associated Enforce Server user account to prevent a user from accessing the
Enforce Server administration console without revoking their client certificate.
See “Configuring user accounts” on page 105.
 Managing roles and users 133
About certificate authentication configuration

About certificate revocation checks

While managing your public key infrastructure, you may need to revoke a client's certificate
with the CA. For example, you might revoke a certificate if an employee leaves the company,
or if an employee's credentials are lost or stolen. When you revoke a certificate, the CA uses
one or more Certificate Revocation Lists (CRLs) to publish those certificates that are no longer
valid. Symantec Data Loss Prevention also supports the use of an Online Certificate Status
Protocol (OCSP) responder, which clients can use to determine if a particular certificate has
been revoked. The OCSP responder can be implemented as a service on your CA server, or
as a separate OCSP server.

Note: Certificate revocation checking is disabled by default. You must enable it and configure
it. See “Configuring certificate revocation checks” on page 135.

OCSP is the first mechanism that Symantec Data Loss Prevention uses to perform certificate
revocation checks. After the Tomcat container has determined that a client certificate is valid,
the Enforce Server sends an OCSP request to a designated OCSP responder to determine if
the certificate was revoked. The information that is used to contact the OCSP responder can
be provided in one of two ways:
■ The Authority Information Access (AIA) field in a client certificate. The client certificate itself
can include the URL of the OCSP responder in an AIA field. The following shows an example
AIA field that defines an OCSP responder:

[1]Authority Info Access Access Method=On-line

Certificate Status Protocol (1.3.6.1.5.5.7.48.1)
Alternative Name: URL=http://my_ocsp_responder

This method is commonly used when you configure an internal CA to provide the OCSP
responder service. If the OCSP responder specified in the AIA field is directly accessible
from the Enforce Server computer, then no additional configuration is required to perform
revocation checks. However, if the OCSP responder is accessible only by a proxy server,
then you must configure the proxy server settings in the Symantec Data Loss Prevention
configuration.
■ The OCSP configuration file. As an alternative, you can manually configure OCSP responder
properties using the manager-certauth.security configuration file. If you choose to use
this file, the configuration in the file overrides any information that is present in a client
certificate's AIA field. This method is commonly used if you want to use a local OCSP
responder instead of the one specified in the AIA field, or if your client certificates do not
include an AIA field.
See “Manually configuring OCSP responder properties” on page 137.
 Managing roles and users 134
About certificate authentication configuration

Note: If the OCSP responder that you configure in this file does not use the CA certificate
to sign its responses, then you must add the OCSP responder's certificate to the Tomcat
trust store.
See “Adding certificate authority (CA) certificates to the Tomcat trust store” on page 129.

If a certificate's revocation status cannot be determined using OCSP, then Symantec Data
Loss Prevention retrieves revocation lists from a Certificate Revocation List Distribution Point
(CRLDP). To check revocation using a CRLDP, the client certificate must include a CRL
distribution point field. The following shows an example CRLDP field definition:

[1]CRL Distribution Point

Distribution Point Name:
Full Name: URL=http://my_crldp

Note: Symantec Data Loss Prevention does not support specifying the CRLDP using an LDAP
URL.

If the CRL distribution point is defined in each certificate and the Enforce Server can directly
access the server, then no additional configuration is required to perform revocation checks.
If the CRL distribution point is accessible only by a proxy server, then you must configure the
proxy server settings in the Symantec Data Loss Prevention configuration.
See “Accessing the OCSP responder or CRLDP with a proxy” on page 136.
Regardless of which revocation checking method you use, you must enable certificate revocation
checks on the Enforce Server computer. Certificate revocation checks are enabled by default
if you select certificate installation during the Enforce Server installation. If you upgraded an
existing Symantec Data Loss Prevention installation, certificate revocation is not enabled by
default.
See “Configuring certificate revocation checks” on page 135.
If the Enforce Server computer must use a proxy to access either the OCSP responder service
or CRLDP, then you must configure the proxy settings on the Enforce Server computer.
See “Accessing the OCSP responder or CRLDP with a proxy” on page 136.
If you are using OCSP for revocation checks but certificate client certificate AIA fields do not
specify a valid OCSP responder, then you must manually configure OCSP responder properties
in the manager-certauth.security configuration file.
See “Manually configuring OCSP responder properties” on page 137.
 Managing roles and users 135
About certificate authentication configuration

Configuring certificate revocation checks

When you enable certificate revocation checks, Symantec Data Loss Prevention uses OCSP
to determine if the certificate authority revoked each client certificate.. If the certificate status
cannot be determined using OCSP, Symantec Data Loss Prevention uses a CRLDP to
determine the revocation status.
Follow this procedure to enable certificate revocation checks.
To configure certificate revocation checks
1 Ensure that the OCSP responder is configured, either in the AIA field of each certificate
or in the manager-certauth.security file.
See “About certificate revocation checks” on page 133.
See “Manually configuring OCSP responder properties” on page 137.
2 Ensure that the CRLDP is defined in the CRL distribution point field of each client certificate.
3 Log on to the Enforce Server computer using the account that you created during Symantec
Data Loss Prevention installation.

Note: Do not change permissions or ownership on any configuration file from another
root or Administrator account.

4 Change directory to the /opt/SymantecDLP/Protect/config (Linux) or

c:\SymantecDLP\Protect\config (Windows) directory. If you installed Symantec Data
Loss Prevention into a different directory, substitute the correct path.
5 Open the VontuManager.conf file with a text editor.
6 To enable certificate revocation checks, add or edit the following line in the file:

wrapper.java.additional.19=-Dcom.sun.net.ssl.checkRevocation=true

To disable the checks, change the value to false.

7 To configure the OCSP responder server manually, instead of using the AIA field in client
certificates, edit the following line in the file:

wrapper.java.additional.20=-Djava.security.properties=../config/manager-certauth.security

Also enable this line in the file if you want to disable OCSP revocation checking. Then
you can configure a property in manager-certauth.security to disable OCSP checks.
Ensure that the configuration parameter points to the indicated OCSP configuration file.
Always edit the existing manager-certauth.security file, rather than creating a new file.
See “Manually configuring OCSP responder properties” on page 137.
 Managing roles and users 136
About certificate authentication configuration

8 To enable revocation checking using a CRLDP, add or uncomment the following line in
the file:

wrapper.java.additional.22=-Dcom.sun.security.enableCRLDP=true

This option is enabled by default for new Symantec Data Loss Prevention installations.
9 If you use CRLDP revocation checks, optionally configure the cache lifetime using the
property:

wrapper.java.additional.22=-Dsun.security.certpath.ldap.cache.lifetime=30

This parameter specifies the length of time, in seconds, to cache the revocation lists that
are obtained from a CRL distribution point. After this time is reached, a lookup is performed
to refresh the cache the next time there is an authentication request. 30 seconds is the
default cache lifetime. Specify 0 to disable the cache, or -1 to store cache results
indefinitely.
10 Stop and then restart the Vontu Manager service to apply your changes.

Accessing the OCSP responder or CRLDP with a proxy

Symantec recommends that you allow direct access from the Enforce Server computer to all
OCSP responder servers and CRLDP servers that are required to perform certificate revocation
checks. If the OCSP responder or the CRLDP servers are accessible only through a proxy,
then you must configure the proxy settings on the Enforce Server computer.
When you configure a proxy, the Enforce Server uses your proxy configuration for all HTTP
connections, such as those connections that are created to connect to a Data Insight server
to fetch certificates. Check with your proxy administrator before you configure these proxy
settings, and consider allowing direct access to OCSP servers and CRDLP servers if at all
possible.
To configure proxy settings for an OCSP responder or CRLDP server
1 Ensure that the OCSP responder is configured in the AIA field of each certificate.
See “About certificate revocation checks” on page 133.
2 Ensure that the CRLDP is defined in the CRL distribution point field of each client certificate.
3 Log on to the Enforce Server computer using the account that you created during Symantec
Data Loss Prevention installation.

Note: Do not change permissions or ownership on any configuration file from another
root or Administrator account.
 Managing roles and users 137
About certificate authentication configuration

4 Change directory to the /opt/SymantecDLP/Protect/config (Linux) or

c:\SymantecDLP\Protect\config (Windows) directory. If you installed Symantec Data
Loss Prevention into a different directory, substitute the correct path.
5 Open the VontuManager.conf file with a text editor.
6 Add or edit the following configuration properties to identify the proxy:

wrapper.java.additional.22=-Dhttp.proxyHost=myproxy.mydomain.com
wrapper.java.additional.23=-Dhttp.proxyPort=8080
wrapper.java.additional.24=-Dhttp.nonProxyHosts=hosts

Replace myproxy.mydomain.com and 8080 with the host name and port of your proxy
server. Replace hosts with one or more accessible OCSP responders to use if the proxy
is unavailable. You can include server host names, fully qualified domain names, or IP
addresses separated with a pipe character. For example:

wrapper.java.additional.24=-Dhttp.nonProxyHosts=ocsp-server|
127.0.0.1|DataInsight_Server_Host

7 Save your changes to the configuration file.

8 Stop and then restart the Vontu Manager service to apply your changes.

Manually configuring OCSP responder properties

You can optionally edit the manager-certauth.security file to configure OCSP connection
parameters for your system. By default, this file enables OCSP checks, but all other options
are commented and inactive. If you uncomment any parameters in the file, those parameters
override the OCSP configuration that is present in the AIA fields of a client certificate.
See “About certificate revocation checks” on page 133.

Note: If the OCSP responder that you configure in this file does not use the CA certificate to
sign its responses, then you must add the OCSP responder's certificate to the Tomcat trust
store.
See “Adding certificate authority (CA) certificates to the Tomcat trust store” on page 129.

manager-certauth.security is located in the /opt/SymantecDLP/Protect/config (Linux)

or c:\SymantecDLP\Protect\config (Windows) directory. Always edit the existing
manager-certauth.security file, rather than create a new file. You may want to backup the
file before making your changes to preserve the original contents. The
manager-certauth.security contains additional information about these parameters.

The file contains the following parameters.

 Managing roles and users 138
About certificate authentication configuration

Table 5-5 OCSP configuration parameters

Configuration parameter with example Description

ocsp.enable=true This parameter enables OCSP for revocation checks if

certificate revocation is also enabled in the
VontuManager.properties file. This parameter is
enabled by default for all Symantec Data Loss Prevention
installations. Disable the property if you want to use only
CRLDP checks instead of OCSP.

ocsp.responderURL=http://ocsp.example.net:80 Defines the URL of OCSP responder. If you do not define

this parameter, the URL is taken from the AIA field in the
client certificate, if available.

ocsp.responderCertSubjectName=CN=OCSP Defines the subject name of the certificate that corresponds

Responder, O=XYZ Corp to the OCSP responder. By default Symantec Data Loss
Prevention assumes that the certificate of the issuer of the
client certificate corresponds to the OCSP responder's
certificate. If you do not use this default configuration, you
must identify the OCSP responder's certificate in some
other way. You must also add the OCSP responder
certificate to the Tomcat trust store.

See “Adding certificate authority (CA) certificates to the

Tomcat trust store” on page 129.

If you cannot accurately identify the certificate of the OCSP

responder using only the subject name, then use both the
ocsp.responderCertIssuerName and
ocsp.responderCertSerialNumber parameters
instead of ocsp.responderCertSubjectName. If you
define ocsp.responderCertSubjectName, then the
remaining two parameters in this table are ignored.

ocsp.responderCertIssuerName=CN=Enterprise Use this parameter in combination with

CA, O=XYZ Corp ocsp.responderCertSerialNumber to identify the
OCSP responder certificate. This parameter defines the
certificate issuer of the OCSP responder's certificate.

If you use this parameter, do not also use the

ocsp.responderCertSubjectName parameter.

ocsp.responderCertSerialNumber=2A:FF:00 Use this parameter in combination with

ocsp.responderCertIssuerName to identify the OCSP
responder certificate. This parameter defines the serial
number of the OCSP responder's certificate.

If you use this parameter, do not also use the

ocsp.responderCertSubjectName parameter.
 Managing roles and users 139
About certificate authentication configuration

Troubleshooting certificate authentication

By default Symantec Data Loss Prevention logs each successful log-on request to the Enforce
Server administration console. Symantec Data Loss Prevention also logs an error message
if a logon request is made without supplying a certificate, or if a valid certificate presents a CN
that does not map to a valid user account in the Enforce Server configuration.

Note: If certificate authentication fails while the browser establishes an HTTPS connection to
the Enforce Server administration console, then Symantec Data Loss Prevention cannot log
an error message.

You can optionally log additional information about certificate revocation checks by adding or
uncommenting the following system property in the VontuManager.conf file:

wrapper.java.additional.90=-Djava.security.debug=certpath

VontuManager.conf is located in the c:\SymantecDLP\Protect\config (Windows) or

/opt/SymantecDLP/Protect/config (Linux) directory. All debug messages are logged to
c:\SymantecDLP\Protect\logs\debug\VontuManager.log (Windows) or
/var/log/SymantecDLP/debug/VontuManager.log (Linux).

Disabling password authentication and forms-based logon

Forms-based log on with password authentication can be used as a fallback access mechanism
while you configure and test certificate authentication. After you configure certificate
authentication, you can disable forms-based logon and password authentication. Your public
key infrastructure then handles all logon requests.
Once you configure the common name (CN) with both forms and certificate enabled, then you
can switch to certificate-only. You replace the springSecurityContext.xml file with the
springSecurityContext-Certificate.xml file and restart Enforce Server. Form-based logon
is then completely disabled.

Note: When you disable forms-based logon you disable the feature for all users, including
those with Administrator privileges. As an alternative, you can disable forms-based logon or
certificate authentication for an individual user by configuring that user's account.
See “Configuring user accounts” on page 105.

If you later turn on forms-based logon but the Administrator user account does not have a
password configured, you can reset the Administrator password. Reset the password using
the AdminPasswordReset utility.
See “Resetting the Administrator password” on page 109.
 Chapter 6
Connecting to group
directories
This chapter includes the following topics:

■ Creating connections to LDAP servers

■ Configuring directory server connections

■ Scheduling directory server indexing

Creating connections to LDAP servers

Symantec Data Loss Prevention supports directory server connections to LDAP-compliant
directory servers such as Microsoft Active Directory (AD). A group directory connection specifies
how the Enforce Server or Discover Server connects to the directory server.
The connection to the directory server must be established before you create any user groups
in the Enforce Server. The Enforce Server or Discover Server uses the connection to obtain
details about the groups. If this connection is not created, you are not able to define any User
Groups. The connection is not permanent, but you can configure the connection to synchronize
at a specified interval. The directory server contains all of the information that you need to
create User Groups.
See “User Groups” on page 335.

Note: If you use a directory server that contains a self-signed authentication certificate, you
must add the certificate to the Enforce Server or the Discover Server. If your directory server
uses a pre-authorized certificate, it is automatically added to the Enforce Server or Discover
Server. See “Importing SSL certificates to Enforce or Discover servers” on page 238.
 Connecting to group directories 141
Configuring directory server connections

To create a group directory connection

1 Navigate to the System > Settings > Directory Connections screen.
2 Click Add Connection.
3 Configure the directory connection.
See “Configuring directory server connections” on page 141.

Configuring directory server connections

The Directory Connections page is the home page for configuring directory server connections.
Once you define the directory connection, you can create one or more User Groups.
See “Configuring User Groups” on page 748.

Table 6-1 Configuring directory server connections

Step Action Description

1 Navigate to the Directory Connections This page is available at System > Settings > Directory
page (if not already there). Connections.

2 Click Create New Connection. This action takes you to the Configure Directory
Connection page.

3 Enter a Name for the directory server The Connection Name is the user-defined name for the
connection. connection. It appears at the Directory Connections home
page once the connection is configured.

4 Specify the Network Parameters for the Table 6-2 provides details on these parameters.
directory server connection. Enter or specify the following parameters:

■ The Hostname of the computer where the directory

server is installed.
■ The Port on the directory server that supports
connections.
■ The Base DN (distinguished name) of the directory
server.
■ The Encryption Method for the connection, either None
or Secure.

5 Specify the Authentication mode for Table 6-3 provides details on configuring the authentication
connecting to the directory server. parameters.

6 Click Test Connection to verify the If there is anything wrong with the connection, the system
connection. displays an error message describing the problem.
 Connecting to group directories 142
Configuring directory server connections

Table 6-1 Configuring directory server connections (continued)

Step Action Description

7 Click Save to save the direction connection The system automatically indexes the directory server after
configuration. you successfully create, test, and save the directory server
connection.

8 Select the Index and Replication Status Verify that the directory server was indexed. After some time
tab. (depending on the size of the directory server query), you
should see that the Replication Status is "Completed
<date> <time>". If you do not see that the status is
completed, verify that you have configured and tested the
directory connection properly. Contact your directory server
administrator for assistance.

9 Select the Index Settings tab. You can adjust the directory server indexing schedule as
necessary at the Index Settings tab.

See “Scheduling directory server indexing” on page 143.

Table 6-2 Directory connection network parameters

Network parameters Description

Hostname Enter the Hostname of the directory server.

For example: enforce.dlp.symantec.com

You must enter the Fully Qualified Name (FQN) of the directory server. Do not use
the IP address.

Port Enter the connection Port for the directory server.

For example: 389

Typically the port is 389 or 636 for secure connections.

Base DN Enter the Base DN for the directory server. This field only accepts one directory
server entry.

For example: dc=enforce,dc=dlp,dc=symantec,dc=com

The Base DN string cannot contain any space characters.

The Base DN is the base distinguished name of the directory server. Typically, this
name is the domain name of the directory server. The Base DN parameter defines
the initial depth of the directory server search.
 Connecting to group directories 143
Scheduling directory server indexing

Table 6-2 Directory connection network parameters (continued)

Network parameters Description

Encryption Method Select the Secure option if you want the communication between the directory server
and the Enforce Server to be encrypted using SSL.
Note: If you choose to use a secure connection, you may need to import the SSL
certificate for the directory server to the Enforce Server keystore. See “Importing SSL
certificates to Enforce or Discover servers” on page 238.

Table 6-3 Directory connection authentication parameters

Authentication Description

Authentication Select the Authentication option to connect to the directory server using
authentication mode. Check Connect with Credentials to add your username and
password to authenticate to the directory server.

Username To authenticate with Active Directory, use one of the following methods:

■ Domain and user name, for example: Domain\username

■ User name and domain, for example: username@domain.com
■ Fully distinguished user name and domain (without spaces), for example:
cn=username,cn=Users,dc=domain,dc=com
To authenticate with another type of directory server:

■ A different syntax may be required, for example:

uid=username,ou=people,o=company

Password Enter the password for the user name that was specified in the preceding field.

The password is obfuscated when you enter it.

Scheduling directory server indexing

Each directory connection is set to automatically index the configured LDAP server once at
12:00 AM the day after you create the initial connection. You can modify the indexing schedule
to specify when and how often the index is synchronized.
Each directory server connection is set to automatically index the configured User Groups
hosted in the directory server once at 12:00 AM the day after you create the initial connection.
After you create, test, and save the directory server connection, the system automatically
indexes all of the User Groups that are hosted in the directory whose connection you have
established. You can modify this setting, and schedule indexing daily, weekly, or monthly.
 Connecting to group directories 144
Scheduling directory server indexing

To schedule group directory indexing

1 Select an existing group directory server connection from the System > Settings >
Directory Connections screen. Or, create a new connection.
See “Configuring directory server connections” on page 141.
2 Adjust the Index Settings to the desired schedule.
See Table 6-4 on page 144.

Table 6-4 Schedule group directory server indexing and view status

Index Settings Description

Index the directory server The Once setting is selected by default and automatically indexes the director
once. server at 12:00 AM the day after you create the initial connection.

You can modify the default Once indexing schedule by specifying when and
how often the index is supposed to be rebuilt.

Index the directory server Select the Daily option to schedule the index daily.
daily.
Specify the time of day and, optionally, the Until duration for this schedule.

Index the directory server Select the Weekly option to schedule the index to occur once a week.
weekly.
Specify the day of the week to index.

Specify the time to index.

Optionally, specify the Until duration for this schedule.

Index the directory server Specify the day of the month to index the directory and the time.
monthly.
Optionally, specify the Until duration for this schedule.

View the indexing and Select the Index and Replication Status tab to view the status of the indexing
replication status. process.

■ Indexing Status
Displays the next scheduled index, date and time.
■ Detection Server Name
Displays the detection server where the User Group profile is deployed.
■ Replication Status
■ Displays the data and time of the most recent synchronization with the
directory group server.
 Chapter 7
Managing stored
credentials
This chapter includes the following topics:

■ About the credential store

■ Adding new credentials to the credential store

■ Configuring endpoint credentials

■ Managing credentials in the credential store

■ Managing stored credentials

About the credential store

An authentication credential can be stored as a named credential in a central credential store.
It can be defined once, and then referenced by any number of Discover targets. Passwords
are encrypted before they are stored.
The credential store simplifies management of user name and password changes.
You can add, delete, or edit stored credentials.
See “Adding new credentials to the credential store” on page 146.
See “Managing credentials in the credential store” on page 147.
The Credential Management screen is accessible to users with the "Credential Management"
privilege.
Stored credentials can be used when you edit or create a Discover target.
See “Network Discover/Cloud Storage Discover scan target configuration options” on page 1532.
 Managing stored credentials 146
Adding new credentials to the credential store

Adding new credentials to the credential store

You can add new credentials to the credential store. These credentials can later be referenced
with the credential name.
To add a stored credential
1 Click System > Settings > Credentials, and click Add Credential.
2 Enter the following information:

Credential Name Enter your name for this stored credential.

The credential name must be unique within the

credential store. The name is used only to identify
the credential.

Access Username Enter the user name for authentication.

Access Password Enter the password for authentication.

Re-enter Access Password Re-enter the password.

3 Click Save.
4 You can later edit or delete credentials from the credential store.
See “Managing credentials in the credential store” on page 147.
See “Configuring endpoint credentials” on page 146.

Configuring endpoint credentials

You must add credentials to the Credential Store before you can access credentials for Endpoint
FlexResponse or the Endpoint Discover Quarantine response rule. The credentials are stored
in an encrypted folder on all endpoints that are connected to an Endpoint Server. Because all
endpoints store the credentials, you must be careful about the type of credentials you store.
Use credentials that cannot access other areas of your system. Before your endpoint credentials
can be used, you must enable the Enforce Server to recognize them.
To create endpoint credentials
1 Go to: System > Settings > General.
2 Click Configure.
3 Under the Credential Management section, ensure that the Allow Saved Credentials
on Endpoint Agent checkbox is selected.
4 Click Save.
 Managing stored credentials 147
Managing credentials in the credential store

5 Go to: System > Settings > Credentials.

6 Click Add Credential.
7 Under the General section, enter the details of the credential you want to add.
8 Under Usage Permission, select Servers and Endpoint agents.
9 Click Save.
See “About the credential store” on page 145.
See “Configuring the Endpoint Discover: Quarantine File action” on page 1270.

Managing credentials in the credential store

You can delete or edit a stored credential.
To delete a stored credential
1 Click System > Settings > Credentials. Locate the name of the stored credential that
you want to remove.
2 Click the delete icon to the right of the name. A credential can be deleted only if it is not
currently referenced in a Discover target or indexed document profile.
To edit a stored credential
1 Click System > Settings > Credentials. Locate the name of the stored credential that
you want to edit.
2 Click the edit icon (pencil) to the right of the name.
3 Update the user name or password.
4 Click Save.
5 If you change the password for a given credential, the new password is used for all
subsequent Discover scans that use that credential.

Managing stored credentials

An authentication credential can be stored in a central credential store. It can be defined once
as a named credential, and then referenced by any number of Network Discover/Cloud Storage
Discover targets.
Store your authentication credentials in a central store to simplify management of user name
and password changes.
You can add, delete, or edit stored credentials.
 Managing stored credentials 148
Managing stored credentials

To add a stored credential

1 In System > Settings > Credentials, click Add Credential.
2 Enter the following information:

Credential Name Enter your name for this stored credential.

The credential name must be unique within the

credential store. The name is used only to identify
the credential.

Access Username Enter the user name for authentication.

Access Password Enter the password for authentication.

Re-enter Access Password Re-enter the password.

3 Click Save.
To delete a stored credential
1 In System > Settings > Credentials, locate the name of the stored credential that you
want to remove.
2 Click the delete icon to the right of the name. A credential can be deleted only if it is not
currently referenced in a Discover target or indexed document profile.
To edit a stored credential
1 In System > Settings > Credentials, locate the name of the stored credential that you
want to edit.
2 Click the edit icon (pencil) to the right of the name.
3 Update the user name or password.
4 Click Save.
5 If you change the password for a given credential, the new password is used for all
subsequent Discover scans that use that credential.
See “Providing the password authentication for Network Discover scanned content” on page 1537.
 Chapter 8
Managing system events
and messages
This chapter includes the following topics:

■ About system events

■ System events reports

■ Working with saved system reports

■ Server and Detectors event detail

■ Configuring event thresholds and triggers

■ About system event responses

■ Enabling a syslog server

■ About system alerts

■ Configuring the Enforce Server to send email alerts

■ Configuring system alerts

■ About log review

■ System event codes and messages

About system events

System events related to your Symantec Data Loss Prevention installation are monitored,
reported, and logged. System events include notifications from Cloud Operations for cloud
services.
System event reports are viewed from the Enforce Server administration console:
 Managing system events and messages 150
System events reports

■ The five most recent system events of severity Warning or Severe are listed on the
Overview screen (System > Servers and Detectors > Overview).
See “About the Overview screen” on page 239.
■ Reports on all system events of any severity can be viewed by going to System > Servers
and Detectors > Events.
See “System events reports” on page 150.
■ Recent system events for a particular detection server or cloud service are listed on the
Server/Detector Detail screen for that server or detector.
See “Server/Detector Detail screen” on page 243.
■ Click on any event in an event list to go to the Event Details screen for that event. The
Event Details screen provides additional information about the event.
See “Server and Detectors event detail” on page 154.
There are three ways that system events can be brought to your attention:
■ System event reports displayed on the administration console
■ System alert email messages
See “About system alerts” on page 160.
■ Syslog functionality
See “Enabling a syslog server” on page 159.
Some system events require a response.
See “About system event responses” on page 157.
To narrow the focus of system event management you can:
■ Use the filters in the various system event notification methods.
See “System events reports” on page 150.
■ Configure the system event thresholds for individual servers.
See “Configuring event thresholds and triggers” on page 155.

System events reports

To view all system events, go to the system events report screen (System > Servers and
Detectors > Events). This screen lists events, one event per line. The list contains those
events that match the selected data range, and any other filter options that are listed in the
Applied Filters bar. For each event, the following information is displayed:

Table 8-1
Events Description

Type The type (severity) of the event. Type may be any one of those listed in Table 8-2.
 Managing system events and messages 151
System events reports

Table 8-1 (continued)

Events Description

Time The date and time of the event.

Server The name of the server on which the event occurred.

Host The IP address or host name of the server on which the event occurred.

Code A number that identifies the kind of event.

See the Symantec Data Loss Prevention Administration Guide for information on event
code numbers.

Summary A brief description of the event. Click on the summary for more detail about the event.

Table 8-2 System event types

Event Description

System information

Warning

Severe

You can select from several report handling options.

See “Common incident report features” on page 1381.
Click any event in the list to go to the Event Details screen for that event. The Event Details
screen provides additional information about the event.
See “Server and Detectors event detail” on page 154.
Since the list of events can be long, filters are available to help you select only the events that
you are interested in. By default, only the Date filter is enabled and it is initially set to All Dates.
The Date filter selects events by the dates the events occurred.
To filter the list of system events by date of occurrence
1 Go to the Filter section of the events report screen and select one of the date range
options.
2 Click Apply.
3 Select Custom from the date list to specify beginning and end dates.
In addition to filtering by date range, you can also apply advanced filters. Advanced filters are
cumulative with the current date filter. This means that events are only listed if they match the
advanced filter and also fall within the current date range. Multiple advanced filters can be
 Managing system events and messages 152
System events reports

applied. If multiple filters are applied, events are only listed if they match all the filters and the
date range.
To apply additional advanced filters
1 Click on Advanced Filters and Summarization.
2 Click on Add Filter.
3 Choose the filter you want to use from the left-most drop-down list. Available filters are
listed in Table 8-3.
4 Choose the filter-operator from the middle drop-down list.

Note: You can use the Cloud Operations filter value to view events from Cloud Operations
for your detectors.

For each advanced filter you can specify a filter-operator Is Any Of or Is None Of.
5 Enter the filter value, or values, in the right-hand text box, or click a value in the list to
select it.
■ To select multiple values from a list, hold down the Control key and click each one.
■ To select a range of values from a list, click the first one, then hold down the Shift key
and click the last value in the range you want.

6 (Optional) Specify additional advanced filters if needed.

7 When you have finished specifying a filter or set of filters, click Apply.
Click the red X to delete an advanced filter.
The Applied Filters bar lists the filters that are used to produce the list of events that is
displayed. Note that multiple filters are cumulative. For an event to appear on the list it must
pass all the applied filters.
The following advanced filters are available:

Table 8-3 System events advanced filter options

Filter Description

Event Code Filter events by the code numbers that identify each
kind of event. You can filter by a single code number
or multiple code numbers separated by commas
(2121, 1202, 1204). Filtering by code number
ranges, or greater than, or less than operators is
not supported.
 Managing system events and messages 153
Working with saved system reports

Table 8-3 System events advanced filter options (continued)

Filter Description

Event type Filter events by event severity type (Info, Warning,

or Severe).

Server Filter events by the server on which the event

occurred.

Note: A small subset of the parameters that trigger system events have thresholds that can
be configured. These parameters should only be adjusted with advice from Symantec Support.
Before changing these settings, you should have a thorough understanding of the implications
that are involved. The default values are appropriate for most installations.
See “Configuring event thresholds and triggers” on page 155.

See “About system events” on page 149.

See “Server and Detectors event detail” on page 154.
See “ Working with saved system reports” on page 153.
See “Configuring event thresholds and triggers” on page 155.
See “About system alerts” on page 160.

Working with saved system reports

The System Reports screen lists system and agent-related reports that have previously been
saved. To display the System Reports screen, click System > System Reports. Use this
screen to work with saved system reports.
To create a saved system report
1 Go to one of the following screens:
■ System Events (System > Events)
■ Agents Overview (System > Agents > Overview)
■ Agents Events (System > Agents > Events)
See “About the Enforce Server administration console” on page 66.
2 Select the filters and summaries for your custom report.
See “About custom reports and dashboards” on page 1364.
3 Select Report > Save As.
 Managing system events and messages 154
Server and Detectors event detail

4 Enter the saved report information.

See “Saving custom incident reports” on page 1366.
5 Click Save.
The System Reports screen is divided into two sections:
■ System Event - Saved Reports lists saved system reports.
■ Agent Management - Saved Reports lists saved agent reports.
For each saved report you can perform the following operations:
■ Share the report. Click share to allow other Symantec Data Loss Prevention uses who
have the same role as you to share the report. Sharing a report cannot be undone; after a
report is shared it cannot be made private. After a report is shared, all users with whom it
is shared can view, edit, or delete the report.
See “Saving custom incident reports” on page 1366.
■ Change the report name or description. Click the pencil icon to the right of the report name
to edit it.
■ Change the report scheduling. Click the calendar icon to the right of the report name to
edit the delivery schedule of the report and to whom it is sent.
See “Saving custom incident reports” on page 1366.
See “Delivery schedule options for incident and system reports” on page 1369.
■ Delete the report. Click the red X to the right of the report name to delete the report.

Server and Detectors event detail

To view the Server and Detectors Event Detail screen, go to System > Servers and
Detectors > Events and click one of the listed events.
See “System events reports” on page 150.
The Server and Detectors Event Detail screen displays all of the information available for
the selected event. The information on this screen is not editable.
The Server and Detectors Event Detail screen is divided into two sections—General and
Message.
 Managing system events and messages 155
Configuring event thresholds and triggers

Table 8-4 Event detail — General

Item Description

Type The event is one of the following types:

■ Info: Information about the system.
■ Warning: A problem that is not severe enough to generate an error.
■ Severe: An error that requires immediate attention.

Time The date and time of the event.

Server or The name of the server or detector.

Detector

Host The host name or IP address of the server.

Table 8-5 Event detail — Message

Item Description

Code A number that identifies the kind of event.

See “System event codes and messages” on page 164.

Summary A brief description of the event.

Detail Detailed information about the event.

See “About system events” on page 149.

See “System events reports” on page 150.
See “About system alerts” on page 160.

Configuring event thresholds and triggers

A small subset of the parameters that trigger system events have thresholds that can be
configured. These parameters are configured for each detection server or detector separately.
These parameters should only be adjusted with advice from Symantec Support. Before changing
these settings, you should have a thorough understanding of the implications. The default
values are appropriate for most installations.
See “About system events” on page 149.
 Managing system events and messages 156
Configuring event thresholds and triggers

To view and change the configurable parameters that trigger system events
1 Go to the Overview screen (System > Servers and Detectors > Overview).
2 Click on the name of a detection server or detector to display that server's Server/Detector
Detail screen.
3 Click Server/Detector Settings.
The Advanced Server/Detector Settings screen for that server is displayed.
4 Change the configurable parameters, as needed.

Table 8-6 Configurable parameters that trigger events

Parameter Description Event

BoxMonitor.DiskUsageError
Indicates the amount of filled disk space Low disk space
(as a percentage) that triggers a severe
system event. For example, a Severe
event occurs if a detection server is
installed on the C drive and the disk
space error value is 90. The detection
server creates a Severe system event
when the C drive usage is 90% or
greater. The default is 90.

BoxMonitor.DiskUsageWarning
Indicates the amount of filled disk space Low disk space
(as a percentage) that triggers a
Warning system event. For example, a
Warning event occurs if the detection
server is installed on the C drive and the
disk space warning value is 80. Then
the detection server generates a
Warning system event when the C drive
usage is 80% or greater. The default is
80.

BoxMonitor.MaxRestartCount Indicates the number of times that a process name restarts excessively
system process can be restarted in one
hour before a Severe system event is
generated. The default is 3.

IncidentDetection.MessageWaitSevere Indicates the number of minutes Long message wait time

messages need to wait to be processed
before a Severe system event is sent
about message wait times. The default
is 240.
 Managing system events and messages 157
About system event responses

Table 8-6 Configurable parameters that trigger events (continued)

Parameter Description Event

IncidentDetection.MessageWaitWarning Indicates the number of minutes Long message wait time

messages need to wait to be processed
before sending a Severe system event
about message wait times. The default
is 60.

IncidentWriter.BacklogInfo Indicates the number of incidents that N incidents in queue

can be queued before an Info system
event is generated. This type of backlog
usually indicates that incidents are not
processed or are not processed
correctly because the system may have
slowed down or stopped. The default is
1000.

IncidentWriter.BacklogWarning Indicates the number of incidents that N incidents in queue

can be queued before generating a
Warning system event. This type of
backlog usually indicates that incidents
are not processed or are not processed
correctly because the system may have
slowed down or stopped. The default is
3000.

IncidentWriter.BacklogSevere Indicates the number of incidents that N incidents in queue

can be queued before a Severe system
event is generated. This type of backlog
usually indicates that incidents are not
processed or are not processed
correctly because the system may have
slowed down or stopped. The default is
10000.

About system event responses

There are three ways that system events can be brought to your attention:
■ System event reports displayed on the administration console
■ System alert email messages
See “About system alerts” on page 160.
■ Syslog functionality
See “Enabling a syslog server” on page 159.
 Managing system events and messages 158
About system event responses

In most cases, the system event summary and detail information should provide enough
information to direct investigation and remediation steps. The following table provides some
general guidelines for responding to system events.

Table 8-7 System event responses

System event or category Appropriate response

Low disk space If this event is reported on a detection server, recycle the
Symantec Data Loss Prevention services on the detection server.
The detection server may have lost its connection to the Enforce
Server. The detection server then queues its incidents locally,
and fills up the disk.

If this event is reported on an Enforce Server, check the status

of the Oracle and the Vontu Incident Persister services. Low disk
space may result if incidents do not transfer properly from the file
system to the database. This event may also indicate a need to
add additional disk space.

Tablespace is almost full Add additional data files to the database. When the hard disk is
at 80% of capacity, obtain a bigger disk instead of adding
additional data files.

Refer to the Symantec Data Loss Prevention Installation Guide.

Licensing and versioning Contact Symantec Support.

Monitor not responding
Restart the Symantec Monitor service. If the event persists, check
the network connections. Make sure the computer that hosts the
detections server is turned on by connecting to it. You can connect
with terminal services or another remote desktop connection
method. If necessary, contact Symantec Support.

See “About Symantec Data Loss Prevention services”

on page 85.

Alert or scheduled report sending Go to System > Settings > General and ensure that the settings
failed in the Reports and Alerts and SMTP sections are configured
correctly. Check network connectivity between the Enforce Server
and the SMTP server. Contact Symantec Support.

Auto key ignition failed Contact Symantec Support.

Cryptographic keys are inconsistent Contact Symantec Support.

 Managing system events and messages 159
Enabling a syslog server

Table 8-7 System event responses (continued)

System event or category Appropriate response

Long message wait time Increase detection server capacity by adding more CPUs or
replacing the computer with a more powerful one.

Decrease the load on the detection server. You can decrease

the load by applying the traffic filters that have been configured
to detect fewer incidents. You can also re-route portions of the
traffic to other detection servers.

Increase the threshold wait times if all of the following items are
true:

■ This message is issued during peak hours.

■ The message wait time drops down to zero before the next
peak.
■ The business is willing to have such delays in message
processing.

process_name restarts excessively Check the process by going to System > Servers > Overview.
To see individual processes on this screen, Process Control must
be enabled by going to System > Settings > General >
Configure.

N incidents in queue Investigate the reason for the incidents filling up the queue.
The most likely reasons are as follows:

■ Connection problems. Response: Make sure the

communication link between the Endpoint Server and the
detection server is stable.
■ Insufficient connection bandwidth for the number of generated
incidents (typical for WAN connections). Response: Consider
changing policies (by configuring the filters) so that they
generate fewer incidents.

Enabling a syslog server

Syslog functionality sends Severe system events to a syslog server. Syslog servers allow
system administrators to filter and route the system event notifications on a more granular
level. System administrators who use syslog regularly for monitoring their systems may prefer
to use syslog instead of alerts. Syslog may be preferred if the volume of alerts seems unwieldy
for email.
Syslog functionality is an on or off option. If syslog is turned on, all Severe events are sent to
the syslog server.
 Managing system events and messages 160
About system alerts

To enable syslog functionality

1 Go to the \SymantecDLP\Protect\config directory on Windows or the
/opt/SymantecDLP/Protect/config directory on Linux.

2 Open the Manager.properties file.

3 Uncomment the #systemevent.syslog.host= line by removing the # symbol from the
beginning of the line, and enter the hostname or IP address of the syslog server.
4 Uncomment the #systemevent.syslog.port= line by removing the # symbol from the
beginning of the line. Enter the port number that should accept connections from the
Enforce Server server. The default is 514.
5 Uncomment the #systemevent.syslog.format= [{0}] {1} - {2} line by removing the
# symbol from the beginning of the line. Then define the system event message format
to be sent to the syslog server:
If the line is uncommented without any changes, the notification messages are sent in the
format: [server name] summary - details. The format variables are:
■ {0} - the name of the server on which the event occurred
■ {1} - the event summary
■ {2} - the event detail
For example, the following configuration specifies that Severe system event notifications
are sent to a syslog host named server1 which uses port 600.

systemevent.syslog.host=server1
systemevent.syslog.port=600
systemevent.syslog.format= [{0}] {1} - {2}

Using this example, a low disk space event notification from an Enforce Server on a host
named dlp-1 would look like:

dlp-1 Low disk space - Hard disk space for

incident data storage server is low. Disk usage is over 82%.

See “About system events” on page 149.

About system alerts

System alerts are email messages that are sent to designated addresses when a particular
system event occurs. You define what alerts (if any) that you want to use for your installation.
Alerts are specified and edited on the Configure Alert screen, which is reached by System
> Servers and Detectors > Alerts > Add Alert.
 Managing system events and messages 161
Configuring the Enforce Server to send email alerts

Alerts can be specified based on event severity, server name, or event code, or a combination
of those factors. Alerts can be sent for any system event.
The email that is generated by the alert has a subject line that begins with Symantec Data
Loss Prevention System Alert followed by a short event summary. The body of the email
contains the same information that is displayed by the Event Detail screen to provide complete
information about the event.
See “Configuring the Enforce Server to send email alerts” on page 161.
See “Configuring system alerts” on page 162.
See “Server and Detectors event detail” on page 154.

Configuring the Enforce Server to send email alerts

To send out email alerts regarding specified system events, the Enforce Server has to be
configured to support sending of alerts and reports. This section describes how to specify the
report format and how to configure Symantec Data Loss Prevention to communicate with an
SMTP server.
After completing the configuration described here, you can schedule the sending of specific
reports and create specific system alerts.
To configure Symantec Data Loss Prevention to send alerts and reports
1 Go to System > Settings > General and click Configure.
The Edit General Settings screen is displayed.
2 In the Reports and Alerts section, select one of the following distribution methods:
■ Send reports as links, logon is required to view. Symantec Data Loss Prevention
sends email messages with links to reports. You must log on to the Enforce Server to
view the reports.

Note: Reports with incident data cannot be distributed if this option is set.

■ Send report data with emails. Symantec Data Loss Prevention sends email messages
and attaches the report data.

3 Enter the Enforce Server domain name or IP address in the Fully Qualified Manager
Name field.
If you send reports as links, Symantec Data Loss Prevention uses the domain name as
the basis of the URL in the report email.
Do not specify a port number unless you have modified the Enforce Server to run on a
port other than the default of 443.
 Managing system events and messages 162
Configuring system alerts

4 If you want alert recipients to see any correlated incidents, check the Correlations Enabled
box.
When correlations are enabled, users see them on the Incident Snapshot screen.
5 In the SMTP section, identify the SMTP server to use for sending out alerts and reports.
Enter the relevant information in the following fields:
■ Server: The fully qualified hostname or IP address of the SMTP server that Symantec
Data Loss Prevention uses to deliver system events and scheduled reports.
■ System email: The email address for the alert sender. Symantec Data Loss Prevention
specifies this email address as the sender of all outgoing email messages. Your IT
department may require the system email to be a valid email address on your SMTP
server.
■ User ID: If your SMTP server requires it, type a valid user name for accessing the
server. For example, enter DOMAIN\bsmith.
■ Password: If your SMTP server requires it, enter the password for the User ID.

6 Click Save.
See “About system alerts” on page 160.
See “Configuring system alerts” on page 162.
See “About system events” on page 149.

Configuring system alerts

You can configure Symantec Data Loss Prevention to send an email alert whenever it detects
a specified system event. Alerts can be specified based on event severity, server name, or
event code, or a combination of those factors. Alerts can be sent for any system event.
See “About system alerts” on page 160.
Note that the Enforce Server must first be configured to send alerts and reports.
See “Configuring the Enforce Server to send email alerts” on page 161.
Alerts are specified and edited on the Configure Alert screen, which is reached by System
> Servers > Alerts and then choosing Add Alert to create a new alert, or clicking on the name
of an existing alert to modify it.
 Managing system events and messages 163
Configuring system alerts

To create or modify an alert

1 Go the Alerts screen (System > Servers and Detectors > Alerts).
2 Click the Add Alert tab to create a new alert, or click on the name of an alert to modify
it.
The Configure Alert screen is displayed.
3 Fill in (or modify) the name of the alert. The alert name is displayed in the subject line of
the email alert message.
4 Fill in (or modify) a description of the alert.
5 Click Add Condition to specify a condition that will trigger the alert.
Each time you click Add Condition you can add another condition. If you specify multiple
conditions, every one of the conditions must be met to trigger the alert.
Click on the red X next to a condition to remove it from an existing alert.
6 Enter the email address that the alert is to be sent to. Separate multiple addresses by
commas.
7 Limit the maximum number of times this alert can be sent in one hour by entering a number
in the Max Per Hour box.
If no number is entered in this box, there is no limit on the number of times this alert can
be sent out. The recommended practice is to limit alerts to one or two per hour, and to
substitute a larger number later if necessary. If you specify a large number, or no number
at all, recipient mailboxes may be overloaded with continual alerts.
8 Click Save to finish.
The Alerts list is displayed.
There are three kinds of conditions that you can specify to trigger an alert:
■ Event type - the severity of the event.
■ Server - the server associated with the event.
■ Event code - a code number that identifies a particular kind of event.
For each kind of condition, you can choose one of two operators:
■ Is any of.
■ Is none of.
For each kind of condition, you can specify appropriate parameters:
■ Event type. You can select one, or a combination of, Information, Warning, Severe. Click
on an event type to specify it. To specify multiple types, hold down the Control key while
clicking on event types. You can specify one, two, or all three types.
 Managing system events and messages 164
About log review

■ Server. You can select one or more servers from the list of available servers. Click on the
name of server to specify it. To specify multiple servers, hold down the Control key while
clicking on server names. You can specify as many different servers as necessary.
■ Event code. Enter the code number. To enter multiple code numbers, separate them with
commas or use the Return key to enter each code on a separate line.
See “System event codes and messages” on page 164.
By combining multiple conditions, you can define alerts that cover a wide variety of system
conditions.

Note: If you define more than one condition, the conditions are treated as if they were connected
by the Boolean "AND" operator. This means that the Enforce Server only sends the alert if all
conditions are met. For example, if you define an event type condition and a server condition,
the Enforce Server only sends the alert if the specified event occurs on the designated server.

See “About system alerts” on page 160.

See “Configuring the Enforce Server to send email alerts” on page 161.
See “System events reports” on page 150.

About log review

Your Symantec Data Loss Prevention installation includes a number of log files. These files
provide information on server communication, Enforce Server and detection server operation,
incident detection, and so on.
By default, logs for the Enforce Server and detection server are stored in the following
directories:
■ Windows:SymantecDLP\Protect\logs
■ Linux: /var/log/SymantecDLP
See “About log files” on page 293.
See also the Symantec Data Loss Prevention System Maintenance Guide for additional
information about working with logs.

System event codes and messages

Symantec Data Loss Prevention system events are monitored, reported, and logged. Each
event is identified by code number listed in the tables.
See “About system events” on page 149.
System event lists and reports can be filtered by event codes.
 Managing system events and messages 165
System event codes and messages

See “System events reports” on page 150.

Note: Numbers enclosed in braces, such as {0}, indicate text strings that are dynamically
inserted into the actual event name or description message.

Table 8-8 General detection server events

Code Summary Description

1000 Monitor started All monitor processes have been started.

1001 Local monitor started All monitor processes have been started.

1002 Monitor started Some monitor processes are disabled and haven't been
started.

1003 Local monitor started Some monitor processes are disabled and haven't been
started.

1004 Monitor stopped All monitor processes have been stopped.

1005 Local monitor stopped All monitor processes have been stopped.

1006 {0} failed to start Process {0} can't be started. See log files for more detail.

1007 {0} restarts excessively Process {0} has restarted {1} times during last {2} minutes.

1008 {0} is down {0} process went down before it had fully started.

1010 Restarted {0} {0} process was restarted because it went down unexpectedly.

1011 Restarted {0} {0} was restarted because it was not responding.

1012 Unable to start {0} Cannot bind to the shutdown datagram socket. Will retry.

1013 {0} resumed starting Successfully bound to the shutdown socket.

1014 Low disk space Hard disk space is low. Symantec Data Loss Prevention
server disk usage is over {0}%.

Table 8-9 Endpoint server events

Code Summary Description

1100 Aggregator started None

1101 Aggregator failed to start Error starting Aggregator. {0} No incidents will be detected.
 Managing system events and messages 166
System event codes and messages

Table 8-9 Endpoint server events (continued)

Code Summary Description

1102 Communications with non-legacy SSL keystore and truststore are not configured for this
agents are disabled endpoint server. Please go to configure server page to
configure SSL keystore and truststore.

Table 8-10 Detection configuration events

Code Summary Description

1200 Loaded policy "{0}" Policy "{0}" v{1} ({2}) has been successfully loaded.

1201 Loaded policies {0} None

1202 No policies loaded No relevant policies are found. No incidents will be detected.
1203 Unloaded policy "{0}" Policy "{0}" has been unloaded.

1204 Updated policy "{0}" Policy "{0}" has been successfully updated. The current policy
version is {1}. Active channels: {2}.

1205 Incident limit reached for Policy The policy "{0}" has found incidents in more than {1}
"{0}" messages within the last {2} hours. The policy will not be
enforced until the policy is changed, or the reset period of {2}
hours is reached.

1206 Long message wait time Message wait time was {0}:{1}:{2}:{3}.

1207 Failed to load Vector Machine Failed to load [{0}] Vector Machine Learning profile. See
Learning profile server logs for more details.

1208 Failed to unload Vector Machine Failed to unload [{0}] Vector Machine Learning profile. See
Learning profile server logs for more details.

1209 Loaded Vector Machine Learning Loaded [{0}] Vector Machine Learning profile.
profile

1210 Unloaded Vector Machine Unloaded [{0}] Vector Machine Learning profile.
Learning profile

1211 Vector Machine Learning training Training succeeded for [{0}] Vector Machine Learning profile.
successful

1212 Vector Machine Learning training Training failed for [{0}] Vector Machine Learning profile.
failed

1213 {0} messages timed out in {0} messages timed out in Detection in the last {1} minutes.
Detection recently Enable Detection execution trace logs for details.
 Managing system events and messages 167
System event codes and messages

Table 8-10 Detection configuration events (continued)

Code Summary Description

1214 Detected regular expression rules Policy set contains regular expression rule(s) with invalid
with invalid patterns patterns. See FileReader.log for details.

Table 8-11 File reader events

Code Summary Description

1301 File Reader started None

1302 File Reader failed to start Error starting File Reader. {0} No incidents will be detected.

1303 Unable to delete folder File Reader was unable to delete folder "{0}" in the file system.
Please investigate, as this will cause system malfunction.

1304 Channel enabled Monitor channel "{0}" has been enabled.

1305 Channel disabled Monitor channel "{0}" has been disabled. 1306 License
received. {0}.

1306 License received. None

1307 started Process is started.

1308 down Process is down.

Table 8-12 ICAP events

Code Summary Description

1400 ICAP channel configured The channel is in {0} mode

1401 Invalid license The ICAP channel is not licensed or the license has expired.
No incidents will be detected or prevented by the ICAP
channel.

1402 Content Removal Incorrect Configuration rule in line {0} is outdated or not written in
proper grammar format. Either remove it from the config file
or update the rule.

1403 Out of memory Error (Web While processing request on connection ID{0}, out of memory
Prevent) while processing error occurred. Please tune your setup for traffic load.
message

1404 Host restriction Any host (ICAP client) can connect to ICAP Server.

1405 Host restriction error Unable to get the IP address of host {0}.
 Managing system events and messages 168
System event codes and messages

Table 8-12 ICAP events (continued)

Code Summary Description

1406 Host restriction error Unable to get the IP address of any host in Icap.AllowHosts.

1407 Protocol Trace Enabled Enabled Traces available at {0}.

1408 Invalid Load Balance Factor Icap LoadBalanceFactor configured to 0. Treating it as 1.

Table 8-13 MTA events

Code Summary Description

1500 Invalid license The SMTP Prevent channel is not licensed or the license has
expired. No incidents will be detected or prevented by the
SMTP Prevent channel.

1501 Bind address error Unable to bind {0}. Please check the configured address or
the RequestProcessor log for more information. 1502 MTA
restriction error Unable to resolve host {0}.

1503 All MTAs restricted Client MTAs are restricted, but no hosts were resolved.
Please check the RequestProcessor log for more information
and correct the RequestProcessor.AllowHosts setting for this
Prevent server.

1504 Downstream TLS Handshake TLS handshake with downstream MTA {0} failed. Please
failed check SmtpPrevent and RequestProcessor logs for more
information.

1505 Downstream TLS Handshake TLS handshake with downstream MTA {0} was successfully
successful completed.

Table 8-14 File inductor events

Code Summary Description

1600 Override folder invalid Monitor channel {0} has invalid source folder: {1} Using folder:
{2}.

1601 Source folder invalid Monitor channel {0} has invalid source folder: {1} The channel
is disabled.
 Managing system events and messages 169
System event codes and messages

Table 8-15 File scan events

Code Summary Description

1700 Scan start failed Discover target with ID {0} does not exist. 1701 Scan
terminated {0}

1702 Scan completed Discover target "{0}" completed a scan successfully.

1703 Scan start failed {0}

1704 Share list had errors {0}

1705 Scheduled scan failed Failed to start a scheduled scan of Discover target {0}. {1}

1706 Scan suspend failed {0}

1707 Scan resume failed {0}

1708 Scheduled scan suspension Scheduled suspension failed for scan of Discover target {0}.
failed {1}

1709 Scheduled scan resume failed Scheduled suspension failed for scan of Discover target {0}.
{1}

1710 Maximum Scan Duration Timeout Discover target "{0}" timed out because of Maximum Scan
Occurred Duration.

1711 Maximum Scan Duration Timeout Maximum scan time duration timed out for scan: {0}. However,
Failed an error occurred while trying to abort the scan.

1712 Scan Idle Timeout Occurred Discover target "{0}" timed out because of Scan Idle Timeout.

1713 Scan Idle Timeout Failed Maximum idle time duration timed out for scan: {0}. However,
an error occurred while trying to abort the scan.

1714 Scan terminated - Invalid Server Scan of discover target "{0}" has been terminated from the
State state of "{1}" because the associated discover server {2}
entered an unexpected state of "{3}".

1715 Scan terminated - Server Scan of discover target "{0}" has been terminated because
Removed the associated discover server {1} is no longer available.

1716 Scan terminated - Server Scan of discover target "{0}" has been terminated because
Reassigned the associated discover server {1} is already scanning
discover target(s) "{2}".

1717 Scan terminated - Transition Failed to handle the state change of discover server {1} while
Failed scanning discover target "{0}". See log files for details.
 Managing system events and messages 170
System event codes and messages

Table 8-15 File scan events (continued)

Code Summary Description

1718 Scan start failed Scan of discover target "{0}" has failed to start. See log files
for detailed error description.

1719 Scan start failed due to Scan of discover target "{0}" has failed, as its target type is
unsupported target type no longer supported.

Table 8-16 Incident attachment external storage events

Code Summary Description

1750 Incident attachment migration Migration of incident attachments from database to external
started storage directory has started.

1751 Incident attachment migration Completed migrating incident attachments from database to
completed external storage directory.

1752 Incident attachment migration One or more incident attachments could not be migrated from
failed database to external storage directory. Check the incident
persister log for more details. Once the error is resolved,
restart the VontuIncidentPersister service to resume
the migration.

1753 Incident attachment migration One or more incident attachments migration from database
error. to external storage directory has encountered error. Check
the incident persister log for more details. Migration will
continue and will retry erred attachment later.

1754 Failed to update incident Failed to update the schedule to delete incident attachments
attachment deletion schedule in the external directory. Check the incident persister log for
more details.

1755 Incident attachment deletion Deletion of obsolete incident attachments from the external
started storage directory has started.

1756 Incident attachment deletion Deletion of obsolete incident attachments from the external
completed storage directory has completed.

1757 Incident attachment deletion One or more incident attachments could not be deleted from
failed the external storage directory. Check the incident persister
log for more details.

1758 Incident attachment external Incident attachment external storage directory is not
storage directory is not accessible. Check the incident persister log for more details.
accessible
 Managing system events and messages 171
System event codes and messages

Table 8-16 Incident attachment external storage events (continued)

Code Summary Description

Incident attachment external Incident attachment external storage directory is accessible.

storage directory is accessible

Table 8-17 Incident persister and incident writer events

Code Summary Description

1800 Incident Persister is unable to Persister ran out of memory processing incident {0}.
process incident Incident

1801 Incident Persister failed to

process incident {0}

1802 Corrupted incident received A corrupted incident was received, and renamed to {0}.

1803 Policy misconfigured Policy "{0}" has no associated severity.

1804 Incident Persister is unable to Incident Persister cannot start because it failed to access the
start incident folder {0}. Check folder permissions.

1805 Incident Persister is unable to Incidents folder The Incident Persister is unable to access
access the incident folder {0}. Check folder permissions.

1806 Response rule processing failed Response rule processing failed to start: {0}.
to start

1807 Response rule processing Response rule command runtime execution failed from error:
execution failed {0}.

1808 Unable to write incident Failed to delete old temporary file {0}.

1809 Unable to write incident Failed to rename temporary incident file {0}.

1810 Unable to list incidents Failed to list incident files in folder {0}. Check folder
permissions.

1811 Error sending incident Unexpected error occurred while sending an incident. {0}
Look in the incident writer log for more information.

1812 Incident writer stopped Failed to delete incident file {0} after it was sent. Delete the
file manually, correct the problem and restart the incident
writer.

1813 Failed to list incidents Failed to list incident files in folder {0}. Check folder
permissions.

1814 Incident queue backlogged There are {0} incidents in this server's queue.
 Managing system events and messages 172
System event codes and messages

Table 8-17 Incident persister and incident writer events (continued)

Code Summary Description

1815 Low disk space on incident server Hard disk space for the incident data storage server is low.
Disk usage is over {0}%.

1816 Failed to update policy statistics Failed to update policy statistics for policy {0}.

1817 Daily incident maximum The daily incident maximum for policy {0} has been
exceeded exceeded.\n No further incidents will be generated.

1818 Incident is oversized, has been Incident is oversized, has been partially persisted with
persisted with a limited number messageID {0}, Incident File Name {1}.
of components and/or violations

1821 Failure to process an incident Unexpected error occurred while sending an incident {0}
received from the cloud gateway

Table 8-18 Install or update events

Code Summary Description

1900 Failed to load update package Database connection error occurred while loading the
software update package {0}.

1901 Software update failed Failed to apply software update from package {0}. Check the
update service log.

Table 8-19 Key ignition password events

Code Summary Description

2000 Key ignition error Failed to ignite keys with the new ignition password. Detection
against Exact Data Profiles will be disabled.

2001 Unable to update key ignition The key ignition password won't be updated, because the
password. cryptographic keys aren't ignited. Exact Data Matching will
be disabled.

Table 8-20 Admin password reset event code

Code Summary Description

2099 Administrator password reset The Administrator password has been reset by the password
reset tool.
 Managing system events and messages 173
System event codes and messages

Table 8-21 Manager administrator and policy events

Code Summary Description

2100 Administrator saved The administrator settings were successfully saved.

2101 Data source removed The data source with ID {0} was removed by {1}.

2102 Data source saved The {0} data source was saved by {1}.

2103 Document source removed The document source with ID {0} was removed by {1}.

2104 Document source saved The {0} document source was saved by {1}.

2105 New protocol created The new protocol {0} was created by {1}.

2106 Protocol order changed The protocol {0} was moved {1} by {2}.

2107 Protocol removed The protocol {0} was removed by {1}.

2108 Protocol saved The protocol {0} was edited by {1}.

2109 User removed The user with ID {0} was removed by {1}.

2110 User saved The user {0} was saved by {1}.

2111 Runaway lookup detected One of the attribute lookup plug-ins did not complete
gracefully and left a running thread in the system. Manager
restart may be required for cleanup.

2112 Loaded Custom Attribute Lookup Plug-ins The following Custom Attribute
Lookup Plug-ins were loaded: {0}.

2113 No Custom Attribute Lookup No Custom Attribute Lookup Plug-in was found.
Plug-in was loaded

2114 Custom attribute lookup failed Lookup plug-in {0} timed out. It was unloaded.

2115 Custom attribute lookup failed Failed to instantiate lookup plug-in {0}. It was unloaded. Error
message: {1}

2116 Policy changed The {0} policy was changed by {1}.

2117 Policy removed The {0} policy was removed by {1}.

2118 Alert or scheduled report sending configured by {1} contains the following unreachable email
failed. {0} addresses: {2}. Either the addresses are bad or your email
server does not allow relay to those addresses.

2119 System settings changed The system settings were changed by {0}.
 Managing system events and messages 174
System event codes and messages

Table 8-21 Manager administrator and policy events (continued)

Code Summary Description

2120 Endpoint Location settings The endpoint location settings were changed by {0}.
changed

2121 The account ''{1}'' has been The maximum consecutive failed logon number of {0}
locked out attempts has been exceeded for account ''{1}'', consequently
it has been locked out.

2122 Loaded FlexResponse Actions The following FlexResponse Actions were loaded: {0}.

2123 No FlexResponse Action was No FlexResponse Action was found.

loaded.

2124 A runaway FlexResponse action One of the FlexResponse plug-ins did not complete gracefully
was detected. and left a running thread in the system. Manager restart may
be required for cleanup.

2125 Data Insight settings changed. The Data Insight settings were changed by {0}.

2126 Agent configuration created Agent configuration {0} was created by {1}.

2127 Agent configuration modified Agent configuration {0} was modified by {1}.

2128 Agent configuration removed Agent configuration {0} was removed by {1}.

2129 Agent configuration applied Agent configuration {0} was applied to endpoint server {1} by
{2}.

2130 Directory Connection source The directory connection source with ID {0} was removed by
removed {1}.

2131 Directory Connection source The {0} directory connection source was saved by {1}.
saved

2132 Agent Troubleshooting Task Agent Troubleshooting task of type {0} created by user {1}.

2133 Certificate authority file Certificate authority file {0} generated.

generated.

2134 Certificate authority file is corrupt. Certificate authority file {0} is corrupt.

2135 Password changed for certificate Password changed for certificate authority file {0}. New
authority file. certificate authority file is {1}.

2136 Server keystore generated. Server keystore {0} generated for endpoint server {1}.

2137 Server keystore is missing or Server keystore {0} for endpoint server {1} is missing or
corrupt. corrupt.
 Managing system events and messages 175
System event codes and messages

Table 8-21 Manager administrator and policy events (continued)

Code Summary Description

2138 Server truststore generated. Server truststore {0} generated for endpoint server {1}.

2139 Server truststore is missing or Server truststore {0} for endpoint server {1} is missing or
corrupt. corrupt.

2140 Client certificates and key Client certificates and key generated.
generated.

2141 Agent installer package Agent installer package generated for platforms {0}.
generated.

Table 8-22 Enforce licensing and key ignition events

Code Summary Description

2200 End User License Agreement The Symantec Data Loss Prevention End User License
accepted Agreement was accepted by {0}, {1}, {2}.

2201 License is invalid None

2202 License has expired One or more of your product licenses has expired. Some
system feature may be disabled. Check the status of your
licenses on the system settings page.

2203 License about to expire One or more of your product licenses will expire soon. Check
the status of your licenses on the system settings page.

2204 No license The license does not exist, is expired or invalid. No incidents
will be detected.

2205 Keys ignited The cryptographic keys were ignited by administrator logon.

2206 Key ignition failed Failed to ignite the cryptographic keys manually. Please look
in the Enforce Server logs for more information. It will be
impossible to create new exact data profiles.

2207 Auto key ignition The cryptographic keys were automatically ignited.

2208 Manual key ignition required The automatic ignition of the cryptographic keys is not
configured. Administrator logon is required to ignite the
cryptographic keys. No new exact data profiles can be created
until the administrator logs on.
 Managing system events and messages 176
System event codes and messages

Table 8-23 Manager major events

Code Summary Description

2300 Low disk space Hard disk space is low. Symantec Data Loss Prevention
Enforce Server disk usage is over {0}%.

2301 Tablespace is almost full Oracle tablespace {0} is over {1}% full.

2302 {0} not responding Detection Server {0} did not update its heartbeat for at least
20 minutes.

2303 Monitor configuration changed The {0} monitor configuration was changed by {1}.

2304 System update uploaded A system update was uploaded that affected the following
components: {0}.

2305 SMTP server is not reachable. SMTP server is not reachable. Cannot send out alerts or
schedule reports.

2306 Enforce Server started The Enforce Server was started.

2307 Enforce Server stopped The Enforce Server was stopped.

2308 Monitor status updater exception The monitor status updater encountered a general exception.
Please look at the Enforce Server logs for more information.

2309 System statistics update failed Unable to update the Enforce Server disk usage and database
usage statistics. Please look at the Enforce Server logs for
more information.

2310 Statistics aggregation failure The statistics summarization task encountered a general
exception. Refer to the Enforce Server logs for more
information.

2311 Version mismatch Enforce version is {0}, but this monitor's version is {1}.

2312 Incident deletion failed Incident Deletion failed .

2313 Incident deletion completed Incident deletion ran for {0} and deleted {1} incident(s).

2314 Endpoint data deletion failed Endpoint data deletion failed.

2315 Low disk space on incident server Hard disk space for the incident data storage server is low.
Disk usage is over {0}%.

2316 Over {0} incidents currently Persisting over {0} incidents can decrease database
contained in the database performance.
 Managing system events and messages 177
System event codes and messages

Table 8-24 Monitor version support events

Code Summary Description

2320 Version obsolete Detection server is not supported when two major versions
older than Enforce server version. Enforce version is {0}, and
this detection server's version is {1}. This detection server
must be upgraded.

2321 Version older than Enforce Enforce will not have visibility for this detection server and
version will not be able to send updates to it. Detection server
incidents will be received and processed normally. Enforce
version is {0}, and this detection server's version is {1}.

2322 Version older than Enforce Functionality introduced with recent versions of Enforce
version relevant to this type of detection server will not be supported
by this detection server. Enforce version is {0}, and this
detection server's version is {1}.

2323 Minor version older than Enforce Functionality introduced with recent versions of Enforce
minor version relevant to this type of detection server will not be supported
by this detection server and might be incompatible with this
detection server. Enforce version is {0}, and this detection
server's version is {1}. This detection server should be
upgraded.

2324 Version newer than Enforce Detection server is not supported when its version is newer
version than the Enforce server version. Enforce version is {0}, and
this detection server's version is {1}. Enforce must be
upgraded or detection server must be downgraded.

Table 8-25 Manager reporting events

Code Summary Description

2400 Export web archive finished Archive "{0}" for user {1} was created successfully.

2401 Export web archive canceled Archive "{0}" for user {1} was canceled.

2402 Export web archive failed Failed to create archive "{0}" for user {1}. The report specified
had over {2} incidents.

2403 Export web archive failed Failed to create archive "{0}" for user {1}. Failure occurred at
incident {2}.

2404 Unable to run scheduled report The scheduled report job {0} was invalid and has been
removed.
 Managing system events and messages 178
System event codes and messages

Table 8-25 Manager reporting events (continued)

Code Summary Description

2405 Unable to run scheduled report The scheduled report {0} owned by {1} encountered an error:
{2}.

2406 Report scheduling is disabled The scheduled report {0} owned by {1} cannot be run because
report scheduling is disabled.

2407 Report scheduling is disabled The scheduled report cannot be run because report
scheduling is disabled.

2408 Unable to run scheduled report Unable to connect to mail server when delivery scheduled
report {0}{1}.

2409 Unable to run scheduled report User {0} is no longer in role {1} which scheduled report {2}
belongs to. The schedule has been deleted.

2410 Unable to run scheduled report Unable to run scheduled report {0} for user {1} because the
account is currently locked.

2411 Scheduled report sent The schedule report {0} owned by {1} was successfully sent.

2412 Export XML report failed XML Export of report by user [{0}] failed XML Export of report
by user [{0}] failed.

2420 Unable to run scheduled data Unable to distribute report {0} (id={1}) by data owner because
owner report distribution sending of report data has been disabled.

2421 Report distribution by data owner Report distribution by data owner for report {0} (id={1}) failed.
failed

2422 Report distribution by data owner Report distribution by data owner for report {0} (id={1})
finished finished with {2} incidents for {3} data owners. {4} incidents
for {5} data owners failed to be exported.

2423 Report distribution to data owner The report distribution {1} (id={2}) for the data owner "{0}"
truncated exceeded the maximum allowed size. Only the first {3}
incidents were sent to "{0}".

Table 8-26 Messaging events

Code Summary Description

2500 Unexpected Error Processing {0} encountered an unexpected error processing a message.
Message See the log file for details.
 Managing system events and messages 179
System event codes and messages

Table 8-26 Messaging events (continued)

Code Summary Description

2501 Memory Throttler disabled {0} x {1} bytes need to be available for memory throttling.
Only {2} bytes were available. Memory Throttler has been
disabled.

Table 8-27 Detection server communication events

Code Summary Description

2600 Communication error Unexpected error occurred while sending {1} updates to {0}.
{2} Please look at the monitor controller logs for more
information.

2650 Communication error(VML) Unexpected error occurred while sending profile updates
config set {0} to {1} {2}. Please look at the monitor controller
logs for more information.

Table 8-28 Monitor controller events

Code Summary Description

2700 Monitor Controller started Monitor Controller service was started.

2701 Monitor Controller stopped Monitor Controller service was stopped.

2702 Update transferred to {0} Successfully transferred update package {1} to detection
server {0}.

2703 Update transfer complete Successfully transferred update package {0} to all detection
servers.

2704 Update of {0} failed Failed to transfer update package to detection server {0}.

2705 Configuration file delivery Successfully transferred config file {0} to detection server.
complete

2706 Log upload request sent. Successfully sent log upload request {0}.

2707 Unable to send log upload Encountered a recoverable error while attempting to deliver
request log upload request {0}.

2708 Unable to send log upload Encountered an unrecoverable error while attempting to
request deliver log upload request {0}.

2709 Using built-in certificate Using built-in certificate to secure the communication between
Enforce and Detection Servers.
 Managing system events and messages 180
System event codes and messages

Table 8-28 Monitor controller events (continued)

Code Summary Description

2710 Using user generated certificate Using user generated certificate to secure the communication
between Enforce and Detection Servers.

2711 Time mismatch between Enforce Time mismatch between Enforce and Monitor. It is
and Monitor. This may affect recommended to fix the time on the monitor through automatic
certain functionalities in the time synchronization.
system.

2712 Connected to cloud detector Connected to cloud detector.

2713 Cloud connector disconnected Error {0} - check your network settings.

Table 8-29 Packet capture events

Code Summary Description

2800 Bad spool directory configured Packet Capture has been configured with a spool directory:
for Packet Capture {0}. This directory does not have write privileges. Please
check the directory permissions and monitor configuration
file. Then restart the monitor.

2801 Failed to send list of NICs. {0} {0}.

Table 8-30 EDM index events and messages

Code Summary Description

2900 EDM profile search failed {0}.

2901 Keys are not ignited Exact Data Matching will be disabled until the cryptographic
keys are ignited.

2902 Index folder inaccessible Failed to list files in the index folder {0}. Check the
configuration and the folder permissions.

2903 Created index folder The local index folder {0} specified in the configuration had
not existed. It was created.

2904 Invalid index folder The index folder {0} specified in the configuration does not
exist.

2905 Exact data profile creation failed Data file for exact data profile "{0}" was not created. Please
look in the enforce server logs for more information.

2906 Indexing canceled Creation of database profile "{0}" was canceled.

 Managing system events and messages 181
System event codes and messages

Table 8-30 EDM index events and messages (continued)

Code Summary Description

2907 Replication canceled Canceled replication of database profile "{0}" version {1} to
server {2}.

2908 Replication failed Connection to database was lost while replicating database
profile {0} to server {1}.

2909 Replication failed Database error occurred while replicating database profile
{0} to server {1}.

2910 Failed to remove index file Failed to delete index file {1} of database profile {0}.

2911 Failed to remove index files Failed to delete index files {1} of database profile {0}.

2912 Failed to remove orphaned file Failed to remove orphaned database profile index file {0}.

2913 Replication failed Replication of database profile {0} to server {2} failed.{1}
Check the monitor controller log for more details.

2914 Replication completed Completed replication of database profile {0} to server {2}.
File {1} was transferred successfully.

2915 Replication completed Completed replication of database profile {0} to the server
{2}. Files {1} were transferred successfully.

2916 Database profile removed Database profile {0} was removed. File {1} was deleted
successfully.

2917 Database profile removed Database profile {0} was removed. Files {1} were deleted
successfully.

2918 Loaded database profile Loaded database profile {0} from {1}.

2919 Unloaded database profile Unloaded database profile {0}.

2920 Failed to load database profile {2} No incidents will be detected against database profile "{0}"
version {1}.

2921 Failed to unload database profile {2} It may not be possible to reload the database profile "{0}"
version {1} in the future without detection server restart.

2922 Couldn't find registered content Registered content with ID {0} wasn't found in database during
indexing.

2923 Database error Database error occurred during indexing. {0}

2924 Process shutdown during The process has been shutdown during indexing. Some
indexing registered content may have failed to create.
 Managing system events and messages 182
System event codes and messages

Table 8-30 EDM index events and messages (continued)

Code Summary Description

2925 Policy is inaccurate Policy "{0}" has one or more rules with unsatisfactory
detection accuracy against {1}.{2}

2926 Created exact data profile Created {0} from file "{1}".\nRows processed: {2}\nInvalid
rows: {3}\nThe exact data profile will now be replicated to all
Symantec Data Loss Prevention Servers.

2927 User Group "{0}" synchronization The following User Group directories have been
failed removed/renamed in the Directory Server and could not be
synchronized: {1}.Please update the "{2}" User Group page
to reflect such changes.

2928 One or more EDM profiles are out Check the "Manage > Data Profiles > Exact Data" page for
of date and must be reindexed more details. The following EDM profiles are out of date: {0}.

Table 8-31 IDM index events and messages

Code Summary Description

3000 {0} {1} Document profile wasn't created.

3001 Indexing canceled Creation of document profile "{0}" was canceled.

3002 Replication canceled Canceled replication of document profile "{0}" version {1} to
server {2}.

3003 Replication failed Connection to database was lost while replicating document
profile "{0}" version {1} to server {2}.

3004 Replication failed Database error occurred while replicating document profile
"{0}" version {1} to server {2}.

3005 Failed to remove index file Failed to delete index file {2} of document profile "{0}" version
{1}.

3006 Failed to remove index files Failed to delete index files {2} of document profile "{0}" version
{1}.

3007 Failed to remove orphaned file {0}

3008 Replication failed Replication of document profile "{0}" version {1} to server {3}
failed. {2}\nCheck the monitor controller log for more details.

3009 Replication completed Completed replication of document profile "{0}" version {1}
to server {3}. File {2} was transferred successfully.
 Managing system events and messages 183
System event codes and messages

Table 8-31 IDM index events and messages (continued)

Code Summary Description

3010 Replication completed Completed replication of document profile "{0}" version {1}
to server {3}.\nFiles {2} were transferred successfully.

3011 Document profile removed Document profile "{0}" version {1} was removed. File {2} was
deleted successfully.

3012 Document profile removed Document profile "{0}" version {1} was removed. Files {2}
were deleted successfully.

3013 Loaded document profile Loaded document profile "{0}" version {1} from {2}.

3014 Unloaded document profile Unloaded document profile "{0}" version {1}.

3015 Failed to load document profile {2}No incidents will be detected against document profile "{0}"
version {1}.

3016 Failed to unload document profile {2} It may not be possible to reload the document profile "{0}"
version {1} in the future without monitor restart.

3017 Created document profile Created "{0}" from "{1}". There are {2} accessible files in the
content root. {3} The profile contains index for {4}
document(s). {5} The document profile will now be replicated
to all Symantec Data Loss Prevention Servers.

3018 Document profile {0} has reached maximum size. Only {1} out of {2} documents
are indexed.

3019 Nothing to index Document source "{0}" found no files to index.

3020 Created document profile Created "{0}" from "{1}". There are {2} accessible files in the
content root. {3} The profile contains index for {4}
document(s). Comparing to last indexing run: {5} new
document(s) were added, {6} document(s) were updated, {7}
documents were unchanged, and {8} documents were
removed. The document profile will now be replicated to all
Symantec Data Loss Prevention servers.

3021 Nothing to index The new remote IDM profile for source "{0}" was identical to
the previous imported version.

3022 Profile conversion IDM profile {0} has been converted to {1} on the endpoint.

3023 Endpoint IDM profiles memory IDM profile {0} size plus already deployed profiles size are
usage too large to fit on the endpoint, only exact matching will be
available.
 Managing system events and messages 184
System event codes and messages

Table 8-32 Attribute lookup events

Code Summary Description

3100 Invalid Attributes detected with Invalid or unsafe Attributes passed from Standard In were
Script Lookup Plugin removed during script execution. Please check the logs for
more details.

3101 Invalid Attributes detected with Invalid or unsafe Attributes passed to Standard Out were
Script Lookup Plugin removed during script execution. Please check the logs for
more details.

Table 8-33 Monitor stub events

Code Summary Description

3200 AggregatorStub started None

3201 {0} updated List of updates:{1}.

3202 {0} store intialized Initial items:{1}.

3203 Received {0} Size: {1} bytes.

3204 FileReaderStub started None

3205 IncidentWriterStub started Using test incidents folder {0}.

3206 Received configuration for {0} {1}.

3207 PacketCaptureStub started None

3208 RequestProcessorStub started None

3209 Received advanced settings None

3210 Updated settings Updated settings:{0}.

3211 Loaded advanced settings None

3212 UpdateServiceStub started None

3213 DetectionServerDatabaseStub None

started

Table 8-34 Packet capture events

Code Summary Description

3300 Packet Capture started Packet Capture has successfully started.

 Managing system events and messages 185
System event codes and messages

Table 8-34 Packet capture events (continued)

Code Summary Description

3301 Capture failed to start on device Device {0} is configured for capture, but could not be
{0} initialized. Please see PacketCapture.log for more information.

3302 PacketCapture could not elevate PacketCapture could not elevate its privileges. Some
its privilege level initialization tasks are likely to fail. Please check ownership
and permissions of the PacketCapture executable.

3303 PacketCapture failed to drop its Root privileges are still attainable after attempting to drop
privilege level them. PacketCapture will not continue

3304 Packet Capture started again as Packet capture started processing again because some disk
more disk space is available space was freed on the monitor hard drives.

3305 Packet Capture stopped due to Packet capture stopped processing packets because there
disk space limit is too little space on the monitor hard drives.

3306 Endace DAG driver is not Packet Capture was unable to activate Endace device
available support. Please see PacketCapture.log for more information.

3307 PF_RING driver is not available Packet Capture was unable to activate devices using the
PF_RING interface. Please check PacketCapture.log and
your system logs for more information.

3308 PACKET_MMAP driver is not Packet Capture was unable to activate devices using the
available PACKET_MMAP interface. Please check PacketCapture.log
and your system logs for more information.

3309 {0} is not available Packet Capture was unable to load {0} . No native capture
interface is available. Please see PacketCapture.log for more
information.

3310 No {0} Traffic Captured {0} traffic has not been captured in the last {1} seconds.
Please check Protocol filters and the traffic sent to the
monitoring NIC.

3311 Could not create directory Could not create directory {0} : {1}.

Table 8-35 Log collection events

Code Summary Description

3400 Couldn't add files to zip The files requested for collection could not be written to an
archive file.

3401 Couldn't send log collection The files requested for collection could not be sent.
 Managing system events and messages 186
System event codes and messages

Table 8-35 Log collection events (continued)

Code Summary Description

3402 Couldn't read logging properties A properties file could not be read. Logging configuration
changes were not applied.

3403 Couldn't unzip log configuration The zip file containing logging configuration changes could
package not be unpacked. Configuration changes will not be applied.

3404 Couldn't find files to collect There were no files found for the last log collection request
sent to server.

3405 File creation failed Could not create file to collect endpoint logs.

3406 Disk usage exceeded File creation failed due to insufficient disk space.

3407 Max open file limit exceeded File creation failed as max allowed number of files are already
open.

Table 8-36 Enforce SPC events

Code Summary Description

3500 SPC Server successfully SPC Server successfully registered. Product Instance Id [{0}].
registered.

3501 SPC Server successfully SPC Server successfully unregistered. Product Instance Id
unregistered. [{0}].

3502 A self-signed certificate was A self-signed certificate was generated. Certificate alias [{0}].
generated.

Table 8-37 Enforce user data sources events

Code Summary Description

3600 User import completed User import from source {0} completed successfully.
successfully.

3601 User import failed. User import from data source {0} has failed.

3602 Updated user data linked to Updated user data linked to {0} existing incident events.
incidents.

Table 8-38 Catalog item distribution related events

Code Summary Description

3700 Unable to write catalog item Failed to delete old temporary file {0}.
 Managing system events and messages 187
System event codes and messages

Table 8-38 Catalog item distribution related events (continued)

Code Summary Description

3701 Unable to rename catalog item Failed to rename temporary catalog item file {0}.

3702 Unable to list catalog items Failed to list catalog item files in folder {0}.Check folder
permissions.

3703 Error sending catalog items Unexpected error occurred while sending an catalog
item.{0}Look in the file reader log for more information.

3704 File Reader failed to delete files. Failed to delete catalog file {0} after it was sent.\nDelete the
file manually, correct the problem and restart the File Reader.

3705 Failed to list catalog item files Failed to list catalog item files in folder {0}.Check folder
permissions.

3706 The configuration is not valid. The property {0} was configured with invalid value {1}. Please
make sure that this has correct value provided.

3707 Scan failed: Remediation Remediation detection catalog update timed out after {0}
detection catalog could not be seconds for target {1}.
updated

Table 8-39 Detection server database events

Code Summary Description

3800 DetectionServerDatabase started None

3801 DetectionServerDatabase failed Error starting DetectionServerDatabase. Reason: {0}.

to start

3802 Invalid Port for Could not retrieve the port for DetectionServerDatabase
DetectionServerDatabase process to listen to connection. Reason: {0}. Check if the
property file setting has the valid port number.

Table 8-40 Telemetry event code

Code Summary Description

3803 Telemetry transmission failed. Telemetry transmission failed. Transmission status : {0}
 Managing system events and messages 188
System event codes and messages

Table 8-41 Endpoint communication layer events

Code Summary Description

3900 Internal communications error. Internal communications error. Please see {0} for errors.
Search for the string {1}.

3901 System events have been System event throttle limit exceeded. {0} events have been
suppressed. suppressed. Internal error code = {1}.

Table 8-42 Agent communication event code

Code Summary Description

4000 Agent Handshaker error Agent Handshaker error. Please see {0} for errors. Search
for the string {1}.

Table 8-43 Monitor controller replication communication layer application error events

Code Summary Description

4050 Agent data batch persist error Unexpected error occurred while agent data being persisted
: {0}. Please look at the monitor controller logs for more
information.

4051 Agent status attribute batch Status attribute data for {0} agent(s) could not be persisted.
persist error Please look at the monitor controller logs for more information.

4052 Agent event batch persist Event data for {0} agent(s) could not be persisted. Please
look at the monitor controller logs for more information.

Table 8-44 Enforce Server web services event code

Code Summary Description

4101 Response Rule Execution Request fetch failed even after {0} retries. Database
Service Database failure on connection still down. The service will be stopped.
request fetch

Table 8-45 Cloud service enrollment events

Code Summary Description

4200 Cloud Service enrollment: Cloud Service enrollment: successfully received client
successfully received client certificate from Symantec Managed PKI Service.
certificate from Symantec
Managed PKI Service
 Managing system events and messages 189
System event codes and messages

Table 8-45 Cloud service enrollment events (continued)

Code Summary Description

4201 Cloud Service enrollment: error ERROR {0}.

requesting client certificate from
Symantec Managed PKI Service

4205 Symantec Managed PKI Symantec Managed PKI certificate expires in {0} days.
certificate expires in {0} days

4206 Symantec Managed PKI Service Symantec Managed PKI Service certificate has expired.
certificate has expired

4210 Cloud Service enrollment bundle Invalid enrollment file content.

error

4211 Cloud Service enrollment bundle Enrollment file missing from ZIP bundle.
error

4212 Invalid Cloud Detector enrollment Detector info doesn't match the existing configuration.
bundle

Table 8-46 Cloud detector event code

Code Summary Description

4300 Cloud Detector created in Cloud detector {0} created in Enforce.

Enforce

Table 8-47 User Groups profile event code

Code Summary Description

4400 One or more User Group profiles Check the "Manage > Policies > User Groups" page for
are out of date and must be more details. The following User Group profiles are out of
reindexed. date: {0}.

Table 8-48 Cloud operations event code

Code Summary Description

4701 Cloud operations events or Cloud operations issued an event or notification about the
notifications cloud service.
 Chapter 9
Managing the Symantec
Data Loss Prevention
database
This chapter includes the following topics:

■ Working with Symantec Data Loss Prevention database diagnostic tools

■ Viewing tablespaces and data file allocations

■ Viewing table details

■ Checking the database update readiness

Working with Symantec Data Loss Prevention

database diagnostic tools
The Enforce Server administration console lets you view diagnostic information about the
tablespaces and tables in your database to help you better manage your database resources.
You can see how full your tablespaces and tables are, and whether or not the files in the tables
are automatically extensible to accommodate more data. This information can help you manage
your database by understanding where you may want to enable the Oracle Autoextend feature
on data files, or otherwise manage your database resources. You can also generate a detailed
database report to share with Symantec Technical Support for help with troubleshooting
database issues.
You can view the allocation of tablespaces, including the size, memory usage, extensibility,
status, and number of files in each tablespace. You can also view the name, size, and
Autoextend setting for each file in a tablespace. In addition, you can view table-level allocations
for incident data tables, other tables, indexes, and locator object (LOB) tables.
 Managing the Symantec Data Loss Prevention database 191
Viewing tablespaces and data file allocations

You can generate a full database report in HTML format to share with Symantec Technical
Support at any time by clicking Get full report. The data in the report can help Symantec
Technical Support troubleshoot issues in your database.
See “Generating a database report” on page 192.

Viewing tablespaces and data file allocations

You can view tablespaces and data file allocations on the Database Tablespaces Summary
page (System > Database > Tablespaces Summary).
The Database Tablespaces Summary page displays the following information:
■ Name: The name of the tablespace.
■ Size: The size of the tablespace in megabytes.
■ Used (%): The percentage of the tablespace currently in use.
■ Used (MB): The amount of the tablespace currently in use, in megabytes.
■ Extendable To (MB): The size to which the tablespace can be extended. This value is
based on the Autoextend settings of the files within the tablespace.
■ Status: The current status of the tablespace according to the percentage of the tablespace
currently in use, depending on the warning thresholds. If you are using the default warning
threshold settings, the status is:
■ OK: The tablespace is under 80% full, or the tablespace can be automatically extended.
■ Warning: The tablespace is between 80% and 90% full. If you see a warning on a
tablespace, you may consider enabling Autoextend on the data files in the tablespace
or extending the maximum value for data file auto-extensibility.
■ Severe: The tablespace is more than 90% full. If you see a severe warning on a
tablespace, you should enable Autoextend on the data files in the tablespace, extend
the maximum value for data file auto-extensibility, or determine whether you can purge
some of the data in the tablespace.

■ Number of Files: The number of data files in the tablespace.

Select a tablespace from the list to view details about the files it contains. The tablespace file
view displays the following information:
■ Name: The name of the file.
■ Size: The size of the file, in megabytes.
■ Auto Extendable: Specifies if the file is automatically extensible based on the Autoextend
setting of the file in the Oracle database.
 Managing the Symantec Data Loss Prevention database 192
Viewing tablespaces and data file allocations

■ Extendable To (MB): The maximum size to which the file can be automatically extended,
in megabytes.
■ Path: The path to the file.

Adjusting warning thresholds for tablespace usage in large databases

If your database contains a very large amount of data (1 terabyte or more), you may want to
adjust the warning thresholds for tablespace usage. For such large databases, Symantec
recommends adjusting the Warning threshold to 85% full, and the Severe threshold to 95%
full. You may want to set these thresholds even higher for larger databases. You can specify
these values in the /SymantecDLP/protect/config/Manager.properties file.
To adjust the tablespace usage warning thresholds
1 Open the Manager.properties file in a text editor.
2 Set the Warning and Severe thresholds to the following values:

com.vontu.manager.tablespaceThreshold.warning=85
com.vontu.manager.tablespaceThreshold.severe=95

3 Save the changes to the Manager.properties file and close it.

4 Restart the Vontu Manager service to apply your changes.

Generating a database report

You can generate a full database report in HTML format at any time by clicking Get full report
on the Database Tablespaces Summary page. The database report includes the following
information:
■ Detailed database information
■ Incident data distribution
■ Message data distribution
■ Policy group information
■ Policy information
■ Endpoint agent information
■ Detection server (monitor) information
Symantec Technical Support may request this report to help troubleshoot database issues.
 Managing the Symantec Data Loss Prevention database 193
Viewing table details

To generate a database report

1 Navigate to System > Database > Tablespaces Summary.
2 Click Get full report.
3 The report takes several minutes to generate. Refresh your screen after several minutes
to view the link to the report.
4 To open or save the report, click the link above the Tablespaces Allocation table. The
link includes the timestamp of the report for your convenience.
5 In the Open File dialog box, chose whether to open the file or save it.
6 To view the report, open it in a web browser or text editor.
7 To update the report, click Update full report.

Viewing table details

You can view table-level allocations on the Database Table Details page (System > Database
> Table Details). Viewing table-level allocations can be useful after a large data purge to see
the de-allocation of space within your database segments. You can refresh the information
displayed on this page by clicking Update table data at any time.
The Database Table Details page displays your table-level allocations on one of four tabs:
■ Incident Tables: This tab lists all the incident data tables in the Symantec Data Loss
Prevention database schema. The tab displays the following information:
■ Table Name: The name of the table.
■ In Tablespace: The name of the tablespace that contains the table.
■ Size (MB): The size of the table, in megabytes.
■ % Full: The percentage of the table currently in use.

■ Other Tables: This tab lists all other tables in the schema. The tab displays the following
information:
■ Table Name: The name of the table.
■ In Tablespace: The name of the tablespace that contains the table.
■ Size (MB): The size of the table, in megabytes.
■ % Full: The percentage of the table currently in use.

■ Indices: This table lists all of the indexes in the schema. The tab displays the following
information:
■ Index Name: The name of the index.
 Managing the Symantec Data Loss Prevention database 194
Checking the database update readiness

■ Table Name: The name of the table that contains the index.
■ In Tablespace: The name of the tablespace that contains the table.
■ Size (MB): The size of the table, in megabytes.
■ % Full: The percentage of the table currently in use.

■ LOB Segments: This table lists all of the locator object (LOB) tables in the schema. The
tab displays the following information:
■ Table Name: The name of the table.
■ Column Name: The name of the table column containing the LOB data.
■ In Tablespace: The name of the tablespace that contains the table.
■ LOB Segment Size (MB): The size of the LOB segment, in megabytes.
■ LOB Index Size: The size of the LOB index, in megabytes.
■ % Full: The percentage of the table currently in use.

Note: The percentage used value for each table displays the percentage of the table currently
in use as reported by the Oracle database in dark blue. It also includes an additional estimated
percentage used range in light blue. Symantec Data Loss Prevention calculates this range
based on tablespace utilization.

Checking the database update readiness

You use the Update Readiness tool to confirm that the Oracle database is ready to upgrade
to the next Symantec Data Loss Prevention version.
The Update Readiness tool tests the following items in the database schema:
■ Oracle version
■ Oracle patches
■ Permissions
■ Tablespaces
■ Existing schema against standard schema
■ Real Application Clusters
■ Change Data Capture
■ Virtual columns
■ Partitioned tables
 Managing the Symantec Data Loss Prevention database 195
Checking the database update readiness

■ Numeric overflow
■ Temp Oracle space
Table 9-1 lists tasks you complete to run the tool.

Table 9-1 Using the Update Readiness tool

Step Task Details

1 Locate the latest version of the tool. See “Locating the Update Readiness tool” on page 195.

2 Create the Update Readiness tool See “Creating the Update Readiness tool database
database account. account” on page 195.

3 Run the tool. See “Running the Update Readiness tool for Symantec
Data Loss Prevention version 14.x” on page 196.

4 Review the update readiness results. See “Reviewing update readiness results” on page 197.

Locating the Update Readiness tool

You can obtain the latest version of the tool (for both major or minor release versions of
Symantec Data Loss Prevention) on FileConnect. Go to https://fileconnect.symantec.com/ to
download the tool. Symantec recommends that you download the tool to the
DLPDownloadHome\DLP\15.0\ directory.

The tool file name is Symantec_DLP_15.0_Update_Readiness_Tool.zip. The tool version

changes when updated tools are released.

Note: Review the Readme file packaged with the tool for a list of Symantec Data Loss Prevention
versions the tool is capable of testing.

See “Checking the database update readiness” on page 194.

Creating the Update Readiness tool database account

Before you can run the Update Readiness tool, you must create a database account.
To create the new Update Readiness tool database account
1 Navigate to the /script folder where you extracted the Update Readiness tool.
2 Start SQL*Plus:

sqlplus /nolog
 Managing the Symantec Data Loss Prevention database 196
Checking the database update readiness

3 Run the oracle_create_user.sql script:

SQL> @oracle_create_user.sql

4 At the Please enter the password for sys user prompt, enter the password for the SYS
user.
5 At the Please enter sid prompt, enter a user name.
6 At the Please enter required username to be created prompt, enter a name for the new
upgrade readiness database account.
7 At the Please enter a password for the new username prompt, enter a password for
the new upgrade readiness database account.
Use the following guidelines to create an acceptable password:
■ Passwords cannot contain more than 30 characters.
■ Passwords cannot contain double quotation marks, commas, or backslashes.
■ Avoid using the & character.
■ Passwords are case-sensitive by default. You can change the case sensitivity through
an Oracle configuration setting.
■ If your password uses special characters other than _, #, or $, or if your password
begins with a number, you must enclose the password in double quotes when you
configure it.
Store the user name and password in a secure location for future use. You use this user
name and password to run the Update Readiness tool.
8 As the database sysdba user, grant permission to the "protect" user for the following
database objects:

sqlplus sys/protect as sysdba

GRANT READ,WRITE ON directory DATA_PUMP_DIR TO protect;
GRANT SELECT ON dba_registry_history TO protect;
GRANT SELECT ON dba_temp_free_space TO protect;

See “Locating the Update Readiness tool” on page 195.

See “Checking the database update readiness” on page 194.

Running the Update Readiness tool for Symantec Data Loss

Prevention version 14.x
After you locate the update readiness tool, you run it from the command prompt.
 Managing the Symantec Data Loss Prevention database 197
Checking the database update readiness

To run the Update Readiness tool

1 From a command window, go to the directory where you extracted the Update Readiness
tool.
2 Run the Update Readiness tool using the following command:

java UpdateReadinessTool
--username <username>
--password <password>
--sid <database_system_id>
--readiness_username <readiness_username>
--readiness_password <readiness_password>
[--quick]

The following table identifies the commands:

<username> The protect database user name.

<password> The protect database password.

<database_system_id> The database system ID (SID).

<readiness_username> The Update Readiness tool database account user you created.

See “Creating the Update Readiness tool database account”

on page 195.

<readiness_password> The password for the Update Readiness tool database account
user.

[--quick] The optional command only runs the database object check and
skips the update readiness test.

After the test completes, you can locate the results in a log file in the /output directory.
This directory is located where you extracted the Update Readiness tool. If you do not
include [--quick] when you run the tool, the test may take up to an hour to complete.
You can verify the status of the test by reviewing log files in the /output directory.
See “Locating the Update Readiness tool” on page 195.
See “Reviewing update readiness results” on page 197.

Reviewing update readiness results

After you run the Update Readiness tool, the tool returns test results in a log file. Table 9-2
lists the results summarized in the log file.
 Managing the Symantec Data Loss Prevention database 198
Checking the database update readiness

Table 9-2 Update Readiness results

Status Description

Pass Items that display under this section are confirmed and ready for update.

Warning If not fixed, items that display under this section may prevent the database from
upgrading properly.

Error These items prevent the upgrade from completing and must be fixed.

See “Checking the database update readiness” on page 194.

 Chapter 10
Working with Symantec
Information Centric
Encryption
This chapter includes the following topics:

■ About Symantec Information Centric Encryption

■ About the Symantec ICE Utility

■ Overview of implementing Information Centric Encryption capabilities

■ Configuring the Enforce Server to connect to the Symantec ICE Cloud

About Symantec Information Centric Encryption

Symantec Information Centric Encryption (ICE) is a risk-reduction solution that lets your
employees, partners, and trusted individuals securely share company files and documents.
Symantec ICE can help you to detect confidential files and encrypt them so that only the users
that you authorize can access them.
Typical encryption technologies may allow data loss after files are decrypted. Once the files
are decrypted, they can be sent to other individuals and are no longer protected. However,
ICE encryption technology encrypts and protects files throughout the life of a file, regardless
of where the file travels.
When a file is determined to be confidential or critical, ICE automatically encrypts it in place
by using the ICE library and encryption services. Once it is encrypted, only the users that you
authorize can read it.
ICE also includes the Information Centric Encryption Cloud Console, which provides you with
visibility into the use of ICE-encrypted files. You can monitor who has accessed those files,
 Working with Symantec Information Centric Encryption 200
About Symantec Information Centric Encryption

from where those files are accessed, and how those files are used. You can also use the ICE
Cloud Console to set specific group permissions. You can set permissions for the saving,
sharing, and editing of files for user groups. You can also revoke access to individual files or
rights to access files for specific user groups.
When ICE is combined with the power of Symantec Data Loss Prevention 15 or Symantec
CloudSOC (a separate ICE license is required), you can scan for and encrypt confidential and
sensitive files that are stored in:
■ Enterprise file shares
Symantec Data Loss Prevention Network Discover has the built-in ability to apply Information
Centric Encryption to sensitive files that are stored in:
■ File System server locations. Configure a response rule to use the Network Protect:
Encrypt File action.
■ Microsoft SharePoint. Configure a DLP response rule to use the SharePoint Encrypt
Server FlexResponse action. The encryption functionality is enabled using a Server
FlexResponse plug-in that is deployed automatically when you install Symantec Data
Loss Prevention 15. No additional customization or configuration is required to deploy
this Server FlexResponse plug-in.

■ Removable drives
Use built-in ICE capabilities to encrypt sensitive files that are copied or transferred to USB
removable storage devices such as external hard drives and USB sticks.
DLP Agents have the built-in ability to apply ICE to encrypt sensitive files that are copied
to USB removable storage devices. Use the Prevent: Encrypt action in your response rule.
Manage your ICE environment by deploying an ICE utility for decryption; the ICE utility is
available at FileConnect with your Data Loss Prevention downloadable components.
■ Cloud file storage
ICE supports content inspection of your enterprise Box or OneDrive environments. When
users in your organization send files to your enterprise's Box service, Symantec CloudSOC
uses the CloudSOC Gatelet to scan them in real time. Symantec CloudSOC uses the
CloudSOC Securlet to periodically scan the files that are already present on your enterprise's
Microsoft OneDrive accounts.
Use either the Symantec Data Loss Prevention Enforce Server administration console or
the Symantec CloudSOC console to define your policies for identifying confidential files.
You can use ICE with just Symantec CloudSOC. However, using Symantec Data Loss
Prevention also lets you leverage robust policy authoring and remediation capabilities.
 Working with Symantec Information Centric Encryption 201
About the Symantec ICE Utility

For further information

About the Symantec ICE Utility

The Symantec ICE Utility allows an authorized user to decrypt a file that has been encrypted
by ICE. If a user attempts to access a file that ICE protects, the ICE Utility prompts the user
for authentication. If the user is authenticated, the ICE Utility decrypts the file. The ICE Utility
also applies any permission sets assigned to the user in the ICE Cloud Console. For example,
if you have disabled printing for the user or the user group, the user is not able to print the
document.

Note: On mobile devices, the ICE Utility is called ICE Workspace. You can get ICE Workspace
with the VIP Access for Mobile app.

The ICE Utility is context aware, meaning that it recognizes a user's environment. The ICE
Utility can be deployed in two types of environments: managed environments and unmanaged
environments.
■ In managed environments, your organization provides and maintains the devices on which
users access protected files.
In managed environments, the ICE Utility leverages the policies and security controls that
your organization puts in place over user devices. In this environment, the ICE Utility gives
the user greater flexibility with decrypting and working with protected files. Files open in
their native app, and the user has full access to the file to edit, share, save, save as, and
print the file. Users are required to authenticate at least once every 180 days.
The managed version of the ICE Utility works the same across Windows and macOS
platforms.
■ If you use the ICE Utility with Data Loss Prevention, and you want to use it with Network
Discover and Endpoint Prevent, download it from FileConnect with your other Data
Loss Prevention components.
■ If you use the ICE Utility with CloudSOC only, or with Data Loss Prevention for cloud
storage content protection only, download it from the Information Centric Encryption
Cloud Console. Download the managed version of the ICE Utility from the Settings >
Downloads page of the ICE Cloud Console.

■ In unmanaged environments, such as those of your partners or in which employees bring

their own devices, users' devices are outside your direct control.
Since you have no direct control over the security of the users' devices in unmanaged
environments, the ICE Utility provides additional security. The ICE Utility enforces stricter
restrictions over when and how a file is decrypted, and allows you greater content control
through the use of permission sets.
 Working with Symantec Information Centric Encryption 202
Overview of implementing Information Centric Encryption capabilities

When users attempt to open a protected file on a device without the ICE Utility, they are
prompted to download the ICE Utility. They can download the ICE Utility directly from
Symantec at https://sice.enc.protect.symantec.com/auth/client/download.html.
Users are required to authenticate the first time they attempt to access an encrypted file
every 24 hours.
■ On Windows, supported file types are opened in their native app, but the permissions
that you assigned to the user are enforced. So, if you have restricted printing for the
user or the user group, the user is unable to print the file.
Files that ICE does not support open in their native app, but ICE does not enforce
permissions.
■ On macOS, supported file types are opened in their native app, if the edit permission
is enabled on the Information Centric Encryption Cloud Console. However, if the
permissions include content lock or print restrictions, such files open in the Mac
Preview application in view-only mode. For Office formats, ICE-encrypted files launch
the Microsoft Office application. If the user does not have Microsoft Office installed,
then Word documents open in Mac TextEdit, and Excel and PowerPoint files open in
Mac Preview.
On iOS, supported file types are opened in a view-only mode irrespective of the
permissions that are assigned to the user.

In all environments, when the user finishes with the file, the ICE Utility encrypts it again,
maintaining the file's security throughout its lifetime.

Note: If a user is allowed to save the file with a new name, the new file is not encrypted.

Overview of implementing Information Centric

Encryption capabilities
The high-level steps for implementing Information Centric Encryption with Symantec Data
Loss Prevention are provided in Table 10-1. Specific task steps are provided in the topics
referenced in the "Details" column.
For more information about Information Centric Encryption, refer to the Symantec Information
Centric Encryption Deployment Guide at http://www.symantec.com/docs/DOC9707.
 Working with Symantec Information Centric Encryption 203
Overview of implementing Information Centric Encryption capabilities

Table 10-1 Overview of implementing Information Centric Encryption capabilities

Step Action Details

1 Depending on your See “Installing a new license file” on page 206.

organization's security
needs, install one or both
of the following licenses:

■ Network Protect ICE

■ Endpoint Prevent ICE

2 Configure the Enforce See “Configuring the Enforce Server to connect to the
Server to connect to the Symantec ICE Cloud” on page 204.
Symantec ICE Cloud.

3 Configure policy response See “Configuring the Endpoint Prevent: Encrypt action”
rule actions to protect on page 1275.
sensitive files using ICE
See “Configuring the Network Protect: Encrypt File action”
encryption.
on page 1292.

See “Configuring the Server FlexResponse action” on page 1245.

4 Configure Network Protect See “Configuring Network Protect for file shares” on page 1619.
to enable ICE encryption
protection for supported
scan targets.

5 Configure DLP Agents to See “Information Centric Encryption settings for DLP Agents”
enable them to encrypt on page 1804.
sensitive files on
endpoints, or on removable
devices that are connected
to endpoints.
 Working with Symantec Information Centric Encryption 204
Configuring the Enforce Server to connect to the Symantec ICE Cloud

Table 10-1 Overview of implementing Information Centric Encryption capabilities

(continued)

Step Action Details

6 Download and then install The ICE Utility is available for download from Symantec
the ICE Utility on all FileConnect.
managed devices within
See “About the Symantec ICE Utility” on page 201.
your organization. The ICE
Utility is required for users
to be able to access
ICE-encrypted files.

Unmanaged device users

will be prompted to
download and install the
ICE Utility when they
attempt to access an
ICE-encrypted file for the
first time on a particular
device.

Configuring the Enforce Server to connect to the

Symantec ICE Cloud
After you install the Endpoint Prevent ICE license or the Network Protect ICE license, you
must configure the Enforce Server to connect to the Symantec ICE Cloud. This step is a
prerequisite for enabling any of the encryption-related functions that you can configure using
the Enforce Server configuration console.
To configure the Enforce Server to connect to the Symantec ICE Cloud:
1 Go to System > Settings > General and click Configure.
2 At the Edit General Settings screen, scroll down to the Symantec ICE Cloud Access
Settings section.
3 Type the following Symantec ICE Cloud details in the provided fields:
■ Customer ID
■ Domain ID
■ Service URL
■ Service User ID
■ Service Password
 Working with Symantec Information Centric Encryption 205
Configuring the Enforce Server to connect to the Symantec ICE Cloud

Note: Obtain this information from the Settings > Advanced Configuration > External
Services page of the ICE Cloud Console. Note that the Service Password is only visible
when you first authorize an external service. If you have lost your Service Password, the
only way to see your Service Password is to obtain a new one.

4 Click Save.
See “Installing a new license file” on page 206.
 Chapter 11
Adding a new product
module
This chapter includes the following topics:

■ Installing a new license file

■ About system upgrades

Installing a new license file

When you first purchase Symantec Data Loss Prevention, upgrade to a later version, or
purchase additional product modules, you must install one or more Symantec Data Loss
Prevention license files. License files have names in the format name.slf.
You can also enter a license file for one module to start and, later on, enter license files for
additional modules.
For detailed information about installing the license file for your initial purchase of Symantec
Data Loss Prevention, see the Symantec Data Loss Prevention Installation Guide for your
operating system.
To install a license:
1 Download the new license file.
For information on downloading and extracting a license file, see the document Acquiring
Symantec Data Loss Prevention Software, available at the Symantec FileConnect site.
2 Go to System > Settings > General and click Configure.
3 At the Edit General Settings screen, scroll down to the License section.
 Adding a new product module 207
About system upgrades

4 In the Install License field, browse for the new Symantec Data Loss Prevention license
file you downloaded, then click Save to agree to the terms and conditions of the end user
license agreement (EULA) for the software and to install the license.

Note: If you do not agree to the terms and conditions of the EULA, you cannot install the
software.

5 To enable full functionality of new product license-related features, restart the Vontu
Manager Service.
See “About Symantec Data Loss Prevention services” on page 85.
The Current License list displays the following information for each product license:
■ Product – The individual Symantec Data Loss Prevention product name
■ Count – The number of users licensed to use the product
■ Status – The current state of the product
■ Expiration – The expiration date of license for the product
A month before Expiration of the license, warning messages appear on the System > Servers
> Overview screen. When you see a message about the expiration of your license, contact
Symantec to purchase a new license key before the current license expires.

About system upgrades

The System Upgrade button on the Overview screen initiates the loading and upgrading of
your system to a newer version of Symantec Data Loss Prevention.
For information about upgrading the Symantec Data Loss Prevention software, see the
Symantec Data Loss Prevention Upgrade Guide.
See “About Symantec Data Loss Prevention administration” on page 65.
 Section 3
Managing detection servers

■ Chapter 12. Installing and managing detection servers and cloud detectors

■ Chapter 13. Managing log files

■ Chapter 14. Using Symantec Data Loss Prevention utilities

 Chapter 12
Installing and managing
detection servers and cloud
detectors
This chapter includes the following topics:

■ About managing Symantec Data Loss Prevention servers

■ Enabling Advanced Process Control

■ Server controls

■ Server configuration—basic

■ Editing a detector

■ Server and detector configuration—advanced

■ Adding a detection server

■ Adding a cloud detector

■ Removing a server

■ Importing SSL certificates to Enforce or Discover servers

■ About the Overview screen

■ Configuring the Enforce Server to use a proxy to connect to cloud services

■ Server and detector status overview

■ Recent error and warning events list

■ Server/Detector Detail screen

 Installing and managing detection servers and cloud detectors 210
About managing Symantec Data Loss Prevention servers

■ Advanced server settings

■ Advanced detector settings

■ About using load balancers in an endpoint deployment

About managing Symantec Data Loss Prevention

servers
Symantec Data Loss Prevention servers and cloud detectors are managed from the System
> Servers and Detectors > Overview screen. This screen provides an overview of your
system, including server status and recent system events. It displays summary information
about all Symantec Data Loss Prevention servers, a list of recent error and warning events,
and information about your license. From this screen you can add or remove detection servers.
■ Click on the name of a server to display its Server/Detector Detail screen, from which you
can control and configure that server.
See “Installing a new license file” on page 206.
See “About the Enforce Server administration console” on page 66.
See “About the Overview screen” on page 239.
See “Server/Detector Detail screen” on page 243.
See “Adding a detection server” on page 234.
See “Adding a cloud detector” on page 236.
See “Removing a server” on page 237.
See “Server controls” on page 211.
See “Server configuration—basic” on page 213.

Enabling Advanced Process Control

Symantec Data Loss Prevention Advanced Process Control lets you start or stop individual
server processes from the Enforce Server administration console. You do not have to start or
stop an entire server. This feature can be useful for debugging. When Advanced Process
Control is off (the default), each Server/Detector Detail screen shows only the status of the
entire server. When you turn Advanced Process Control on, the General section of the
Server/Detector Detail screen displays individual processes.
See “Server/Detector Detail screen” on page 243.
 Installing and managing detection servers and cloud detectors 211
Server controls

To enable Advanced Process Control

1 Go to System > Settings > General and click Configure.
The Edit General Settings screen is displayed.
2 Scroll down to the Process Control section and check the Advanced Process Control
box.
3 Click Save.
Table 12-1 describes the individual processes and the servers on which they run once advanced
process control is enabled.

Table 12-1 Advanced processes

Process Description Control

Monitor Controller The Monitor Controller process The MonitorController Status is available for
controls detection servers. the Enforce Server.

File Reader The File Reader process detects The FileReader Status is available for all
incidents. detection servers.

Incident Writer The Incident Writer process sends The IncidentWriter Status is available for all
incidents to the Enforce Server. detection servers, unless they are part of a
single-tier installation, in which case there is only
one Incident Writer process.

Packet Capture The Packet Capture process The PacketCapture Status is available for
captures network streams. Network Monitor.

Request The Request Processor processes The RequestProcessor Status is available for
Processor SMTP requests. Network Prevent for Email.

Endpoint Server The Endpoint Server process The EndpointServer Status is available for
interacts with Symantec DLP Endpoint Prevent.
Agents.

Detection Server The Detection Server Database The DetectionServerDatabase Status is

Database process is used for automated available for Network Discover.
incident remediation tracking.

See “Server configuration—basic” on page 213.

Server controls
Servers and their processes are controlled from the Server/Detector Detail screen.
 Installing and managing detection servers and cloud detectors 212
Server controls

■ To reach the Server/Detector Detail screen for a particular server, go to the System >
Servers and Detectors > Overview screen and click a server name, detector name, or
appliance name in the list.
See “Server/Detector Detail screen” on page 243.
The status of the server and its processes appears in the General section of the
Server/Detector Detail screen. The Start, Recycle and Stop buttons control server and
process operations.
Current status of the server is displayed in the General section of the Server/Detector Detail
screen. The possible values are:

Table 12-2 Server status values

Icon Status

Starting - In the process of starting.

Running - Running without errors.

Running Selected - Some processes on the server are stopped or have errors. To see
the statuses of individual processes, you must first enable Advanced Process Control
on the System Settings screen.

Stopping - In the process of stopping.

Stopped - Fully stopped.

Unknown - The Server has encountered one of the following errors:

■ Start. To start a server or process, click Start.

■ Recycle. To stop and restart a server, click Recycle.
■ Stop. To stop a server or process, click Stop.
■ To halt a process during its start-up procedure, click Terminate.
■ To reboot an appliance, click Reboot.

Note: Status and controls for individual server processes are only displayed if Advanced
Process Control is enabled for the Enforce Server. To enable Advanced Process Control, go
to System > Settings > General > Configure, check the Advanced Process Control box,
and click Save.
 Installing and managing detection servers and cloud detectors 213
Server configuration—basic

■ To update the status, click the refresh icon in the upper-right portion of the screen, as
needed.
See “About Symantec Data Loss Prevention administration” on page 65.
See “About the Overview screen” on page 239.
See “Server/Detector Detail screen” on page 243.
See “Server configuration—basic” on page 213.
See “System events reports” on page 150.
See “Server and Detectors event detail” on page 154.

Server configuration—basic
Enforce Servers are configured from the System > Settings > General menu.
Detection servers are configured from each server's individual Configure Server screen.
To configure a server
1 Go to the System > Servers and Detectors > Overview screen.
2 Click on the name of the server in the list.
That server's Server/Detector Detail screen is displayed. In the upper-left portion of a
Server/Detector Detail screen are the following buttons:
■ Done. Click Done to return to the previous screen.
■ Configure. Click Configure to specify a basic configuration for this server.
■ Server Settings. Click Server Settings to specify advanced configuration parameters
for this server. Use caution when modifying advanced server settings. It is
recommended that you check with Symantec Support before changing any of the
advanced settings.
See “Server and detector configuration—advanced” on page 234.
See Symantec Data Loss Prevention online Help for information about advanced
server configuration.

3 Click Configure or Server Settings to display a configuration screen for that type of
server.
4 Specify or change settings on the screen as needed, and then click Save.
Click Cancel to return to the previous screen without changing any settings.

Note: A server must be recycled before new settings take effect.

 Installing and managing detection servers and cloud detectors 214
Server configuration—basic

See “Server controls” on page 211.

The Configure Server screen contains a General section for all detection servers that contains
the following parameters:
■ Name. The name you choose to give the server. This name appears in the Enforce Server
administration console (System > Servers and Detectors > Overview). The name is
limited to 255 characters.
■ Host. The host name or IP address of the system hosting the server. Host names must be
fully qualified. If the host has more than one IP address, specify the address on which the
detection server listens for connections to the Enforce Server.
■ Port. The port number used by the detection server to communicate with the Enforce
Server. The default is 8100.
For Single Tier Monitors, the Host field on the Configure Server page is pre-populated with
the local IP address 127.0.0.1. You cannot change this value.
The remaining portions of a Configure Server screen vary according to the type of server.
See “Network Monitor Server—basic configuration” on page 214.
See “Network Discover/Cloud Storage Discover Server and Network Protect—basic
configuration” on page 221.
See “Network Prevent for Email Server—basic configuration” on page 216.
See “Network Prevent for Web Server—basic configuration” on page 219.
See “Endpoint Server—basic configuration” on page 222.
See “Single Tier Monitor — basic configuration” on page 223.
See “Classification Server—basic configuration” on page 232.
See “Server/Detector Detail screen” on page 243.

Network Monitor Server—basic configuration

Detection servers are configured from each server's individual Configure Server screen. To
display the Configure Server screen, go to the Overview screen (System > Servers and
Detectors > Overview) and click the name of the server in the list. That server's
Server/Detector Detail screen appears. Click Configure to display the Configure Server
screen.
A Network Monitor Server's Configure Server screen is divided into a general section and
two tabs:
■ General section. Use this section to specify the server's name, host, and port.
See “Server configuration—basic” on page 213.
■ Packet Capture tab. Use this tab to configure network packet capture settings.
 Installing and managing detection servers and cloud detectors 215
Server configuration—basic

■ SMTP Copy Rule tab. Use this tab to modify the source folder where the server retrieves
SMTP message files.
The top portion of the Packet Capture defines general packet capture parameters. It provides
the following fields:

Field Description

Source Folder Override The source folder is the directory the server uses to
buffer network streams before it processes them.
The recommended setting is to leave the Source
Folder Override field blank to accept the default. If
you want to specify a custom buffer directory, type
the full path to the directory.

Network Interfaces Select the network interface card(s) to use for

monitoring. Note that to monitor a NIC WinPcap
software must be installed on the Network Monitor
Server.

See the Symantec Data Loss Prevention Installation

Guide for more information about NICs.

Th Protocol section of the Packet Capture specifies the types of network traffic (by protocol)
to capture. It also specifies any custom parameters to apply. This section lists the standard
protocols that you have licensed with Symantec, and any custom TCP protocols you have
added.
To monitor a particular protocol, check its box. When you initially configure a server, the settings
for each selected protocol are inherited from the system-wide protocol settings. You configure
these settings by going to System > Settings > Protocol. System-wide default settings are
listed as Standard.
Consult Symantec Data Loss Prevention online Help for information about working with
system-wide settings.
To override the inherited filtering settings for a protocol, click the name of the protocol. The
following custom settings are available (some settings may not be available for some protocols):
■ IP filter
■ L7 sender filter
■ L7 recipient filter
■ Content filter
■ Search Depth (packets)
■ Sampling rate
 Installing and managing detection servers and cloud detectors 216
Server configuration—basic

■ Maximum wait until written

■ Maximum wait until dropped
■ Maximum stream packets
■ Minimum stream size
■ Maximum stream size
■ Segment Interval
■ No traffic notification timeout (The maximum value for this setting is 360000 seconds.)
Use the SMTP Copy Rule to modify the source folder where this server retrieves SMTP
message files. You can modify the Source Folder by entering the full path to a folder.
See “About Symantec Data Loss Prevention administration” on page 65.
See “About the Overview screen” on page 239.
See “Server/Detector Detail screen” on page 243.
See “Server configuration—basic” on page 213.
See “Server controls” on page 211.
In addition to the settings available through the Configure Server screen, you can specify
advanced settings for this server. To specify advanced configuration parameters, click Server
Settings on the server's Server/Detector Detail screen. Use caution when modifying advanced
server settings. Check with Symantec Support before you change any advanced setting.
See “Advanced server settings” on page 245.
See the Symantec Data Loss Prevention online Help for information about advanced server
settings.

Network Prevent for Email Server—basic configuration

Detection servers are configured from each server's individual Configure Server screen. To
display the Configure Server screen, go to the Overview screen (System > Servers and
Detectors > Overview) and click the name of the server in the list. That server's
Server/Detector Detail screen appears. Click Configure to display the Configure Server
screen.
A Network Prevent for Email Server Configure Server screen is divided into a General section
and an Inline SMTP tab. The General section specifies the server's name, host, and port.
See “Server configuration—basic” on page 213.
Use the Inline SMTP tab to configure different Network Prevent for Email Server features:
 Installing and managing detection servers and cloud detectors 217
Server configuration—basic

Field Description

Trial Mode Trial mode lets you test prevention capabilities

without blocking requests. When trial mode is
selected, the server detects incidents and creates
incident reports, but does not block any messages.
Deselect this option to block those messages that
are found to violate Symantec Data Loss Prevention
policies.

Keystore Password If you use TLS authentication in a forwarding mode

configuration, enter the correct password for the
keystore file.

Next Hop Configuration
Select Reflect to operate Network Prevent for Email
Server in reflecting mode. Select Forward to
operate in forwarding mode.
Note: If you select Forward you must also select
Enable MX Lookup orDisable MX Lookup to
configure the method that is used to determine the
next-hop MTA.

Enable MX Lookup This option applies only to forwarding mode

configurations.

Select Enable MX Lookup to perform a DNS query

on a domain name to obtain the mail exchange (MX)
records for the server. Network Prevent for Email
Server uses the returned MX records to select the
address of the next hop mail server.

If you select Enable MX Lookup, also add one or

more domain names in the Enter Domains text
box. For example:

companyname.com

Network Prevent for Email Server performs MX

record queries for the domain names that you
specify.
Note: You must include at least one valid entry in
the Enter Domains text box to successfully
configure forwarding mode behavior.
 Installing and managing detection servers and cloud detectors 218
Server configuration—basic

Field Description

Disable MX Lookup This field applies only to forwarding mode

configurations.

Select Disable MX Lookup if you want to specify

the exact or IP address of one or more next-hop
MTAs. Network Prevent for Email Server uses the
hostnames or addresses that you specify and does
not perform an MX record lookup.

If you select Disable MX Lookup, also add one or

more hostnames or IP addresses for next-hop MTAs
in the Enter Hostnames text box. You can specify
multiple entries by placing each entry on a separate
line. For example:

smtp1.companyname.com
smtp2.companyname.com
smtp3.companyname.com

Network Prevent for Email Server always tries to

use the first MTA that you specify in the list. If that
MTA is not available, Network Prevent for Email
Server tries the next available entry in the list.
Note: You must include at least one valid entry in
the Enter Hostnames text box to successfully
configure forwarding mode behavior.

See the Symantec Data Loss Prevention MTA Integration Guide for Network Prevent for Email
for additional information about configuring Network Prevent for Email Server options.
See “About Symantec Data Loss Prevention administration” on page 65.
See “About the Overview screen” on page 239.
See “Server/Detector Detail screen” on page 243.
See “Server configuration—basic” on page 213.
See “Server controls” on page 211.
In addition to the settings available through the Configure Server screen, you can specify
advanced settings for this server. To specify advanced configuration parameters, click Server
Settings on the server's Server/Detector Detail screen. Use caution when modifying advanced
server settings. Check with Symantec Support before you change any advanced setting.
See “Advanced server settings” on page 245.
 Installing and managing detection servers and cloud detectors 219
Server configuration—basic

See the Symantec Data Loss Prevention online Help for information about advanced server
settings.

Network Prevent for Web Server—basic configuration

Detection servers are configured from each server's individual Configure Server screen. To
display the Configure Server screen, go to the Overview screen (System > Servers and
Detectors > Overview) and click the name of the server in the list. That server's
Server/Detector Detail screen appears. Click Configure to display the Configure Server
screen.
A Network Prevent for Web Server Configure Server screen is divided into a general section
and one tab:
■ General section. This section specifies the server's name, host, and port.
See “Server configuration—basic” on page 213.
■ ICAP tab. This tab is for configuring Internet Content Adaptation Protocol (ICAP) capture.
Use the ICAP tab to configure Web-based network traffic. The ICAP tab is divided into four
sections:
■ The Trial Mode section enables you to test prevention without blocking traffic. When trial
mode is selected, the server detects incidents and creates incident reports, but it does not
block any traffic. This option enables you to test your policies without blocking traffic. Check
the box to enable trial mode.
■ The Request Filtering section configures traffic filtering criteria:

Field Description

Ignore Requests Smaller Than
Specify the minimum body size of HTTP
requests to inspect on this server. The
default value is 4096 bytes. HTTP requests
with bodies smaller than this number are
not inspected.

Ignore Requests without Attachments Check this box to inspect only those HTTP
requests that contain attachments.

Ignore Requests to Hosts or Domains Enter the host names or domains whose
requests should be filtered out (ignored).
Enter one host or domain name per line.

Ignore Requests from User Agents Enter the names of user agents whose
requests should be filtered out (ignored).
Enter one agent per line.
 Installing and managing detection servers and cloud detectors 220
Server configuration—basic

■ The Response Filtering section configures the filtering criteria to manage HTTP responses:

Field Description

Ignore Responses Smaller Than
Enter the minimum body size of HTTP
responses to inspect on this server. The
default value is 4096 bytes. HTTP
responses with bodies smaller than this
number are not inspected.

Inspect Content Type Specify the MIME content types that this
server is to monitor. By default, this field
contains content type values for standard
Microsoft Office, PDF, and plain-text
formats. You can add other MIME content
type values. Enter separate content types
on separate lines. For example, to inspect
WordPerfect 5.1 files, enter
application/wordperfect5.1.

Ignore Responses from Hosts or Domains Enter the host names or domains whose
responses are to be ignored. Enter one host
or domain name per line.

Ignore Responses to User Agents Enter the names of user agents whose
responses are to be ignored. Enter one user
agent per line.

■ The Connection section configures settings for the ICAP connection between an HTTP
proxy server and the Network Prevent for Web Server:

Field Description

TCP Port Specify the TCP port number that this

server is to use to listen to ICAP requests.
The same value must be configured on the
HTTP proxy sending ICAP requests to this
server. The recommended value is 1344.

Maximum Number of Requests Enter the maximum number of simultaneous

ICAP request connections. The default is
25.

Maximum Number of Responses Enter the maximum number of simultaneous

ICAP response connections from the HTTP
proxy or proxies that are allowed. The
default is 25.
 Installing and managing detection servers and cloud detectors 221
Server configuration—basic

Field Description

Connection Backlog Enter the maximum number of waiting

connections allowed. Each waiting
connection means that a user waits at their
browser. The minimum value is 1.

See “Configuring Network Prevent for Web Server” on page 1511.

See “About Symantec Data Loss Prevention administration” on page 65.
See “About the Overview screen” on page 239.
See “Server/Detector Detail screen” on page 243.
See “Server configuration—basic” on page 213.
See “Server controls” on page 211.
In addition to the settings available through the Configure Server screen, you can specify
advanced settings for this server. To specify advanced configuration parameters, click Server
Settings on the server's Server/Detector Detail screen. Use caution when modifying advanced
server settings. Check with Symantec Support before you change any advanced setting.
See “Advanced server settings” on page 245.
See the Symantec Data Loss Prevention online Help for information about advanced server
settings.

Network Discover/Cloud Storage Discover Server and Network

Protect—basic configuration
Detection servers are configured from each server's individual Configure Server screen. To
display the Configure screen for a server, go to the System > Servers and Detectors >
Overview screen and click on the name of the server in the list. That server's Server/Detector
Detail screen is displayed. Click Configure. The server's Configure Server screen is displayed.
See “Modifying the Network Discover/Cloud Storage Discover Server configuration” on page 1527.
A Network Discover Server's Configure Server screen is divided into a general section and
one tab:
■ General section. This section is for specifying the server's name, host, and port.
See “Server configuration—basic” on page 213.
■ Discover tab. This tab is for modifying the number of parallel scans that run on this Discover
Server.
The maximum count can be increased at any time. After it is increased, any queued scans
that are eligible to run on the Network Discover Server are started. The count can be
 Installing and managing detection servers and cloud detectors 222
Server configuration—basic

decreased only if the Network Discover Server has no running scans. Before you reduce
the count, pause, or stop, all scans running on the server.
To view the scans running on Network Discover Servers, go to Manage > Discover
Scanning > Discover Targets.

See “About Symantec Data Loss Prevention administration” on page 65.

See “Server/Detector Detail screen” on page 243.
See “Server configuration—basic” on page 213.
See “Server controls” on page 211.
In addition to the settings available through the Configure Server screen, you can also specify
advanced settings for this server. To specify advanced configuration parameters, click Server
Settings on the Server/Detector Detail screen. Use caution when modifying advanced server
settings. It is recommended that you check with Symantec Support before changing any of
the advanced settings.
See “Advanced server settings” on page 245.

Endpoint Server—basic configuration

Detection servers are configured from each server's individual Configure Server screen. To
display the Configure screen for a server, go to the System > Servers and Detectors >
Overview screen and click the name of the server. The Server/Detector Detail screen for
that server is displayed. Click Configure to display the Configure Server screen for that
server.
See “Adding a detection server” on page 234.
The Configure Server screen for an Endpoint Server is divided into a general section and the
following tabs:
■ General. This section is for specifying the server name, host, and port.
See “Server configuration—basic” on page 213.
■ Agent. This section is for adding agent security certificates to the Endpoint Server.
See “Adding and editing agent configurations” on page 1784.
Agent Listener. Use this section to configure the Endpoint Server to listen for connections
from Symantec DLP Agents:

Field Description

Bind address Enter the IP address on which the Endpoint Server listens for communications from
the Symantec DLP Agents. The default IP address is 0.0.0.0 which allows the
Endpoint Server to listen on all host IP addresses.
 Installing and managing detection servers and cloud detectors 223
Server configuration—basic

Field Description

Port Enter the port over which the Endpoint Server listens for communications from the
Symantec DLP Agents.
Note: Many Linux systems restrict ports below 1024 to root access. The Endpoint
Server cannot by configured to listen for connections from Symantec DLP Agents
to these restricted ports on Linux systems.

Note: If you are using FIPS 140-2 mode for communication between the Endpoint Server and
DLP Agents, do not use Diffie-Hellman (DH) cipher suites. Mixing cipher suites prevents the
agent and Endpoint Server from communicating. You can confirm the current cipher suit setting
by referring to the EndpointCommunications.SSLCipherSuites setting on the Server
Settings page. See “Advanced server settings” on page 245.

Single Tier Monitor — basic configuration

Detection servers are configured from each server's individual Configure Server screen. To
display the Configure Server screen, go to the System > Servers and Detectors > Overview
screen and click the name of the server in the list. That server's Server/Detector Detail screen
appears. Click Configure to display the Configure Server screen.
The Single Tier Monitor is a detection server that includes the detection capabilities of the
Network Monitor, Network Discover/Cloud Storage Discover, Network Prevent for Web, Network
Prevent for Email, and the Endpoint Prevent and Endpoint Discover detection servers. Each
of these detection server types is associated with one or more detection "channels." The Single
Server deployment simplifies Symantec Data Loss Prevention administration and reduces
maintenance and hardware costs for small organizations, or for branch offices of larger
enterprises that would benefit from on-site deployments of Symantec Data Loss Prevention.

Configuring the channels for Network Monitor

Network Monitor uses two channels: Packet Capture and SMTP Copy Rule. To configure
Network Monitor, enter your configuration information on both the Packet Capture and SMTP
Copy Rule tabs on the Configure Server screen.
 Installing and managing detection servers and cloud detectors 224
Server configuration—basic

To configure the Packet Capture and SMTP Copy Rule tabs

1 Optional: On the Packet Capture tab of the Configure Server Screen, specify the Source
Folder Override.
The source folder is the directory the server uses to buffer network streams before it
processes them. The recommended setting is to leave the Source Folder Override field
blank to accept the default. If you want to specify a custom buffer directory, type the full
path to the directory.
2 Select the Network Interfaces.
Select the network interface card(s) to use for monitoring.
See the Symantec Data Loss Prevention Installation Guide for more information about
NICs.
3 In the Protocol section, check the box for each type of network traffic to capture.
When you initially configure a server, the settings for each selected protocol are inherited
from the system-wide protocol settings. You configure these settings by going to System
> Settings > Protocol. System-wide default settings are listed as Standard. To override
the inherited filtering settings for a protocol, click the name of the protocol. The following
custom settings are available (some settings may not be available for some protocols):
■ IP filter
■ L7 sender filter
■ L7 recipient filter
■ Content filter
■ Search Depth (packets)
■ Sampling rate
■ Maximum wait until written
■ Maximum wait until dropped
■ Maximum stream packets
■ Minimum stream size
■ Maximum stream size
■ Segment Interval
 Installing and managing detection servers and cloud detectors 225
Server configuration—basic

■ No traffic notification timeout (The maximum value for this setting is 360000 seconds.)

4 Optional: On the SMTP Copy Rule tab, specify the Source Folder Override to modify
the source folder where this server retrieves SMTP message files.
You can modify the source folder by entering the full path to a folder. Leave this field blank
to use the default source folder.

Configuring the channel for Network Discover/Cloud Storage Discover

Network Discover/Cloud Storage Discover uses the Discover channel. On the Discover tab,
you can modify the number of parallel scans that run on the Single Tier Monitor by entering a
number in the Maximum Parallel Scans field.

Note: If you plan to use the grid scanning feature to distribute the scanning workload across
multiple detection servers, retain the default value (1).

The maximum count can be increased at any time. After it is increased, any queued scans
that are eligible to run on the Network Discover Server are started. The count can be decreased
only if the Network Discover Server has no running scans. Before you reduce the count, pause,
or stop, all scans running on the server.

Configuring the channel for Network Prevent for Web

Network Prevent for Web uses the ICAP channel. The ICAP channel configuration tab is
divided into four sections: Request Filtering, Response Filtering, and Connection.
 Installing and managing detection servers and cloud detectors 226
Server configuration—basic

To configure the ICAP tab

1 Verify or change the Trial Mode setting. Trial Mode lets you test prevention without
blocking requests in real time. If you select Trial Mode, Symantec Data Loss Prevention
detects incidents and indicates that it has blocked an HTTP communication, but it does
not block the communication.
2 Verify or modify the filter options for requests from HTTP clients (user agents). The options
in the Request Filtering section are as follows:

Ignore Requests Smaller Than
Specifies the minimum body size of HTTP
requests to inspect. (The default is 4096 bytes.)
For example, search-strings typed in to search
engines such as Yahoo or Google are usually
short. By adjusting this value, you can exclude
those searches from inspection.

Ignore Requests without Attachments Causes the server to inspect only the requests
that contain attachments. This option can be
useful if you are mainly concerned with requests
intended to post sensitive files.

Ignore Requests to Hosts or Domains
Causes the server to ignore requests to the hosts
or domains you specify. This option can be useful
if you expect a lot of HTTP traffic between the
domains of your corporate headquarters and
branch offices. You can type one or more host
or domain names (for example,
www.company.com), each on its own line.

Ignore Requests from User Agents
Causes the server to ignore requests from user
agents (HTTP clients) you specify. This option
can be useful if your organization uses a program
or language (such as Java) that makes frequent
HTTP requests. You can type one or more user
agent values, each on its own line.
 Installing and managing detection servers and cloud detectors 227
Server configuration—basic

3 Verify or modify the filter options for responses from web servers. The options in the
Response Filtering section are as follows:

Ignore Responses Smaller Than Specifies the minimum size of the body of HTTP
responses that are inspected by this server.
(Default is 4096 bytes.)

Inspect Content Type Specifies the MIME content types that Symantec
Data Loss Prevention should monitor in
responses. By default, this field contains
content-type values for Microsoft Office, PDF,
and plain text formats. To add others, type one
MIME content type per line. For example, type
application/word2013 to have Symantec
Data Loss Prevention analyze Microsoft Word
2013 files.

Note that it is generally more efficient to specify

MIME content types at the Web proxy level.

Ignore Responses from Hosts or Domains Causes the server to ignore responses from the
hosts or domains you specify. You can type one
or more host or domain names (for example,
www.company.com), each on its own line.

Ignore Responses to User Agents Causes the server to ignore responses to user
agents (HTTP clients) you specify. You can type
one or more user agent values, each on its own
line.
 Installing and managing detection servers and cloud detectors 228
Server configuration—basic

4 Verify or modify settings for the ICAP connection between the HTTP proxy server and the
Web Prevent Server. The Connection options are as follows:

TCP Port Specifies the TCP port number over which this
server listens for ICAP requests. This number
must match the value that is configured on the
HTTP proxy that sends ICAP requests to this
server. The recommended value is 1344.

Maximum Number of Requests Specifies the maximum number of simultaneous

ICAP request connections from the HTTP proxy
or proxies. The default is 25.

Maximum Number of Responses Specifies the maximum number of simultaneous

ICAP response connections from the HTTP proxy
or proxies. The default is 25.

Connection Backlog Specifies the number of waiting connections

allowed. A waiting connection is a user waiting
for an HTTP response from the browser. The
minimum value is 1. If the HTTP proxy gets too
many requests (or responses), the proxy handles
them according to your proxy configuration. You
can configure the HTTP proxy to block any
requests (or responses) greater than this number.

Configuring the channel for Network Prevent for Email

Network Prevent for Email uses the Inline SMTP channel. The Inline SMTP configuration tab
is divided into three sections: Maximum number of connections, Security Configuration,
and Next Hop Configuration.
To configure the Inline SMTP tab
1 Verify or change the Trial Mode setting. Trial Mode lets you test prevention without
blocking requests in real time. If you select Trial Mode, Symantec Data Loss Prevention
detects incidents and indicates that it has blocked an email message, but it does not block
the message.
2 Verify or modify the Maximum number of connections. By default, the maximum number
of connections is 12.
 Installing and managing detection servers and cloud detectors 229
Server configuration—basic

3 If you use TLS authentication in a forwarding mode configuration, enter the correct
password for the keystore file in the Keystore Password field of the Security
Configuration section.
 Installing and managing detection servers and cloud detectors 230
Server configuration—basic

4 In the Next Hop Configuration section, configure reflecting mode or forwarding mode by
modifying the following fields:

Field Description

Next Hop Configuration Select Reflect to operate Network Prevent for

Email Server in reflecting mode. Select Forward
to operate in forwarding mode.
Note: If you select Forward you must also select
Enable MX Lookup or Disable MX Lookup to
configure the method used to determine the
next-hop MTA.

Enable MX Lookup This option applies only to forwarding mode

configurations.

Select Enable MX Lookup to perform a DNS

query on a domain name to obtain the mail
exchange (MX) records for the server. Network
Prevent for Email Server uses the returned MX
records to select the address of the next hop mail
server.

If you select Enable MX Lookup, also add one

or more domain names in the Enter Domains
text box. For example:

companyname.com

Network Prevent for Email Server performs MX

record queries for the domain names that you
specify.
Note: You must include at least one valid entry
in the Enter Domains text box to successfully
configure forwarding mode behavior.
 Installing and managing detection servers and cloud detectors 231
Server configuration—basic

Field Description

Disable MX Lookup This field applies only to forwarding mode

configurations.

Select Disable MX Lookup if you want to specify

the exact hostname or IP address of one or more
next-hop MTAs. Network Prevent for Email
Server uses the hostnames or addresses that
you specify and does not perform an MX record
lookup.

If you select Disable MX Lookup, also add one

or more hostnames or IP addresses for next-hop
MTAs in the Enter Hostnames text box. You can
specify multiple entries by placing each entry on
a separate line. For example:

smtp1.companyname.com
smtp2.companyname.com
smtp3.companyname.com

Network Prevent for Email Server always tries to

proxy to the first MTA that you specify in the list.
If that MTA is not available, Network Prevent for
Email Server tries the next available entry in the
list.
Note: You must include at least one valid entry
in the Enter Hostnames text box to successfully
configure forwarding mode behavior.

Configuring the channel for Endpoint

Endpoint uses the Endpoint channel. You can configure the Endpoint channel on the Agent
tab.
To configure the Agent tab
◆ Configure the Agent Listener fields:

Field Description

Bind address Enter the IP address on which the Endpoint Server listens for communications
from the Symantec DLP Agents. The default IP address is 0.0.0.0 which allows
the Endpoint Server to listen on all host IP addresses.

Port Enter the port over which the Endpoint Server listens for communications from
the Symantec DLP Agents.
 Installing and managing detection servers and cloud detectors 232
Server configuration—basic

Configuring Advanced Server Settings for the Single Tier Monitor

Because the Single Tier Monitor runs multiple channels on the same detection server, you
must modify some Advanced Server Settings to get the best performance from your system.
To modify the Advanced Server Settings on your Single Tier Monitor
1 Log on to the Enforce Server as Administrator.
2 Go to System > Servers and Detectors > Overview.
The Overview page appears.
3 Click the Single Tier Monitor detection server row.
The Server/Detector Detail page appears.
4 Click Server Settings.
The Server/Detector Detail - Advanced Settings page appears.
5 Modify the following settings:

Setting Value

MessageChain.NumChains 32

MessageChain.CacheSize 32

PacketCapture.NUMBER_BUFFER_POOL_PACKETS 1,200,000

PacketCapture.NUMBER_SMALL_POOL_PACKETS 1,000,000

6 Click Save.
See “About Symantec Data Loss Prevention administration” on page 65.
See “About the Overview screen” on page 239.
See “Server/Detector Detail screen” on page 243.
See “Server configuration—basic” on page 213.
See “Server controls” on page 211.
See “Advanced server settings” on page 245.
See the Symantec Data Loss Prevention online Help for information about Advanced Server
settings.

Classification Server—basic configuration

Detection servers are configured from each server's individual Configure Server screen. To
display the Configure Server screen, go to the Overview screen (System > Servers and
 Installing and managing detection servers and cloud detectors 233
Editing a detector

Detectors > Overview) and click the name of the server in the list. The Server/Detector
Detail screen for that server appears. Click Configure to display the Configure Server screen.
The Configure Server screen for a Classification Server is divided into two sections:
■ General section. This section specifies the server name, host, and port that is used for
communicating with the Enforce Server.
See “Server configuration—basic” on page 213.
■ Classification section. This section specifies the connection properties that the Data
Classification for Enterprise Vault filter uses to communicate with the Classification Server.
Use the fields of the Classification section to configure connection properties for the server:

Maximum number of sessions Enter the maximum number of concurrent sessions

that the Classification Server can accept from Data
Classification for Enterprise Vault filters. The default
is 12. The maximum number of sessions that a
Classification Server can support depends on the
CPU and memory available to the server. See the
Symantec Enterprise Vault Data Classification
Services Implementation Guide for more
information.

Session Timeout (in milliseconds)
Enter the maximum number of milliseconds that a
Data Classification for Enterprise Vault filter can
remain idle before the Classification Server
terminates the session. The default value is 30000
milliseconds.

Classification Service Port Specify the port number on which the Classification
Server accepts connections from Data Classification
for Enterprise Vault filters. The default port is 10080.

Note: The Classification Server is used only with the Symantec Enterprise Vault Data
Classification solution, which is licensed separately from Symantec Data Loss Prevention.
You must configure the Enterprise Vault Data Classification Services filter and Classification
Server to communicate with one another. See the Symantec Enterprise Vault Data Classification
Services Implementation Guide for more information.

Editing a detector
You can change the name of your detector on the Server/Detector Detail screen.
 Installing and managing detection servers and cloud detectors 234
Server and detector configuration—advanced

Editing the name of a detector

1 Go to System > Servers and Detectors > Overview and click on the name of the detector.
The Server/Detector Detail screen appears.
2 Click Edit.
The Edit Detector page appears.
3 Enter a new name for the detector in the Detector Name field.
4 Click Save.

Server and detector configuration—advanced

Symantec Data Loss Prevention provides advanced server and detector configuration settings
for each detection server or detector in your system.

Note: Check with Symantec Support before changing any advanced settings. If you make a
mistake when changing advanced settings, you can severely degrade performance or even
disable the server entirely.

To change an advanced configuration setting for a detection server or detector

1 Go to System > Servers and Detectors > Overview and click on the name of the detection
server.
That server's Server/Detector Detail screen appears.
2 Click Server Settings or Detector Settings, as appropriate.
The Server/Detector Detail - Advanced Settings screen appears.
See Symantec Data Loss Prevention online Help for information about advanced server
configuration.
See “Advanced server settings” on page 245.
3 With the guidance of Symantec Support, modify the appropriate setting(s).
4 Click Save.
Changes to settings on this screen normally do not take effect until you restart the server.
See “Server configuration—basic” on page 213.

Adding a detection server

Add the detection servers that you want to your Symantec Data Loss Prevention system from
the System > Servers and Detectors > Overview screen.
 Installing and managing detection servers and cloud detectors 235
Adding a detection server

You can add the following types of servers:

■ Network Monitor Server, which monitors network traffic.
■ Network Discover/Cloud Storage Discover Server, which inspects stored data for policy
violations.
■ Network Prevent for Email Server, which prevents SMTP violations.
■ Cloud Prevent for Email Server, which prevents Microsoft Office 365 Exchange traffic
violations.
■ Network Prevent for Web Server, which prevents ICAP proxy server violations such as
FTP, HTTP, and HTTPS.
■ Endpoint Prevent, which controls Symantec DLP Agents that monitor and scan endpoints.
■ Single-Tier Server: By selecting the Single-Tier Server option, the detection servers that
you have licensed are installed on the same host as the Enforce Server. The single-tier
server performs detection for the following products (you must have a license for each):
Network Monitor, Network Discover, Network Prevent for Email, Network Prevent for Web,
and Endpoint Prevent.

Note: Symantec recommends that you apply the same hardware and software configuration
to all of the detections servers that you intend to use for grid scans. Symantec Data Loss
Prevention supports grid scans that have up to 11 participating detection servers.

To add a detection server

1 Go to the System Overview screen (System > Servers and Detectors > Overview).
See “About the Overview screen” on page 239.
2 Click Add Server.
The Add Server screen appears.
3 Select the type of server you want to install and click Next.
The Configure Server screen for that detection server appears.
 Installing and managing detection servers and cloud detectors 236
Adding a cloud detector

4 To perform the basic server configuration, use the Configure Server screen, then click
Save when you are finished.
See “Network Monitor Server—basic configuration” on page 214.
See “Network Prevent for Email Server—basic configuration” on page 216.
See Symantec Data Loss Prevention Cloud Prevent for Microsoft Office 365 Implementation
Guide for more details.
See “Network Prevent for Web Server—basic configuration” on page 219.
See “Network Discover/Cloud Storage Discover Server and Network Protect—basic
configuration” on page 221.
See “Endpoint Server—basic configuration” on page 222.
See “Single Tier Monitor — basic configuration” on page 223.
5 To return to the System Overview screen, click Done.
Your new server is displayed in the Servers and Detectors list with a status of Unknown.
6 Click on the server to display its Server/Detector Detail screen.
See “Server/Detector Detail screen” on page 243.
7 Click [Recycle] to restart the server.
8 Click Done to return to the System Overview screen.
When the server is finished restarting, its status displays Running.
9 If necessary, click Server Settings on the Server/Detector Detail screen to perform
Advanced Server configuration.
See “Advanced server settings” on page 245.
See Symantec Data Loss Prevention online Help for information about Advanced Server
configuration.
See “Server configuration—basic” on page 213.

Adding a cloud detector

A cloud detector is a Symantec Data Loss Prevention detection service deployed in the
Symantec Cloud. After Symantec has set up your detection service in the cloud, Symantec
sends you an enrollment bundle. This bundle contains the information that you need to set up
the connection from your on-premises Enforce Server to the detection service in the Symantec
Cloud.
The enrollment bundle is a ZIP archive. For security reasons, you should save the unextracted
ZIP file to a location that is not accessible by others users. For example, on a Microsoft Windows
system, save the bundle to a folder such as:
 Installing and managing detection servers and cloud detectors 237
Removing a server

c:\Users\username\downloads

On a Linux system, save the bundle to a directory such as:

/home/username/

See the documentation for your cloud detector for more detailed information about the
enrollment process.
After you have saved the enrollment bundle, register your cloud detector to enable
communication between it and your on-premises Enforce Server.
To register a cloud detector
1 Log on to the Enforce Server as Administrator.
2 Navigate to System > Servers and Detectors > Overview.
The Overview page appears.
3 Click Add Cloud Detector.
The Add Cloud Detector page appears.
4 Click Browse in the Enrollment Bundle File field.
5 Locate your saved enrollment bundle file, then enter a name in the Detector Name field.
6 Click Enroll Detector.
The Server/Detector Detail screen appears.
7 If necessary, click Detector Settings on the Server/Detector Detail screen to perform
advanced detector configuration.
See “Advanced detector settings” on page 286.
8 Click Done.
It may take several minutes for the Enforce Server administration console to show that the
cloud detector is running. To verify that the detector was added, check the System > Servers
and Detectors > Overview page. The detector should appear in the Servers and Detectors
list with the Connected status.

Removing a server
See the appropriate Symantec Data Loss Prevention Installation Guide for information about
uninstalling Symantec Data Loss Prevention from a server.
An Enforce Server administration console lists the detection servers registered with it on the
System > Servers and Detectors > Overview screen. If Symantec Data Loss Prevention is
uninstalled from a detection server, or that server is stopped or disconnected from the network,
its status is shown as Unknown on the console.
 Installing and managing detection servers and cloud detectors 238
Importing SSL certificates to Enforce or Discover servers

A detection server can be removed (de-registered) from an Enforce Server administration

console. When a detection server is removed from an Enforce Server, its Symantec Data Loss
Prevention services continue to operate. This means that even though a detection server is
de-registered from Enforce, it continues to function unless some action is taken to halt it. In
other words, even though it is removed from an Enforce Server administration console, a
detection server continues to operate. Incidents it detects are stored on the detection server.
If a detection server is re-registered with an Enforce Server, incidents detected and stored are
then forwarded to Enforce.
To remove (de-register) a detection server from Enforce
1 Go to System > Servers and Detectors > Overview.
See “About the Overview screen” on page 239.
2 In the Servers and Detectors section of the screen, click the red X on a server's status
line to remove it from this Enforce Server administration console.
See “Server controls” on page 211.
3 Click OK to confirm.
The server's status line is removed from the System Overview list.

Importing SSL certificates to Enforce or Discover

servers
You can import SSL certificates to the Java trusted keystore on the Enforce or Discover servers.
The SSL certificate can be self-signed (server) or issued by a well-known certificate authority
(CA).
You may need to import an SSL certificate to make secure connections to external servers
such as Active Directory (AD). If a recognized authority has signed the certificate of the external
server, the certificate is automatically added to the Enforce Server. If the server certificate is
self-signed, you must manually import it to the the Enforce or Discover Servers.

Table 12-3 Importing an SSL certificate to Enforce or Discover

Step Description

1 Copy the certificate file you want to import to the Enforce Server or Discover Server computer.

2 Change directory to c:\SymantecDLP\jre\bin on the Enforce Server or Discover Server

computer.
 Installing and managing detection servers and cloud detectors 239
About the Overview screen

Table 12-3 Importing an SSL certificate to Enforce or Discover (continued)

Step Description

3 Execute the keytool utility with the -importcert option to import the public key certificate
to the Enforce Server or Discover Server keystore:

keytool -importcert -alias new_endpointgroup_alias

-keystore ..\lib\security\cacerts -file my-domaincontroller.crt

In this example command, new_endpointgroup_alias is a new alias to assign to the imported

certificate and my-domaincontroler.crt is the path to your certificate.

4 When you are prompted, enter the password for the keystore.

By default, the password is changeit. If you want you can change the password when prompted.

To change the password, use: keytool -storepassword -alias

new_endpointgroup_alias -keystore ..\lib\security\cacerts

5 Answer Yes when you are asked if you trust this certificate.

6 Restart the Enforce Server or Discover Server.

See “Configuring directory server connections” on page 141.

About the Overview screen

The System Overview screen is reached by System > Servers and Detectors > Overview.
This screen provides a quick snapshot of system status. It lists information about the Enforce
Server, and each registered detection server, cloud detector, or appliance.
The System Overview screen provides the following features:
■ The Add Server button is used to register a detection server. When this screen is first
viewed after installation, only the Enforce Server is listed. You must register your various
detection servers with the Add Server button. After you register detection servers, they
are listed in the Servers and Detectors section of the screen.
See “Adding a detection server” on page 234.
■ The Add Cloud Detector button is used to register a cloud detector. When this screen is
first viewed after installation, only the Enforce Server is listed. You must register your cloud
detectors with the Add Cloud Detector button. After you register cloud detectors, they are
listed in the Servers and Detectors section of the screen.
■ The Add Appliance button is used to register and appliance. When this screen is first
viewed after installation, on the Enforce Server is listed. You must register your appliances
with the Add Appliance button. After you register your appliances, they are listed in the
Servers and Detectors section of the screen.
 Installing and managing detection servers and cloud detectors 240
Configuring the Enforce Server to use a proxy to connect to cloud services

See “Adding an appliance” on page 1955.

■ The System Readiness and Appliances Update button is used to access the System
Readiness and Appliances Update screen where you can run tests to confirm that
database update readiness and update appliances.

■ The Upgrade button is for upgrading Symantec Data Loss Prevention to a newer version.
See “About system upgrades” on page 207.
See also the appropriate Symantec Data Loss Prevention Upgrade Guide.
■ The Servers and Detectors section of the screen displays summary information about
the status of each server, detector, or appliance. It can also be use to remove (de-register)
a server, detector, or appliance.
See “Server and detector status overview” on page 241.
■ The Recent Error and Warning Events section shows the last five events of error or
warning severity for any of the servers listed in the Servers and Detectors section.
See “Recent error and warning events list” on page 243.
■ The License section of the screen lists the Symantec Data Loss Prevention individual
products that you are licensed to use.
See “Server configuration—basic” on page 213.
See “About Symantec Data Loss Prevention administration” on page 65.

Configuring the Enforce Server to use a proxy to

connect to cloud services
To configure the Enforce Server to use a proxy to connect to cloud services, you must set up
your proxy according to the proxy manufacturer's instructions. Then you configure the Enforce
Server to support the use of the proxy. After setting up your proxy, use these instructions to
complete the setup.
To configure the Enforce Server to use a proxy to connect to a cloud service
1 Go to System > Settings > General and click Configure. The Edit General Settings
screen is displayed.
2 In the Enforce to Cloud Proxy section, select one of the following proxy categories:
■ No proxy, or transparent proxy, or
■ Manual proxy

3 If you choose Manual proxy, fields for a URL, Port, and Proxy is Authenticated appear.
■ Enter the the HTTP Proxy URL for the cloud service that you obtained from Symantec.
■ Enter a port number.
 Installing and managing detection servers and cloud detectors 241
Server and detector status overview

4 If you are using an authenticated proxy, also enter

■ a user ID
■ a password

5 Click Save.
6 Restart the Vontu Monitor Controller.

Server and detector status overview

The Servers and Detectors section of the System Overview screen is reached by System
> Servers and Detectors > Overview. This section of the screen provides a quick overview
of system status.

Table 12-4 Server and detector statuses

Icon Status Description

Starting The server is starting up.

Running The server is running normally without errors.

Running Selected Some Symantec Data Loss Prevention processes on the server are
stopped or have errors. To see the statuses of individual processes, you
must first enable Advanced Process Control on the System Settings
screen.

See “Enabling Advanced Process Control” on page 210.

Stopping The server is in the process of stopping Symantec Data Loss Prevention
services.

See “About Symantec Data Loss Prevention services” on page 85.

Stopped All Symantec Data Loss Prevention processes are stopped.

Unknown The server is experiencing one of the following errors:

■ The Enforce Server is not reachable from server.
■ Symantec Data Loss Prevention is not installed on the server.
■ A license key has not been configured for the Enforce Server.
■ There is problem with Symantec Data Loss Prevention account
permissions in Windows.
 Installing and managing detection servers and cloud detectors 242
Server and detector status overview

For each server, the following additional information appears. You can also click on any server
name to display the Server/Detector Detail screen for that server.

Table 12-5 Server and detector status additional information

Column name Description

Messages (Last 10 sec) The number of messages processed in the last 10 seconds

Messages (Today) The number of messages processed since 12 am today

Incidents (Today) The number of incidents processed since 12 am today

For Endpoint Servers, the Messages and Incidents are not aligned. This
is because messages are being processed at the Endpoint and not the
Endpoint Server. However, the incident count still increases.

Incident Queue For the Enforce Server, this is the number of incidents that are in the
database, but do not yet have an assigned status. This number is updated
whenever this screen is generated.

For the other types of servers, this is the number of incidents that have
not yet been written to the Enforce Server. This number is updated
approximately every 30 seconds. If the server is shut down, this number
is the last number updated by the server. Presumably the incidents are
still in the incidents folder.

Message Wait Time The amount of time it takes to process a message after it enters the
system. This data applies to the last message processed. If the server
that processed the last message is disconnected, this is N/A.

To see details about a server or detector

◆ Click on any server name to see additional details regarding that server.
See “Server/Detector Detail screen” on page 243.
To remove a server or detector from an Enforce Server
◆ Click the red X for that server, and then confirm your decision.

Note: Removing (de-registering) a server only disconnects it from this Enforce Server, it does
not stop the detection server from operating.

See “Removing a server” on page 237.

 Installing and managing detection servers and cloud detectors 243
Recent error and warning events list

Recent error and warning events list

The Recent Error and Warning Events section of the System > Servers and Detectors >
Overview screen shows the last five events of either error or warning severity for any of the
servers listed in the Servers and Detectors section.

Table 12-6 Recent error and warning events information

Column name Description

Type

The yellow triangle indicates a warning, the red octagon indicates an error.

Time The date and time when the event occurred.

Server The name of the server on which the event occurred.

Host The IP address or name of the machine where the server resides. The server and
host names may be the same.

Code The system event code. The Messagecolumn provides the code text. Event lists
can be filtered by code number.

Message A summary of the error or warning message that is associated with this event code.

■ To display a list of all error and warning events, click Show all.
■ To display the Event Detail screen for additional information about that particular event,
click an event.
See “About the Overview screen” on page 239.
See “System events reports” on page 150.
See “Server and Detectors event detail” on page 154.

Server/Detector Detail screen

The Server/Detector Detail screen provides detailed information about a single selected
server, detector, or appliance. The Server/Detector Detail screen is also used to control and
configure a server, detector, or appliance.
To display the Server/Detector Detail screen for a particular server or detector
1 Navigate to the System > Servers and Detectors > Overview screen.
2 Click the detection server, detector, or appliance name in the Servers and Detectors list.
 Installing and managing detection servers and cloud detectors 244
Server/Detector Detail screen

See “About the Overview screen” on page 239.

The Server/Detector Detail screen is divided into sections. The sections listed below display
all server, detector, and appliance types. The system displays sections based on the type of
detection.

Table 12-7 Server Detail screen display information

Server Detail display Description

sections

General The General section identifies the server, displays system status and statistics,
and provides controls for starting and stopping the server and its processes.

See “Server controls” on page 211.

Configuration The Configuration section displays the Channels, Policy Groups, Agent
Configuration, User Device, and Configuration Status for the detection server.

All Agents The All Agents section displays a summary of all agents that are assigned to
an Endpoint Server.

Click the number next to an agent status to view agent details on the System
> Agents > Overview > Summary Reports screen.
Note: The system only displays the Agent Summary section for an Endpoint
Server.

Recent Error and The Recent Error and Warning Events section displays the five most recent
Warning Events Warning or Severe events that have occurred on this server.

Click on an event to show event details. Click show all to display all error and
warning events.

See “About system events” on page 149.

All Recent Events The All Recent Events section displays all events of all severities that have
occurred on this server during the past 24 hours.

Click on an event to show event details. Click show all to display all detection
server events.

Deployed Exact Data The Deployed Exact Data Profile section lists any Exact Data or Document
Profiles Profiles you have deployed to the detection server. The system displays the
version of the index in the profile.

See “Data Profiles” on page 334.

See “About the Overview screen” on page 239.

See “Server configuration—basic” on page 213.
See “Server controls” on page 211.
 Installing and managing detection servers and cloud detectors 245
Advanced server settings

See “System events reports” on page 150.

See “Server and Detectors event detail” on page 154.

Advanced server settings

Click Server Settings on the detection server's System > Servers and Detectors > Overview
> Server/Detector Detail screen to modify the settings on that server.
Use caution when modifying these settings on a server. Contact Symantec Support before
changing any of the settings on this screen. Changes to these settings normally do not take
effect until after the server has been restarted.
You cannot change settings for the Enforce Server from the Server/Detector Detail screen.
The Server/Detector Detail - Advanced Settings screen only displays for detection servers
and detectors.

Note: If you change advanced server settings to Endpoint Servers in a load-balanced

environment, you must apply the same changes to all Endpoint Servers in the load-balanced
environment.

Table 12-8 Detection server advanced settings

Setting Default Description

BoxMonitor.Channels Varies The values are case-sensitive and

comma-separated if multiple.
Although any mix of them can be
configured, the following are the
officially supported configurations:

■ Network Monitor Server: Packet

Capture, Copy Rule
■ Discover Server: Network
Discover and Cloud Storage
Discover
■ Endpoint Server: Endpoint
■ Network Prevent for Email: Inline
SMTP
■ Network Prevent for Web: ICAP
 Installing and managing detection servers and cloud detectors 246
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

BoxMonitor.DetectionServerDatabase on Enables the BoxMonitor process to

start the Automated Incident
Remediation Tracking database on
the Detection Server. If you set this
to off, you must start the
remediation tracking database
manually.

BoxMonitor.DetectionServerDatabaseMemory -Xrs -Xms300M Any combination of JVM memory

-Xmx1024M flags can be used.

BoxMonitor.DiskUsageError 90 The amount of disk space filled (as

a percentage) that will trigger a
severe system event. For instance,
if Symantec Data Loss Prevention
is installed on the C drive and this
value is 90, then the detection
server creates a severe system
event when the C drive usage is
above 90%.

BoxMonitor.DiskUsageWarning 80 The amount of disk space filled (as

a percentage) that will trigger a
warning system event. For instance,
if Symantec Data Loss Prevention
is installed on the C drive and this
value is 80, then the detection
server generates a warning system
event when the C drive usage is
above 80%.

BoxMonitor.EndpointServer on Enables the Endpoint Server.

BoxMonitor.EndpointServerMemory -Xrs -Xms300M Any combination of JVM memory

-Xmx4096M flags can be used. For example:
-Xrs -Xms300m -Xmx1024m.

BoxMonitor.FileReader on If off, the BoxMonitor cannot start

the FileReader, although it can still
be started manually.
 Installing and managing detection servers and cloud detectors 247
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

BoxMonitor.FileReaderMemory -Xrs -Xms1200M FileReader JVM command-line

-Xmx4G arguments.
-XX:PermSize=128M
-XX:MaxPermSize
=256M

BoxMonitor.HeartbeatGapBeforeRestart 960000 The time interval (in milliseconds)

that the BoxMonitor waits for a
monitor process (for example,
FileReader, IncidentWriter) to report
the heartbeat. If the heartbeat is not
received within this time interval the
BoxMonitor restarts the process.

BoxMonitor.IncidentWriter on If off, the BoxMonitor cannot start

the IncidentWriter in the two-tier
mode, although it can still be started
manually. This setting has no effect
in the single-tier mode.

BoxMonitor.IncidentWriterMemory IncidentWriter JVM command-line

arguments. For example: -Xrs

BoxMonitor.InitialRestartWaitTime 5000

BoxMonitor.MaxRestartCount 3 The number of times that a process

can be restarted in one hour before
generating a SEVERE system
event.

BoxMonitor.MaxRestartCountDuringStartup 5 The maximum times that the

monitor server will attempt to restart
on its own.

BoxMonitor.PacketCapture on If off, the BoxMonitor cannot start

PacketCapture, although it can still
be started manually. The
PacketCapture channel must be
enabled for this setting to work.

BoxMonitor.PacketCaptureDirectives PacketCapture command line

parameters (in Java). For example:
-Xrs
 Installing and managing detection servers and cloud detectors 248
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

BoxMonitor.ProcessLaunchTimeout 30000 The time interval (in milliseconds)

for a monitor process (e.g.
FileReader) to start.

BoxMonitor.ProcessShutdownTimeout 45000 The time interval (in milliseconds)

allotted to each monitor process to
shut down gracefully. If the process
is still running after this time the
BoxMonitor attempts to kill the
process.

BoxMonitor.RequestProcessor on If off, the BoxMonitor cannot start

the RequestProcessor; although, it
can still be started manually. The
Inline SMTP channel must be
enabled for this setting to work.

BoxMonitor.RequestProcessorMemory Any combination of JVM memory

flags can be used. For example:
-Xrs -Xms300M -Xmx1300M

BoxMonitor.RmiConnectionTimeout 15000 The time interval (in milliseconds)

allowed to establish connection to
the RMI object.

BoxMonitor.RmiRegistryPort 37329 The TCP port on which the

BoxMonitor starts the RMI registry.

BoxMonitor.StatisticsUpdatePeriod 10000 The monitor statistics are updated

after this time interval (in
milliseconds).

ContentExtraction.DefaultCharsetForSubFileName N/A Defines the default character set

that is used in decoding the
sub-filename if the charset
conversion fails.
 Installing and managing detection servers and cloud detectors 249
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

ContentExtraction.EnableMetaData off Allows detection on file metadata.

If the setting is turned on, you can
detect metadata for Microsoft Office
and PDF files. For Microsoft Office
files, OLE metadata is supported,
which includes the fields Title,
Subject, Author, and Keywords. For
PDF files, only Document
Information Dictionary metadata is
supported, which includes fields
such as Author, Title, Subject,
Creation, and Update dates.
Extensible Metadata Platform
(XMP) content is not detected. Note
that enabling this metadata
detection option can cause false
positives.
 Installing and managing detection servers and cloud detectors 250
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

ContentExtraction.ImageExtractorEnabled 1 Allows you to adjust or turn off

content extraction for Form
Recognition.

The default setting, 1, loads the

Image Extractor plug-in on demand.
If one or more Form Recognition
rules are used, the Dynamic Image
Extractor plug-in automatically loads
on the detection server when
corresponding policy updates are
received. When Form Recognition
rules are deleted or disabled, the
plug-in automatically unloads. This
option prevents the Dynamic Image
Extractor plug-in from running if
Form Recognition is not being used.

Enter O to disable the Image

Extractor plug-in. This setting
prevents Form Recognition from
extracting images, effectively
disabling the feature.

Enter 2 if you want the Image

Extractor plug-in load when the
content extraction service launches
after the detection server starts up.
The plugin continues to run
regardless of whether form
Recognition policies have been
configured or not.

ContentExtraction.LongContentSize 1M If the message component exceeds

this size (in bytes) then the
ContentExtraction.LongTimeout is
used instead of
ContentExtraction.ShortTimeout.
 Installing and managing detection servers and cloud detectors 251
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

ContentExtraction.LongTimeout Varies The default value for this setting

varies depending on detection
server type (60,000 or 120,000).

The time interval (in milliseconds)

given to the ContentExtractor to
process a document larger than
ContentExtraction.LongContentSize.
If the document cannot be
processed within the specified time
it's reported as unprocessed. This
value should be greater than
ContentExtraction.ShortTimeout
and less than
ContentExtraction.RunawayTimeout.

ContentExtraction.MarkupAsText off Bypasses Content Extraction for

files that are determined to be XML
or HTML. This should be used in
cases such as web pages
containing data in the header block
or script blocks. Default is off.

ContentExtraction.MaxContentSize 30M The maximum size (in MB) of the

document that can be processed by
the ContentExtractor.

ContentExtraction.MaxNumImagesToExtract 10 The maximum number of images to

extract from PDF files and
multi-page TIFF documents.

ContentExtraction.RunawayTimeout 300,000 The time interval (in milliseconds)

given to the ContentExtractor to
finish processing of any document.
If the ContentExtractor does not
finish processing some document
within this time it will be considered
unstable and it will be restarted.
This value should be significantly
greater than
ContentExtraction.LongTimeout.
 Installing and managing detection servers and cloud detectors 252
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

ContentExtraction.ShortTimeout 30,000 The time interval (in milliseconds)

given to the ContentExtractor to
process a document smaller than
ContentExtraction.LongContentSize.
If the document cannot be
processed within the specified time
it is reported as unprocessed. This
value should be less than
ContentExtraction.LongTimeout.

ContentExtraction.TrackedChanges off Allows detection of content that has

changed over time (Track Changes
content) in Microsoft Office
documents.
Note: Using the foregoing option
might reduce the accuracy rate for
IDM and data identifiers. The default
is set to off (disallow).

To index content that has changed

over time, set
ContentExtraction.TrackedChanges=on
in file
\Protect\config\Indexer.properties.
The default and recommended
setting is off.
 Installing and managing detection servers and cloud detectors 253
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

DDM.MaxBinMatchSize 30,000,000 The maximum size (in bytes) used

to generate the MD5 hash for an
exact binary match in an IDM. This
setting should not be changed. The
following conditions must be
matched for IDM to work correctly:

■ This setting must be exactly

identical to the
max_bin_match_size setting on
the Enforce Server in file
indexer.properties.
■ This setting must be smaller or
equal to the
FileReader.FileMaxSize value.
■ This setting must be smaller or
equal to the
ContentExtraction.MaxContentSize
value on the Enforce Server in
file indexer.properties.

Note: Changing the first or third

item in the list requires re-indexing
all IDM files.

DDM.UseJavaMD5 false Setting this flag to true makes the

indexer/detection use the default
Java MD5. False uses a faster MD5
library. In general, this setting
should not be changed. If it is it
must match the setting in the
Indexer.properties file.

Detection.EncodingGuessingDefaultEncoding ISO-8859-1 Specifies the backup encoding

assumed for a byte stream.

Detection.EncodingGuessingEnabled on Designates whether the encoding

of unknown byte streams should be
guessed.

Detection.EncodingGuessingMinimumConfidence 50 Specifies the confidence level

required for guessing the encoding
of unknown byte streams.
 Installing and managing detection servers and cloud detectors 254
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

Detection.MessageTimeout ReportIntervalInSeconds 3600 Number of seconds between each

System Event published to display
the number of messages that have
timed out recently. These System
Events are scheduled to be
published at a fixed rate, but will be
skipped if no messages have timed
out in that period.

DI.MaxViolations 100 Specifies the maximum number of

violations allowed with data
identifiers.

Discover.CountAllFilteredItems false Provides more accurate scan

statistics by counting the items in
folders skipped because of filtering.

Setting the value to false enables

optimized Discover path filters,
which improve performance but may
occasionally lead to unexpected
filter behavior. Optimized filters
normalize slashes, truncate filter
strings before wildcard characters,
and remove trailing slashes.
Therefore, the filter string /Fol*der
will match /Folder, but it will also
match /FolXYZ.

Set this value to true to disable

optimized Discover path filters.

Discover.Exchange.FollowRedirects true Specifies whether to follow

redirects. Symantec Data Loss
Prevention follows redirects only
from the public root folder.

Discover.Exchange.ScanHiddenItems false Scan hidden items in Exchange

repositories, when set to true.

Discover.Exchange.UseSecureHttpConnections true Specifies whether connections to

Exchange repositories and Active
Directory are secure when using the
Exchange Web Services crawler.
 Installing and managing detection servers and cloud detectors 255
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

Discover.IgnorePstMessageClasses IPM.Appointment, This setting specifies a

comma-separated list of .pst
IPM.Contact,
message classes. All items in a
IPM.Task, .pst file that have a message class
in the list will be ignored (no attempt
REPORT.IPM.Note.DR,
will be made to extract the .pst
REPORT.IPM.Note.IPNRN. item). This setting is case-sensitive.

Discover.IncludePstMessageClasses IPM.Note This setting specifies a

comma-separated list of .pst
message classes. All items in a
.pst file that have a message class
in the list will be included.

When both the include setting and

the ignore setting are defined,
Discover.IncludePstMessageClasses
takes precedence.

Discover.PollInterval 10000 Specifies the time interval (in

milliseconds) at which Enforce
retrieves data from the Discover
monitor while scanning.

Discover.Sharepoint.FetchACL true Turns off ACL fetching for integrated

SharePoint scans. The default value
is true (on).

Discover.Sharepoint.SocketTimeout 60000 Sets the timeout value of the socket

connection (in milliseconds)
between the Network Discover
server and the SharePoint target.
 Installing and managing detection servers and cloud detectors 256
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

Discover.ValidateSSLCertificates false Set to true to enable validation of

the SSL certificates for the HTTPS
connections for SharePoint and
Exchange targets. When validation
is enabled, scanning SharePoint or
Exchange servers using self-signed
or untrusted certificates fails. If the
SharePoint web application or
Exchange server is signed by a
certificate issued by a certificate
authority (CA), then the server
certificate or the server CA
certificate must reside in the Java
trusted keystore used by the
Discover Server. If the certificate is
not in the keystore, you must import
it manually using the keytool
utility.

See “Importing SSL certificates to

Enforce or Discover servers”
on page 238.

EDM.HighlightAllMatchesInProximity false If false (default), the system

highlights the minimum number of
matches, starting from the leftmost.
For example, if the EDM policy is
configured to match 3 out of 8
column fields in the index, only the
first 3 matches are highlighted in the
incident snapshot.

If true, the system highlights all

matches occurring in the proximity
window, including duplicates. For
example, if the policy is configured
to match 3 of 8 and there are 7
matches occurring within the
proximity window, the system
highlights all 7 matches in the
incident snapshot.
 Installing and managing detection servers and cloud detectors 257
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

EDM.MatchCountVariant 3 Specifies how matches are counted.

■ 1 - Counts the total number of
token sets matched.
■ 2 - Counts the number of unique
token sets matched.
■ 3 - Counts the number of unique
super sets of token sets.
(default)

See “Configuring Advanced Server

Settings for EDM policies”
on page 454.

EDM.MaximumNumberOfMatchesToReturn 100 Defines a top limit on the number of

matches returned from each RAM
index search.

See “Configuring Advanced Server

Settings for EDM policies”
on page 454.

EDM.RunProximityLogic true If true, runs the token proximity

check.

See “Configuring Advanced Server

Settings for EDM policies”
on page 454.

EDM.SimpleTextProximityRadius 35 Number of tokens that are

evaluated together when the
proximity check is enabled.

See “Configuring Advanced Server

Settings for EDM policies”
on page 454.

EDM.TokenVerifierEnabled false If enabled (true), the server

validates tokens for Chinese,
Japanese, and Korean (CJK)
keywords.

Default is disabled (false).

 Installing and managing detection servers and cloud detectors 258
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

EndpointCommunications. 0 If enabled, limits the transfer rate of

AllConnInboundDataThrottleInKBPS all inbound traffic in kilobits per
second.

Default is disabled.

Changes to this setting apply to all

new connections. Changes do not
affect existing connections.

EndpointCommunications. 0 If enabled, limits the transfer rate of

AllConnOutboundDataThrottleInKBPS all outbound traffic in kilobits per
second.

Default is disabled.

Changes to this setting apply to all

new connections. Changes do not
affect existing connections.

EndpointCommunications. 60 Maximum time for server to wait for

ApplicationHandshakeTimeoutInSeconds each round trip during application
handshake communications before
closing the server-to-agent
connection.

Applies to the duration of time

between when the agent accepts
the TCP connection and when the
agent receives the handshake
message. This duration includes the
SSL handshake and the agent
receiving the HTTP headers. If the
process exceeds the specified
duration, the connection closes.

Changes to this setting apply to all

new connections. Changes do not
affect existing connections.

EndpointCommunications.MaxActiveAgentsPerServer 90000 Sets the maximum number of

agents associated with a given
server at any moment in time.

This setting is implemented after the

next Endpoint Server restart.
 Installing and managing detection servers and cloud detectors 259
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

EndpointCommunications. 150000 Sets the maximum number of

MaxActiveAgentsPerServerGroup agents that will be associated with
a given group of servers behind the
same local load balancer at any
moment in time. Used for maximum
sizes of caches for internal endpoint
features.

This setting is implemented after the

next Endpoint Server restart.

EndpointCommunications.MaxConcurrentConnections 90000 Sets the maximum number of

simultaneous connections to allow.

Changes to this setting apply to all

new connections. Changes do not
affect existing connections.

EndpointCommunications. 86400 (1 day) Sets the maximum time to allow a

MaxConnectionLifetimeInSeconds connection to remain open. Do not
set connections to remain open
indefinitely. Connections that close
ensure that SSL session keys are
frequently updated to improve
security. This timeout only applies
during the normal operation phase
of a connection, after the SSL
handshake and application
handshake phases of a connection.

This setting is implemented

immediately to all connections.

EndpointCommunications.ShutdownTimeoutInMillis 5000 (5 seconds) Sets the maximum time to wait to

gracefully close connections during
shutdown before forcing
connections to close.

This setting is implemented

immediately to all connections.
 Installing and managing detection servers and cloud detectors 260
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

EndpointCommunications.SSLCipherSuites TLS_RSA_WITH_ Lists the allowed SSL cipher suites.

AES_128_CBC_SHA Enter multiple entries, separated by
commas.

Changes to this setting apply to all

new connections. Changes do not
affect existing connections. You
must restart the Endpoint Server for
changes you make to take effect.
See “Server controls” on page 211.

If you are using FIPS 140-2 mode

for communication between the
Endpoint Server and DLP Agents,
do not use Diffie-Hellman (DH)
cipher suites. Mixing cipher suites
prevents the agent and Endpoint
Server from communicating.

EndpointCommunications. 86400 Sets the maximum SSL session

SSLSessionCacheTimeoutInSeconds entry lifetime in the SSL session
cache.

The default settings equals one day.

This setting is implemented after the
next Endpoint Server restart.

EndpointMessageStatistics.MaxFileDetectionCount 100 The maximum number of times a

valid file will be scanned. The file
must not cause an incident. After
exceeding this number, a system
event is generated recommending
that the file be filtered out.

EndpointMessageStatistics.MaxFolderDetectionCount 1800 The maximum number of times a

valid folder will be scanned. The
folder must not cause an incident.
After exceeding this number, a
system event is generated
recommending that the file be
filtered out.
 Installing and managing detection servers and cloud detectors 261
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

EndpointMessageStatistics.MaxMessageCount 2000 The maximum number of times a

valid message will be scanned. The
message must not cause an
incident. After exceeding this
number, a system event is
generated recommending that the
file be filtered out.

EndpointMessageStatistics.MaxSetSize 3 The maximum list of hosts displayed

from where valid files, folders, and
messages come. When a system
event for

EndpointMessageStatistics.

MaxFileDetectionCount,

EndpointMessageStatistics.

MaxFolderDetectionCount,

or EndpointMessageStatistics.

MaxMessageCount is generated,
Symantec Data Loss Prevention
lists the host machines where these
system events were generated. This
setting limits the number of hosts
displayed in the list.

EndpointServer.Discover.ScanStatusBatchInterval 60000 The interval of time in milliseconds

the Endpoint Server accumulates
Endpoint Discover scan statuses
before sending them to the Endpoint
Server as a batch.
 Installing and managing detection servers and cloud detectors 262
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

EndpointServer.Discover.ScanStatusBatchSize 1000 The number of scan statuses the

Aggregator accumulates before
sending them to the Enforce Server
as a batch. The Endpoint Server
forwards a batch of statuses to the
Enforce Server when the status
count reaches the configured value.

The batch is forwarded to the

Enforce Server when any of the
thresholds for the following settings
are met:

■ EndpointServer.Discover.
ScanStatusBatchInterval
■ EndpointServer.Discover.
ScanStatusBatchSize

EndpointServer.EndpointSystemEventQueueSize 20000 The maximum number of system

events that can be stored in the
endpoint agent's queue to be sent
to the Endpoint Server. If the
database connection is lost or some
other occurrence results in a
massive number of system events,
any additional system events that
occur after this number is reached
are discarded. This value can be
adjusted according to memory
requirements.

EndpointServer.MaxPercentage 60 The maximum amount (in

MemToStoreEndpointFiles percentage) of memory to use to
store shadow cache files.

EndpointServer.MaxTimeToKeepEndpointFilesOpen 20000 The time interval (in minutes) that

the endpoint file is kept open or the
file size can exceed the
EndpointServer.MaxEndpointFileSize
setting whichever occurs first.

EndpointServer.MaxTimeToWaitForWriter 1000 The maximum time (in milliseconds)

that the agent will wait to connect
to the server.
 Installing and managing detection servers and cloud detectors 263
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

EndpointServer.NoOfRecievers 15 The number of endpoint shadow

cache file receivers.

EndpointServer.NoOfWriters 10 The number of endpoint shadow

cache file writers.

FileReader.MaxFileSize 30M The maximum size (in MB) of a

message to be processed. Larger
messages are truncated to this size.
To process large files, ensure that
this value is equal to or greater than
the value of
ContentExtraction.MaxContentSize.

FileReader.MaxFileSystemCrawlerMemory 30M The maximum memory that is

allocated for the File System
Crawler. If this value is less than
FileReader.MaxFileSize, then the
greater of the two values is
assigned.

FileReader.MaxReadGap 15 The time that a child process can

have data but not have read
anything before it stops sending
heartbeats.

FileReader.ScheduledInterval 1000 The time interval (in milliseconds)

between drop folder checks by the
filereader. This affects Copy Rule,
Packet Capture, and File System
channels only.

FileReader.TempDirectory Path to a secure A secure directory on the detection

directory as specified in server in which to store temporary
the files for the File reader.
filereader.temp.io.dir
attribute in the
FileReader.properties
configuration file.

FormRecognition.ALIGNMENT_COEFFICIENT 85.00 A threshold on a scale from 0 to

100, indicating how well an image
should align with an indexed gallery
form in order to create an incident.
 Installing and managing detection servers and cloud detectors 264
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

FormRecognition.CANONICAL_FORM_WIDTH 930 The width in pixels to which all

images are internally resized for
form recognition.

FormRecognition.MAXIMUM_FORM_WIDTH 10000 The maximum width in pixels of a

query image that form recognition
detection will process. An image
having a width exceeding this value
will be filtered and ignored.

FormRecognition.MINIMUM_FORM_ASPECT_RATIO 0.3 The minimum aspect ration of a

query image that form recognition
detection will process. An image
having a lower aspect ratio will be
filtered and ignored.

FormRecognition.MINIMUM_FORM_WIDTH 400 The minimum width in pixels of a

query image that form recognition
detection will process. An image
having a width less than this value
will be filtered and ignored.

FormRecognition.OPENCV_THREADPOOL_SIZE 2 The number of threads dedicated

to the thread pool used by the form
recognition detection process. This
value should be configured to half
the number of physical cores
available on your system.

FormRecognition.PRECLASSIFIER_ACTION 1 A numeric value that determines

what types of images will be
process by form recognition
detection.

■ 0 - SKIP_ALL_PHOTOS: No
photographs will be processed
by the form recognition detection
process.
■ 1 - SKIP_DARK_PHOTOS:
Colorful photographs such as
vacations pictures will be
skipped, but photographs of
forms will be processed.
■ 2- SKIP_NONE: All photographs
will be processed.
 Installing and managing detection servers and cloud detectors 265
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

Icap.AllowHosts any The default value of "any" permits

all systems to make a connection
to the Network Prevent for Web
Server on the ICAP service port.
Replacing "any" with the IP address
or Fully-Qualified Domain Name
(FQDN) of one or more systems
restricts ICAP connections to just
those designated systems. To
designate multiple systems,
separate their IP addresses of
FQDNs by commas.

Icap.AllowStreaming false If true, ICAP output is streamed to

the proxy directly without buffering
the ICAP request first.

Icap.BindAddress 0.0.0.0 IP address to which a Network

Prevent for Web Server listener
binds. When BindAddress is
configured, the server will only
answer a connection to that IP
address. The default value of
0.0.0.0 is a wild card that permits
listening to all available addresses
including 127.0.0.1.

Icap.BufferSize 3K The size (in kilobytes) of the

memory buffer used for ICAP
request streaming and chunking.
The streaming can happen only if
the request is larger than
FileReader.MaxFileSize and the
request has a Content-Length
header.

Icap.DisableHealthCheck false If true, disables the ICAP periodic

self-check. If false, enables the
ICAP periodic self-check. This
setting is useful for debugging to
remove clutter produced by
self-check requests from the logs.
 Installing and managing detection servers and cloud detectors 266
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

Icap.EnableTrace false If set to true, protocol debug tracing

is enabled once a folder is specified
using the Icap.TraceFolder setting.

Icap.ExchangeActiveSyncCommandsToInspect SendMail A comma-separated, case-sensitive

list of ActiveSync commands which
need to be sent through Symantec
Data Loss Prevention detection. If
this parameter is left blank,
ActiveSync support is disabled. If
this parameter is set to "any", all
ActiveSync commands are
inspected.

Icap.IncidentSuppressionCacheCleanupInterval 120000 The time interval in milliseconds for

running the Incident Suppression
cache clean-up thread.

Icap.IncidentSuppressionCacheTimeout 120000 The time in miliseconds to invalidate

the Incident Suppression cache
entry.

Icap.LoadBalanceFactor 1 The number of web proxy servers

that a Network Prevent for
Webserver is able to communicate
with. For example, if the server is
configured to communicate with 3
proxies, set the
Icap.LoadBalanceFactor value to 3.

Icap.SpoolFolder This value is needed for ICAP

Spools.

Icap.TraceFolder The fully qualified name of the folder

or directory where protocol debug
trace data is stored when the
Icap.EnableTrace setting is true. By
default, the value for this setting is
left blank.
 Installing and managing detection servers and cloud detectors 267
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

IncidentDetection.IncidentLimitResetTime 86400000 Specifies the time frame (in

milliseconds) used by the

IncidentDetection.

MaxIncidentsPerPolicy

setting. The default setting

86400000 equals one day.

IncidentDetection.MaxContentLength 2000000 Applies only to regular expression

rules. On a per-component basis,
only the first MaxContentLength
number of characters are scanned
for violations. The default
(2,000,000) is equivalent to > 1000
pages of typical text. The limiter
exists to prevent regular expression
rules from taking too long.

IncidentDetection.MaxIncidentsPerPolicy 10000 Defines the maximum number of

incidents detected by a specific
policy on a particular monitor within
the time-frame specified in the

IncidentDetection.

IncidentTimeLimitResetTime.

The default is 10,000 incidents per

policy per time limit.

IncidentDetection.MessageWaitSevere 240 The number of minutes to wait

before sending a severe system
event about message wait times.

IncidentDetection.MessageWaitWarning 60 The number of minutes to wait

before sending a warning system
event about message wait times.
 Installing and managing detection servers and cloud detectors 268
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

IncidentDetection.MinNormalizedSize 30 This setting applies to IDM

detection. It MUST be kept in sync
with the corresponding setting in the
Indexer.properties file on the
Enforce Server (which applies to
indexing). Derivative detections only
apply to messages when their
normalized content is greater than
this setting. If the normalized
content size is less than this setting,
IDM detection does a straight binary
match.

IncidentDetection.patternConditionMaxViolations 100 The maximum number of matches

a detection server reports. The
detection server does not report
matches more than the value of the

IncidentDetection.

patternConditionMaxViolations

parameter, even if there are any.

IncidentDetection.StopCachingWhenMemoryLowerThan 400M Instructs Detection to stop caching

tokenized and cryptographic content
between rule executions if the
available JVM memory drops below
this value (in megabytes). Setting
this attribute to 0 enables caching
regardless of the available memory
and is not recommended because
OutOfMemoryErrors may occur.

Setting this attribute to a value close

to, or larger than, the value of the
-Xmx option in
BoxMonitor.FileReaderMemory
effectively disables the caching.

Note that setting this value too low

can have severe performance
consequences.
 Installing and managing detection servers and cloud detectors 269
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

IncidentDetection.TrialMode false Prevention trial mode setting to

generate prevention incidents
without having a prevention setup.

If true, SMTP incidents coming from

the Copy Rule and Packet Capture
channels appear as if they were
prevented and HTTP incidents
coming from Packet Capture
channel appear as if they were
prevented.

IncidentWriter.BacklogInfo 1000 The number of incidents that collect

in the log before an information level
message about the number of
messages is generated.

IncidentWriter.BacklogSevere 10000 The number of incidents that collect

in the log before a severe level
message about the number of
messages is generated.

IncidentWriter.BacklogWarning 3000 The number of incidents that collect

in the log before a warning level
message about the number of
messages is generated.

IncidentWriter.ResolveIncidentDNSNames false If true, only recipient host names

are resolved from IP.

IncidentWriter.ShouldEncryptContent true If true, the monitor will encrypt the

body of every message, message
component and cracked component
before writing to disk or sending to
Enforce.

Keyword.TokenVerifierEnabled false Default is disabled (false).

If enabled (true), the server

validates tokens for Asian language
keywords (Chinese, Japanese, and
Korean).

See “Enabling and using CJK token

verification for server keyword
matching” on page 695.
 Installing and managing detection servers and cloud detectors 270
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

L7.cleanHttpBody true If true, the HTML entity references

are replaced with spaces.

L7.DefaultBATV Standard This setting determines the tagging

scheme that Network Prevent for
Email uses to interpret Bounce
Address Tag Validation (BATV) tags
in the MAIL FROM header of a
message. If this setting is
“Standard” (the default), Network
Prevent uses the tagging scheme
described in the BATV specification:

http://tools.ietf.org/html/

draft-levine-mass-batv-02

Change this setting to “Ironport” to

enable compatibility with the
IronPort proxy’s implementation of
BATV tagging.

L7.DefaultUrlEncodedCharset UTF-8 Defines the default character set to

be used in decoding query
parameters or URL-encoded body
when the character set information
is missing from the header.

L7.discardDuplicateMessages true If true, the Monitor ignores duplicate

messages based on the
messageID.
 Installing and managing detection servers and cloud detectors 271
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

L7.ExtractBATV true If true (the default), Network Prevent

for Email interprets Bounce Address
Tag Validation (BATV) tags that are
present in the MAIL FROM header
of a message. This allows Network
Prevent to include a meaningful
sender address in incidents that are
generated from messages having
BATV tags. If this setting is false,
Network Prevent for Email does not
interpret BATV tags, and a message
that contains BATV tags may
generate an incident that has an
unreadable sender address.

See http://tools.ietf.org/html/

draft-levine-mass-batv-02 for more

information about BATV.

L7.httpClientIdHeader X-Forwarded-For The sender identifier header name.

L7.MAX_NUM_HTTP_HEADERS 30 If any HTTP message that contains

more than the specified header
lines, it is discarded.

L7.maxWordLength 30 The maximum word length (in

characters) allowed in UTCP string
extraction.

L7.messageIDCacheCleanupInterval 600000 The length of time that the

messageID is cached. The system
will not cache duplicate messages
during this time period if the
L7.discardDuplicateMessages
setting is set to true.
 Installing and managing detection servers and cloud detectors 272
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

L7.minSizeOfGetUrl 100 The minimum size of the GET URL

to process. HTTP GET actions are
not inspected by Symantec Data
Loss Prevention for policy violations
if the number of bytes in the URL is
less than the value of this setting.
For example, with the default value
of 100, no detection check is
performed when a browser displays
the Symantec web site at:
http://www.symantec.com/index.jsp.
The reason is that the URL contains
only 33 characters, which is less
than the 100 minimum.
Note: Other request types such as
POST or PUT are not affected by
L7.minSizeofGetURL. In order for
Symantec Data Loss Prevention to
inspect any GET actions at all, the
L7.processGets setting must be set
to true.

L7.processGets true If true, the GET requests are

processed. If false, the GET
requests are not processed. Note
that this setting interacts with the
L7.minSizeofGetURL setting.

Lexer.IncludePunctuation InWords true If true, punctuation characters

internal to a token are considered
during detection.

See “Configuring Advanced Server

Settings for EDM policies”
on page 454.
 Installing and managing detection servers and cloud detectors 273
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

Lexer.MaximumNumber OfTokens 12000 Maximum number of tokens

extracted from each message
component for detection. Applicable
to all detection technologies where
tokenization is required (EDM,
profiled DGM, and the system
patterns supported by those
technologies). Increasing the default
value may cause the detection
server to run out of memory and
restart.

See “Configuring Advanced Server

Settings for EDM policies”
on page 454.

Lexer.MaxTokensPerMultiToken 10 Maximum number of sub-tokens

that a multi-token cell can contain.

See “Configuring Advanced Server

Settings for EDM policies”
on page 454.

Lexer.StopwordLanguages en Enables the elimination of stop

words for the specified languages.
The default is English.

See “Configuring Advanced Server

Settings for EDM policies”
on page 454.

Lexer.Validate true If true, performs system

pattern-specific validation.

See “Configuring Advanced Server

Settings for EDM policies”
on page 454.

MessageChain.ArchiveTimedOutStreams false Specifies whether messages should

be archived to the temp folder

MessageChain.CacheSize 8 Limits the number of messages that

can be queued in the message
chains.
 Installing and managing detection servers and cloud detectors 274
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

MessageChain.ContentDumpEnabled false If set to true, each message

entering the detection message
chain is logged to
${\SymantecDLP.temp.dir\}/dump.
This setting is intended for use in
troubleshooting and debugging.

MessageChain.MaximumComponentTime 60,000 The time interval (in milliseconds)

allowed before any chain
component is restarted.

MessageChain.MaximumFailureTime 360000 Number of milliseconds that must

elapse before restarting the file
reader. This is tracked after a
message chain error is detected
and that message chain has not
been recovered.

MessageChain.MaximumMessageTime Varies This setting varies between is either

600,000 or 1,800,000 depending on
detection server type.

The maximum time interval (in

milliseconds) that a message can
remain in a message chain.

MessageChain.MemoryThrottlerReservedBytes 200,000,000 Number of bytes required to be

available before a message is sent
through the message chain. This
setting can avoid out of memory
issues. The default value is 200 MB.
The throttler can be disabled by
setting this value to 0.

MessageChain.MinimumFailureTime 30000 Number of milliseconds that must

elapse before failure of a message
chain is tracked. Failure eventually
leads to restarting the message
chain or file reader.
 Installing and managing detection servers and cloud detectors 275
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

MessageChain.NumChains Varies This number varies depending on

detection server type. It is either 4
or 8.

The number of messages, in

parallel, that the file reader will
process. Setting this number higher
than 8 (with the other default
settings) is not recommended. A
higher setting does not substantially
increase performance and there is
a much greater risk of running out
of memory. Setting this to less than
8 (in some cases 1) helps when
processing big files, but it may slow
down the system considerably.

MessageChain.StopProcessing 200M Instructs Detection to stop drilling

WhenMemoryLowerThan down into and processing sub-files
if JVM available memory drops
below this value. Setting this
attribute to 0 will force sub-file
processing, regardless of how little
memory is available. Setting this
attribute to a value close to or larger
than the value of the -Xmx option in
BoxMonitor.FileReaderMemory will
effectively disable sub-file
processing.

NetworkMonitor. NETWORK_THREAD_ 4 Specifies the number of threads that

CONCURRENCY_COUNT can read outstanding network
requests concurrently from kernal
mode to user mode. This setting
should be near or identical to the
number of CPU cores on your
computer.

NetworkMonitor.NETWORK_REQUEST_ 8 Specifies the number of network

QUEUE_COUNT read requests that can be queued.
This setting should be greater than
the value for NetworkMonitor.
NETWORK_THREAD_
CONCURRENCY_COUNT
 Installing and managing detection servers and cloud detectors 276
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

PacketCapture.DISCARD_HTTP_GET true If true, discards HTTP GET

streams.

PacketCapture.DOES_DISCARD_ false If true, a list of tcpstreams is

TRIGGER_STREAM_DUMP dumped to an output file in the log
directory the first time a discard
message is received.

PacketCapture.ENDACE_BIN_PATH To enable packet-capture using an

Endace card, enter the path to the
Endace /bin directory. Note that
environment variables (such as
%ENDACE_HOME%) cannot be used
in this setting. For example:
/usr/local/bin

PacketCapture.ENDACE_LIB_PATH To enable packet-capture using an

Endace card, enter the path to the
Endace /lib directory. Note that
environment variables (such as
%ENDACE_HOME%) cannot be used
in this setting. For example:
/usr/local/lib

PacketCapture.ENDACE_XILINX_PATH To enable packet-capture using an

Endace card, enter the path to the
Endace /xilinx directory. Note that
environment variables (such as
%ENDACE_HOME%) cannot be used
in this setting. For example:
/usr/local/dag/xilinx

PacketCapture.Filter tcp || ip proto 47 || When set to the default value all

(vlan && (tcp || ip non-TCP packets are filtered out
proto 47)) and not sent to Network Monitor.
The default value can be overridden
using the tcpdump filter format
documented in the tcpdump
program. This setting allows
specialists to create more exact
filters (source and destination IPs
for given ports).
 Installing and managing detection servers and cloud detectors 277
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

PacketCapture.INPUT_SOURCE_FILE /dummy.dmp The full path and name of the input

file.

PacketCapture.IS_ARCHIVING_PACKETS false DO NOT USE THIS FIELD.

Diagnostic setting that creates
dumps of packets captured in
packetcapture for later reuse. This
feature is unsupported and does not
have normal error checking. May
cause repeated restarts on pcap.

PacketCapture.IS_ENDACE_ENABLED false To enable packet-capture using an

Endace card, set this value to true.

PacketCapture.IS_FTP_RETR_ENABLED false If true, FTP GETS and FTP PUTS

are processed. If false, only process
FTP PUTS are processed.

PacketCapture.IS_INPUT_SOURCE_FILE false If true, continually reads in packets

from a tcpdump formatted file
indicated in INPUT_SOURCE_FILE.
Set to dag when an Endace card is
installed.

PacketCapture.IS_NAPATECH_ENABLED false To enable packet-capture using a

Napatech card, set this value to
true. The default setting is false.

PacketCapture.KERNEL_BUFFER_SIZE_I686 64M For 32-bit Linux platforms, this

setting specifies the amount of
memory allocated to buffer network
packets. Specify K for kilobytes or
M for megabytes. Do not specify a
value larger than 128M.

PacketCapture.KERNEL_BUFFER_SIZE_Win32 16M For 32-bit Windows platforms, this

setting specifies the amount of
memory allocated to buffer network
packets. Specify K for kilobytes or
M for megabytes.
 Installing and managing detection servers and cloud detectors 278
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

PacketCapture.KERNEL_BUFFER_SIZE_X64 64M For 64-bit Windows platforms, this

setting specifies the amount of
memory allocated to buffer network
packets. Specify K for kilobytes or
M for megabytes.

PacketCapture.KERNEL_BUFFER_SIZE_X86_64 64M For 64-bit Linux platforms, this

setting specifies the amount of
memory allocated to buffer network
packets. Specify K for kilobytes or
M for megabytes. Do not specify a
value larger than 64M.

PacketCapture.MAX_FILES_PER_DIRECTORY 30000 After the specified number of file

streams are processed a new
directory is created.

PacketCapture.MBYTES_LEFT_ 1000 If the amount of disk space (in MB)

TO_DISABLE_CAPTURE left on the drop_pcap drive falls
below this specification, packet
capture is suspended. For example,
if this number is 100, pcap will stop
writing out drop_pcap files when
there is less than 100 MB on the
installed drive

PacketCapture.MBYTES_REQUIRED 1500 The amount of disk space (in MB)

_TO_RESTART_CAPTURE needed on the drop_pcap drive
before packet capture resumes
again after stopping due to lack of
space. For example, if this value is
150 and packet capture is
suspended, packet capture resumes
when more than 150 MB is available
on the drop_pcap drive.

PacketCapture.NAPATECH_TOOLS_PATH This setting specifies the location of

the Napatech Tools directory. This
directory is not set by default. If
packet-capture is enabled for
Napatech, enter the fully qualified
path to the Napatech Tools
installation directory.
 Installing and managing detection servers and cloud detectors 279
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

PacketCapture.NO_TRAFFIC_ALERT_PERIOD 86,400 The refresh time (in seconds),

between no traffic alert messages.
No traffic system events are created
for a given protocol based on this
time period. For instance, if this is
set to 24*60*60 seconds, a new
message is sent every day that
there is no new traffic for a given
protocol. Do not confuse with the
per protocol traffic timeout, that tells
us how long we initially go without
traffic before sending the first alert.

PacketCapture.NUMBER_BUFFER_ POOL_PACKETS 600000 The number of standard-sized

preallocated packet buffers used to
buffer and sort incoming traffic.

PacketCapture.NUMBER_JUMBO_ POOL_PACKETS 1 The number of large-sized

preallocated packet buffers that are
used to buffer and sort incoming
traffic.

PacketCapture.NUMBER_SMALL_ POOL_PACKETS 200000 The number of small-sized

preallocated packet buffers that are
used to buffer and sort incoming
traffic.

PacketCapture.RING_CAPTURE_LENGTH 1518 Controls the amount of packet data

that is captured. The default value
of 1518 is sufficient to capture
typical Ethernet networks and
Ethernet over 802.1Q tagged
VLANs.
 Installing and managing detection servers and cloud detectors 280
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

PacketCapture.RING_DEVICE_MEM 67108864 This setting is deprecated. Instead,

use the PacketCapture.KERNEL_
BUFFER_SIZE_I686 setting (for
32-bit Linux platforms) or the
PacketCapture.KERNEL_
BUFFER_SIZE_X86_64 setting (for
64-bit Linux platforms).

Specifies the amount of memory (in

bytes) to be allocated to buffer
packets per device. (The default of
67108864 is equivalent to 64MB.)

PacketCapture.SIZE_BUFFER_POOL_PACKETS 1540 The size of standard-sized buffer

pool packets.

PacketCapture.SIZE_JUMBO_POOL_PACKETS 10000 The size of jumbo-sized buffer pool

packets.

PacketCapture.SIZE_SMALL_POOL_PACKETS 150 The size of small-sized buffer pool

packets.

PacketCapture.SPOOL_DIRECTORY The directory in which to spool

streams with large numbers of
packets. This setting is user
defined.

PacketCapture.STREAM_WRITE_TIMEOUT 5000 The time (in milliseconds) between

each count (StreamManager's write
timeout)

RequestProcessor.AddDefaultHeader true If true, adds a default header to

every email processed (when in
Inline SMTP mode). The default
header is
RequestProcessor.DefaultHeader.
This header is added to all
messages that pass through the
system, i.e., if it is redirected, if
another header is added, if the
message has no policy violations
then the header is added.
 Installing and managing detection servers and cloud detectors 281
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

RequestProcessor.AllowExtensions 8BITMIME VRFY DSN This setting lists the SMTP protocol
HELP PIPELINING extensions that Network Prevent for
SIZE Email can use when it
ENHANCEDSTATUSCODES communicates with other MTAs.
STARTTLS

RequestProcessor.AddHeaderOnMessageTimeout false The default value sets the system

to continue sending messages if
there is a message timeout.

Set to true, then the X-Header

"X-Symantec-DLP: Message timed
out (potential Enforce System event
1213)” is inserted in the email
message. The downstream edge
MTA uses this header information
to handle the message, and the log
message displays “Passed
message through due to timeout,
with added timeout header.”

RequestProcessor.AllowHosts any The default value of any permits all

systems to make connections to the
Network Prevent for Email Server
on the SMTP service port.
Replacing any with the IP address
or Fully-Qualified Domain Name
(FQDN) of one or more systems
restricts SMTP connections to just
those designated systems. To
designate multiple systems,
separate their addresses with
commas. Use only a comma to
separate addresses; do not include
any spaces between the addresses.

RequestProcessor.AllowUnauthenticatedConnections false The default value ensures that

MTAs must authenticate with
Network Prevent for Email for TLS
communication.

RequestProcessor.Backlog 12 The backlog that the request

processor specifies for the server
socket listener.
 Installing and managing detection servers and cloud detectors 282
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

RequestProcessor.BindAddress 0.0.0.0 IP address to which a Network

Prevent for Email Server listener
binds. When BindAddress is
configured, the server will only
answer a connection to that IP
address. The default value of
0.0.0.0 is a wild card that permits
listening to all available addresses
including 127.0.0.1.

RequestProcessor.BlockStatusCodeOverride 5.7.1 Enables overriding of the ESMTP

status code sent back to the
upstream MTA when executing a
block response rule.

Accepted values are 5.7.0 and

5.7.1. If any other values are
entered, this setting will fall back to
the default of 5.7.1.

Use of the 5.7.0 value (other or

undefined security status) is
preferred when the detection server
is working with Office365 email,
because the 5.7.1 value provides
an incorrect context for the
Office365 use case.

RequestProcessor.DefaultCommandTimeout 300 Specifies the number of seconds

the Network Prevent for Email
Server waits for a response to an
SMTP command before closing
connections to the upstream and
downstream MTAs. The default is
300 seconds. This setting does not
apply to the "." command (the end
of a DATA command). Do not
modify the default without first
consulting Symantec support.

RequestProcessor.CacheEnabled false Enables caching of responses for

duplicate SMTP messages. The
cache was added as part of the
cloud solution to support envelope
splitting.
 Installing and managing detection servers and cloud detectors 283
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

RequestProcessor.CacheCleanupInterval 120000 Specifies the interval after which the

cached responses are cleaned from
the cache. Units are in milliseconds.

RequestProcessor.CachedMessageTimeout 120000 Specifies the amount of time after

generation when a given cached
response can be cleared from the
cache. Units are in milliseconds.

RequestProcessor.DefaultPassHeader X-CFilter-Loop: This is the default header that will

Reflected be added if RequestProcessor.
AddDefaultPassHeader is set to
true, when in Inline SMTP mode.
Must be in a valid header format,
recommended to be an X header.

RequestProcessor.DotCommandTimeout 600 Specifies the number of seconds

the Network Prevent for Email
Server waits for a response to the
"." command (the end of a DATA
command) before closing
connections to the upstream and
downstream MTAs. The default is
600 seconds. Do not modify the
default without first consulting
Symantec support.

RequestProcessor.ForwardConnectionTimeout 20000 The timeout value to use when

forwarding to an MTA.

RequestProcessor.KeyManagementAlgorithm SunX509 The key management algorithm

used in TLS communication.

RequestProcessor.MaxLineSize 1048576 The maximum size (in bytes) of data

lines expected from an external
MTA. If the data lines are larger
than they are broken down to this
size.

RequestProcessor.Mode ESMTP Specifies the protocol mode to use

(SMTP or ESMTP).

RequestProcessor.MTAResubmitPort 10026 This is the port number used by the

request processor on the MTA to
resend the SMTP message.
 Installing and managing detection servers and cloud detectors 284
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

RequestProcessor.NumberOfDNSAttempts 4 The maximum number of DNS

queries that Network Prevent for
Email performs when it attempts to
obtain mail exchange (MX) records
for a domain. Network Prevent for
Email uses this setting only if you
have enabled MX record lookups.

RequestProcessor.RPLTimeout 360000 The maximum time in milliseconds

allowed for email message
processing by a Prevent server. Any
email messages not processed
during this time interval are passed
on by the server.

RequestProcessor.ServerSocketPort 10025 The port number to be used by the

SMTP monitor to listen for incoming
connections from MTA.

RequestProcessor.TagHighestSeverity false When set to true, an additional

email header that reports the
highest severity of all the violated
policies is added to the message.
For example, if the email violated a
policy of severity HIGH and a policy
of severity LOW, it shows:
X-DLP-MAX-Severity:HIGH.

RequestProcessor.TagPolicyCount. false When set to true an additional email

header reporting the total number
of policies that the message violates
is added to the message. For
example, if the message violates 3
policies a header reading:
X-DLP-Policy-Count: 3 is added.
 Installing and managing detection servers and cloud detectors 285
Advanced server settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

RequestProcessor.TagScore false When set to true an additional email

header reporting the total
cumulative score of all the policies
that the message violates is added
to the message. Scores are
calculated using the formula:
High=4, Medium=3, Low=2, and
Info=1. For example, if a message
violates three policies, one with a
severity of medium and two with a
severity of low a header reading:
X-DLP-Score: 7 is added.

RequestProcessor.TrustManagementAlgorithm PKIX The trust management algorithm

that Network Prevent for Email uses
when it validates certificates for TLS
communication. You can optionally
specify a built-in Java trust manager
algorithm (such as SunX509 or
SunPKIX) or a custom algorithm
that you have developed.

RequestProcessorListener.ServerSocketPort 12355 The local TCP port that FileReader

will use to listen for connections
from RequestProcessor on a
Network Prevent server.

ServerCommunicator.CONNECT_ 60 The delay time (in seconds) after

which a detection server returning
DELAY_POST_WAKEUP_
online attempts to connect to the
OR_POST_VPN_ Enforce Server. The default value
is 60 seconds. The range for this
SECONDS
setting is 30 to 600 seconds.

SocketCommunication.BufferSize 8K The size of the buffer that Network

Prevent for Web uses to process
ICAP requests. Increase the default
value only if you need to process
ICAP requests that are greater than
8K. Certain features, such as Active
Directory authentication, may
require an increas in buffer size.
 Installing and managing detection servers and cloud detectors 286
Advanced detector settings

Table 12-8 Detection server advanced settings (continued)

Setting Default Description

UnicodeNormalizer.AsianCharRanges default Can be used to override the default

definition of characters that are
considered Asian by the detection
engine. Must be either default, or a
comma-separated list of ranges, for
example: 11A80-11F9,3200-321E

UnicodeNormalizer.Enabled on Can be used to disable Unicode

normalization.

Enter off to disable.

UnicodeNormalizer.NewlineEliminationEnabled on Can be used to disable newline

elimination for Asian languages.

Enter off to disable.

See “About Symantec Data Loss Prevention administration” on page 65.

See “Advanced agent settings” on page 1804.
See “About the Overview screen” on page 239.
See “Server/Detector Detail screen” on page 243.
See “Server configuration—basic” on page 213.
See “Server controls” on page 211.

Advanced detector settings

Click Detector Settings on the detector's System > Servers and Detectors > Overview >
Server/Detector Detail screen to modify the settings on that server.
Use caution when modifying these settings on a detector. Contact Symantec Support before
changing any of the settings on this screen. Changes to these settings normally do not take
effect until after the detector has been restarted.
You cannot change settings for the Enforce Server from the Server/Detector Detail screen.
The Server/Detector Detail - Advanced Settings screen only displays for detection servers
and detectors.
 Installing and managing detection servers and cloud detectors 287
Advanced detector settings

Table 12-9 Detector advanced settings

Setting Default Description

ContentExtraction.EnableMetaData off Allows detection on file metadata. If the setting is

turned on, you can detect metadata for Microsoft
Office and PDF files. For Microsoft Office files, OLE
metadata is supported, which includes the fields
Title, Subject, Author, and Keywords. For PDF files,
only Document Information Dictionary metadata is
supported, which includes fields such as Author,
Title, Subject, Creation, and Update dates.
Extensible Metadata Platform (XMP) content is not
detected. Note that enabling this metadata detection
option can cause false positives.

ContentExtraction.MarkupAsText off Bypasses Content Extraction for files that are

determined to be XML or HTML. This should be
used in cases such as web pages containing data
in the header block or script blocks. Default is off.

ContentExtraction.TrackedChanges off Allows detection of content that has changed over

time (Track Changes content) in Microsoft Office
documents.
Note: Using the foregoing option might reduce the
accuracy rate for IDM and data identifiers. The
default is set to off (disallow).

To index content that has changed over time, set

ContentExtraction.TrackedChanges=on in file
\Protect\config\Indexer.properties. The
default and recommended setting is
ContentExtraction.TrackedChanges=off.
 Installing and managing detection servers and cloud detectors 288
Advanced detector settings

Table 12-9 Detector advanced settings (continued)

Setting Default Description

DDM.MaxBinMatchSize 30,000,000 The maximum size (in bytes) used to generate the
MD5 hash for an exact binary match in an IDM. This
setting should not be changed. The following
conditions must be matched for IDM to work
correctly:

■ This setting must be exactly identical to the

max_bin_match_size setting on the Enforce
Server in file indexer.properties.
■ This setting must be smaller or equal to the
FileReader.FileMaxSize value.
■ This setting must be smaller or equal to the
ContentExtraction.MaxContentSize value on the
Enforce Server in file indexer.properties.

Note: Changing the first or third item in the list

requires re-indexing all IDM files.

Detection.EncodingGuessingDefaultEncoding ISO-8859-1 Specifies the backup encoding assumed for a byte

stream.

Detection.EncodingGuessingEnabled on Designates whether the encoding of unknown byte

streams should be guessed.

Detection.EncodingGuessingMinimumConfidence 50 Specifies the confidence level required for guessing

the encoding of unknown byte streams.

DI.MaxViolations 100 Specifies the maximum number of violations allowed

with data identifiers.

EDM.MatchCountVariant 3 Specifies how matches are counted.

■ 1 - Counts the total number of token sets

matched.
■ 2 - Counts the number of unique token sets
matched.
■ 3 - Counts the number of unique super sets of
token sets. (default)

See “Configuring Advanced Server Settings for

EDM policies” on page 454.

EDM.MaximumNumberOfMatchesToReturn 100 Defines a top limit on the number of matches

returned from each RAM index search.

See “Configuring Advanced Server Settings for

EDM policies” on page 454.
 Installing and managing detection servers and cloud detectors 289
Advanced detector settings

Table 12-9 Detector advanced settings (continued)

Setting Default Description

EDM.SimpleTextProximityRadius 35 Number of tokens that are evaluated together when

the proximity check is enabled.

See “Configuring Advanced Server Settings for

EDM policies” on page 454.

EDM.TokenVerifierEnabled false If enabled (true), the server validates tokens for

Chinese, Japanese, and Korean (CJK) keywords.

Default is disabled (false).

IncidentDetection.MaxContentLength 2000000 Applies only to regular expression rules. On a

per-component basis, only the first
MaxContentLength number of characters are
scanned for violations. The default (2,000,000) is
equivalent to > 1000 pages of typical text. The
limiter exists to prevent regular expression rules
from taking too long.

IncidentDetection.MinNormalizedSize 30 This setting applies to IDM detection. It must be

kept in sync with the corresponding setting in the
Indexer.properties file on the Enforce Server
(which applies to indexing). Derivative detections
only apply to messages when their normalized
content is greater than this setting. If the normalized
content size is less than this setting, IDM detection
does a straight binary match.

IncidentDetection.patternConditionMaxViolations 100 The maximum number of matches a detector

reports. The detector does not report matches more
than the value of the
'IncidentDetection.patternConditionMaxViolations'
parameter, even if there are any.

Keyword.TokenVerifierEnabled false Default is disabled (false).

If enabled (true), the server validates tokens for

Asian language keywords (Chinese, Japanese, and
Korean).

See “Enabling and using CJK token verification for

server keyword matching” on page 695.
 Installing and managing detection servers and cloud detectors 290
Advanced detector settings

Table 12-9 Detector advanced settings (continued)

Setting Default Description

Lexer.IncludePunctuation InWords true If true, punctuation characters internal to a token

are considered during detection.

See “Configuring Advanced Server Settings for

EDM policies” on page 454.

Lexer.MaximumNumber OfTokens 12000 Maximum number of tokens extracted from each

message component for detection. Applicable to all
detection technologies where tokenization is
required (EDM, profiled DGM, and the system
patterns supported by those technologies).
Increasing the default value may cause the detector
to run out of memory and restart.

See “Configuring Advanced Server Settings for

EDM policies” on page 454.

Lexer.MaxTokensPerMultiToken 10 Maximum number of sub-tokens that a multi-token

cell can contain.

See “Configuring Advanced Server Settings for

EDM policies” on page 454.

Lexer.StopwordLanguages en Enables the elimination of stop words for the

specified languages. The default is English.

See “Configuring Advanced Server Settings for

EDM policies” on page 454.

Lexer.Validate true If true, performs system pattern-specific validation.

See “Configuring Advanced Server Settings for

EDM policies” on page 454.

UnicodeNormalizer.AsianCharRanges default Can be used to override the default definition of

characters that are considered Asian by the
detection engine. Must be either default, or a
comma-separated list of ranges, for example:
11A80-11F9,3200-321E

UnicodeNormalizer.Enabled on Can be used to disable Unicode normalization.

Enter off to disable.

UnicodeNormalizer.NewlineEliminationEnabled on Can be used to disable newline elimination for Asian

languages.

Enter off to disable.

 Installing and managing detection servers and cloud detectors 291
About using load balancers in an endpoint deployment

About using load balancers in an endpoint deployment

You can use a load balancer to manage multiple Endpoint Servers, or a server pool. Adding
Endpoint Servers to a load-balanced server pool enables Symantec Data Loss Prevention to
use less bandwidth while managing more agents. When setting up a server pool to manage
Endpoint Servers and agents, default Symantec Data Loss Prevention settings allow for
communication between servers and agents. However, there are a number of load balancer
settings that may affect how Endpoint Servers and agents communicate. You may have to
make changes to advanced agent and server settings if the load balancer you use does not
use default settings.
In general, load balancers should have the following settings applied to work best with Symantec
Data Loss Prevention:
■ 1-Gbps throughput
■ Source IP persistence. Set the persistence time to be greater than the agent polling period.
■ 24-hour SSL session timeout period
The Endpoint Servers communicate most efficiently with agents when the load balancer is set
up to use source IP persistence. (This protocol name may differ across load balancer brands.)
Using source IP persistence in a Symantec Data Loss Prevention implementation ensures
that if an agent is restarted on the same network, it reconnects to the same Endpoint Server
regardless of the SSL session state. Source IP persistence also uses less bandwidth during
the SSL handshake between agents and Endpoint Servers. This protocol also helps maintain
the event/attribute cache coherence.
For agents that connect to the Endpoint Server over a NAT or a proxy, SSL session server
affinity is the optimal load balancer setting. However, if this setting is used, and the agent is
restarted or if the SSL cached session identity is flushed, a new SSL session is negotiated.
Negotiating a new SSL session may cause the agent to connect to a different monitor more
frequently which may interfere with agent status updates on the Enforce Server.
You review agent connection settings if the load balancer idle connection settings is not set
to default. The load balancer idle connection setting can also be called connection timeout
interval, clean idle connection, and so-on depending on the load balancer brand.
You can assess your Symantec Data Loss Prevention and load balancer settings by considering
the following two scenarios:
■ Default DLP settings. Table 12-10
■ Non-default DLP settings. Table 12-11

Note: Contact Symantec Support before changing default advanced agent and advanced
server settings.
 Installing and managing detection servers and cloud detectors 292
About using load balancers in an endpoint deployment

Table 12-10 Default Symantec Data Loss Prevention settings scenario

Description Resolution

Starting with version 12.5, Symantec Data
Loss Prevention uses non-persistent
connections by default. Using non-persistent
connections means that Endpoint Servers
close connections to agents after agents are
idle for 30 seconds.
Consider how the agent idle timeout coincides with the load balancer
close idle connection setting. If the load balancer is configured to close
idle connections after less than 30 seconds, agents are prematurely
disconnected from Endpoint Servers.
To resolve the issue, complete one of the following:
■ Change the agent idle timeout setting (EndpointCommunications.
IDLE_TIMEOUT_IN_SECONDS.int) to less than the close idle
connection setting on the load balancer.
■ Increase the agent heartbeat setting
(EndpointCommunications.HEARTBEAT_INTERVAL_IN_SECONDS.int)
to be less than the load balancer close idle connections setting.
The user must also increase the no traffic timeout setting
(CommLayer.NO_TRAFFIC_TIMEOUT_IN_SECONDS.int) to a
value greater than the agent heartbeat setting.

Table 12-11 Non-default Symantec Data Loss Prevention settings scenario

Description Resolution

Consider how changes to default Symantec To resolve the issue, complete one of the following:
Data Loss Prevention settings affect how the
■ Change the agent heartbeat
load balancer handles idle and persistent
(EndpointCommunications.HEARTBEAT_INTERVAL_IN_SECONDS.int)
agent connections. For example, if you change
and no traffic timeout settings
the idle timeout setting to 0 to create a
(CommLayer.NO_TRAFFIC_TIMEOUT_IN_SECONDS.int) to less
persistent connection and you leave the default
than the load balancer idle connection setting.
agent heartbeat setting (270 seconds), you
■ Verify that the no traffic timeout setting is greater than the heartbeat
must consider the idle connection setting on
setting.
the load balancer. If the idle connection setting
on the load balancer is less than 270 seconds,
then agents are prematurely disconnected
from Endpoint Servers.

See “Advanced server settings” on page 245.

See “Advanced agent settings” on page 1804.
 Chapter 13
Managing log files
This chapter includes the following topics:

■ About log files

■ Log collection and configuration screen

■ Configuring server logging behavior

■ Collecting server logs and configuration files

■ About log event codes

About log files

Symantec Data Loss Prevention provides a number of different log files that record information
about the behavior of the software. Log files fall into these categories:
■ Operational log files record detailed information about the tasks the software performs and
any errors that occur while the software performs those tasks. You can use the contents
of operational log files to verify that the software functions as you expect it to. You can also
use these files to troubleshoot any problems in the way the software integrates with other
components of your system.
For example, you can use operational log files to verify that a Network Prevent for Email
Server communicates with a specific MTA on your network.
See “Operational log files” on page 294.
■ Debug log files record fine-grained technical details about the individual processes or
software components that comprise Symantec Data Loss Prevention. The contents of
debug log files are not intended for use in diagnosing system configuration errors or in
verifying expected software functionality. You do not need to examine debug log files to
administer or maintain an Symantec Data Loss Prevention installation. However, Symantec
Support may ask you to provide debug log files for further analysis when you report a
 Managing log files 294
About log files

problem. Some debug log files are not created by default. Symantec Support can explain
how to configure the software to create the file if necessary.
See “Debug log files” on page 297.
■ Installation log files record information about the Symantec Data Loss Prevention installation
tasks that are performed on a particular computer. You can use these log files to verify an
installation or troubleshoot installation errors. Installation log files reside in the following
locations:
■ installdir\SymantecDLP\.install4j\installation.log stores the installation log
for Symantec Data Loss Prevention.
■ installdir\oracle_home\admin\protect\ stores the installation log for Oracle.
See the Symantec Data Loss Prevention Installation Guide for more information.

Operational log files

The Enforce Server and the detection servers store operational log files in the
\SymantecDLP\Protect\logs\ directory on Windows installations and in the
/var/log/SymantecDLP/ directory on Linux installations. A number at the end of the log file
name indicates the count (shown as 0 in Table 13-1).
Table 13-1 lists and describes the Symantec Data Loss Prevention operational log files.

Table 13-1 Operational log files

Log file name Description Server

agentmanagement_webservices_access_0.log Logs successful and failed attempts Enforce Server

to access the Agent Management
API web service.

agentmanagement_webservices_soap_0.log Logs the entire SOAP request and Enforce Server

response for most requests to the
Agent Management API web
Service.

boxmonitor_operational_0.log The BoxMonitor process All detection servers

oversees the detection server
processes that pertain to that
particular server type.

For example, the processes that run

on Network Monitor are file reader
and packet capture.

The BoxMonitor log file is typically

very small, and it shows how the
application processes are running.
 Managing log files 295
About log files

Table 13-1 Operational log files (continued)

Log file name Description Server

detection_operational_0.log The detection operation log file All detection servers

provides details about how the
detection server configuration and
whether it is operating correctly.

detection_operational_trace_0.log
The detection trace log file provides All detection servers
details about each message that
the detection server processes. The
log file includes information such
as:

■ The policies that were applied

to the message
■ The policy rules that were
matched in the message
■ The number of incidents the
message generated.

machinelearning_training_operational_0.log This log records information about Enforce Server

the tasks, logs, and configuration
files called on startup of the VML
training process.

manager_operational_0.log. Logs information about the Enforce Server

Symantec Data Loss Prevention
manager process, which
implements the Enforce Server
administration console user
interface.

monitorcontroller_operational_0.log Records a detailed log of the Enforce Server

connections between the Enforce
Server and all detection servers. It
provides details about the
information that is exchanged
between these servers including
whether policies have been pushed
to the detection servers or not.
 Managing log files 296
About log files

Table 13-1 Operational log files (continued)

Log file name Description Server

SmtpPrevent_operational0.log This operational log file pertains to SMTP Prevent

SMTP Prevent only. It is the primary detection servers
log for tracking the health and
activity of a Network Prevent for
Email system. Examine this file for
information about the
communication between the MTAs
and the detection server.

WebPrevent_Access0.log This access log file contains ■ Network Prevent

information about the requests that for Web detection
are processed by Network Prevent servers
for Web detection servers. It is
similar to web access logs for a
proxy server.

WebPrevent_Operational0.log This operational log file reports on ■ Network Prevent

the operating condition of Network for Web detection
Prevent for Web, such as whether servers
the system is up or down and
connection management.

webservices_access_0.log This log file records successful and Enforce Server

failed attempts to access the
Incident Reporting Web Service.

webservices_soap_0.log Contains the entire SOAP request Enforce Server

and response for most requests to
the Incident Reporting API Web
Service. This log records all
requests and responses except
responses to incident binary
requests. This log file is not created
by default. See the Symantec Data
Loss Prevention Incident Reporting
API Developers Guide for more
information.

See “Network Prevent for Web operational log files and event codes” on page 310.
See “Network Prevent for Web access log files and fields” on page 311.
See “Network Prevent for Email log levels” on page 314.
See “Network Prevent for Email operational log codes” on page 314.
 Managing log files 297
About log files

See “Network Prevent for Email originated responses and codes” on page 318.

Debug log files

The Enforce Server and the detection servers store debug log files in the
\SymantecDLP\Protect\logs\ directory on Windows installations and in the
/var/log/SymantecDLP/ directory on Linux installations. A number at the end of the log file
name indicates the count (shown as 0 in debug log files).
The following table lists and describes the Symantec Data Loss Prevention debug log files.

Table 13-2 Debug log files

Log file name Description Server

Aggregator0.log This file describes communications between the Endpoint

detection server and the agents. detection
servers
Look at this log to troubleshoot the following
problems:

■ Connection to the agents

■ To find out why incidents do not appear when they
should
■ If unexpected agent events occur

BoxMonitor0.log This file is typically very small, and it shows how the All
application processes are running. The BoxMonitor detection
process oversees the detection server processes that servers
pertain to that particular server type.

For example, the processes that run on Network

Monitor are file reader and packet capture.

ContentExtractionAPI_FileReader.log Logs the behavior of the Content Extraction API file Detection
reader that sends requests to the plug-in host. The Server
default logging level is "info" which is configurable
using \Protect\config\log4cxx_config_filereader.xml.

ContentExtractionAPI_Manager.log Logs the behavior of the Content Extraction API Enforce

manager that sends requests to the plug-in host. The Server
default logging level is "info" which is configurable
using \Protect\config\log4cxx_config_manager.xml.

ContentExtractionHost_FileReader.log Logs the behavior of the Content Extraction File Detection

Reader hosts and plug-ins. The default logging level Server
is "info" which is configurable using
\Protect\config\log4cxx_config_filereader.xml.
 Managing log files 298
About log files

Table 13-2 Debug log files (continued)

Log file name Description Server

ContentExtractionHost_Manager.log Logs the behavior of the Content Extraction Manager Enforce

hosts and plug-ins. The default logging level is "info" Server
which is configurable using
\Protect\config\log4cxx_config_manager.xml.

DiscoverNative.log.0 Contains the log statements that the Network Discover

Discover/Cloud Storage Discover native code emits. detection
Currently contains the information that is related to servers
.pst scanning. This log file applies only to the
Network Discover/Cloud Storage Discover Servers
that run on Windows platforms.

FileReader0.log This log file pertains to the file reader process and All
contains application-specific logging, which may be detection
helpful in resolving issues in detection and incident servers
creation. One symptom that shows up is content
extractor timeouts.

flash_client_0.log Logs messages from the Adobe Flex client used for Enforce
folder risk reports by Network Discover. Server

flash_server_remoting_0.log Contains log messages from BlazeDS, an Enforce

open-source component that responds to remote Server
procedure calls from an Adobe Flex client. This log
indicates whether the Enforce Server has received
messages from the Flash client. At permissive log
levels (FINE, FINER, FINEST), the BlazeDS logs
contain the content of the client requests to the server
and the content of the server responses to the client

IncidentPersister0.log
This log file pertains to the Incident Persister process. Enforce
This process reads incidents from the incidents folder Server
on the Enforce Server, and writes them to the
database. Look at this log if the incident queue on
the Enforce Server (manager) grows too large. This
situation can be observed also by checking the
incidents folder on the Enforce Server to see if
incidents have backed up.
 Managing log files 299
About log files

Table 13-2 Debug log files (continued)

Log file name Description Server

Indexer0.log This log file contains information when an EDM profile Enforce
or IDM profile is indexed. It also includes the Server
information that is collected when the external indexer (or
is used. If indexing fails then this log should be computer
consulted. where
the
external
indexer
is
running)

jdbc.log This log file is a trace of JDBC calls to the database. Enforce
By default, writing to this log is turned off. Server

machinelearning_native_filereader.log
This log file records the runtime category classification Detection
(positive and negative) and associated confidence Server
levels for each message detected by a VML profile.
The default logging level is "info" which is configurable
using \Protect\config\log4cxx_config_filereader.xml.

machinelearning_training_0_0.log This log file records the design-time base accuracy Enforce
percentages for the k-fold evaluations for all VML Server
profiles.

machinelearning_training_native_manager.log This log file records the total number of features Enforce
modeled at design-time for each VML profile training Server
run. The default logging level is "info" which is
configurable using
\Protect\config\log4cxx_config_manager.xml.

MonitorController0.log This log file is a detailed log of the connections Enforce

between the Enforce Server and the detection Server
servers. It gives details around the information that
is exchanged between these servers including
whether policies have been pushed to the detection
servers or not.
 Managing log files 300
About log files

Table 13-2 Debug log files (continued)

Log file name Description Server

PacketCapture.log This log file pertains to the packet capture process Network
that reassembles packets into messages and writes Monitor
to the drop_pcap directory. Look at this log if there
is a problem with dropped packets or traffic is lower
than expected. PacketCapture is not a Java
process, so it does not follow the same logging rules
as the other Symantec Data Loss Prevention system
processes.

PacketCapture0.log This log file describes issues with PacketCapture Network

communications. Monitor

RequestProcessor0.log This log file pertains to SMTP Prevent only. The log SMTP
file is primarily for use in cases where Prevent
SmtpPrevent0.log is not sufficient. detection
servers

ScanDetail-target-0.log
Where target is the name of the scan target. All white Discover
spaces in the target's name are replaced with detection
hyphens. This log file pertains to Discover server servers
scanning. It is a file by file record of what happened
in the scan. If the scan of the file is successful, it
reads success, and then the path, size, time, owner,
and ACL information of the file scanned. If it failed,
a warning appears followed by the file name.

tomcat\localhost.date.log
These Tomcat log files contain information for any Enforce
action that involves the user interface. The logs Server
include the user interface errors from red error
message box, password failures when logging on,
and Oracle errors (ORA –#).

VontuIncidentPersister.log This log file contains minimal information: stdout Enforce

and stderr only (fatal events). Server

VontuManager.log This log file contains minimal information: stdout Enforce

and stderr only (fatal events). Server

VontuMonitor.log This log file contains minimal information: stdout All

and stderr only (fatal events). detection
servers

VontuMonitorController.log This log file contains minimal information: stdout Enforce

and stderr only (fatal events). Server
 Managing log files 301
Log collection and configuration screen

Table 13-2 Debug log files (continued)

Log file name Description Server

VontuNotifier.log This log file pertains to the Notifier service and its Enforce
communications with the Enforce Server and the Server
MonitorController service. Look at this file to
see if the MonitorController service registered
a policy change.

VontuUpdate.log This log file is populated when you update Symantec Enforce
Data Loss Prevention. Server

See “Network Prevent for Web protocol debug log files” on page 313.
See “Network Prevent for Email log levels” on page 314.

Log collection and configuration screen

Use the System > Servers and Detectors > Logs screen to collect log files or to configure
logging behavior for any Symantec Data Loss Prevention server. The Logs screen contains
two tabs that provide the following features:
■ Collection—Use this tab to collect log files and configuration files from one or more
Symantec Data Loss Prevention servers.
See “Collecting server logs and configuration files” on page 306.
■ Configuration—Use this tab to configure basic logging behavior for a Symantec Data Loss
Prevention server, or to apply a custom log configuration file to a server.
See “Configuring server logging behavior” on page 301.
See “About log files” on page 293.

Configuring server logging behavior

Use the Configuration tab of the System > Servers and Detectors > Logs screen to change
logging configuration parameters for any server in the Symantec Data Loss Prevention
deployment. The Select a Diagnostic Log Setting menu provides preconfigured settings for
Enforce Server and detection server logging parameters. You can select an available
preconfigured setting to define common log levels or to enable logging for common server
features. The Select a Diagnostic Log Setting menu also provides a default setting that
returns logging configuration parameters to the default settings used at installation time.
Table 13-3 describes the preconfigured log settings available for the Enforce Server. Table 13-4
describes the preconfigured settings available for detection servers.
 Managing log files 302
Configuring server logging behavior

Optionally, you can upload a custom log configuration file that you have created or modified
using a text editor. (Use the Collection tab to download a log configuration file that you want
to customize.) You can upload only those configuration files that modify logging properties (file
names that end with Logging.properties). When you upload a new log configuration file to
a server, the server first backs up the existing configuration file of the same name. The new
file is then copied into the configuration file directory and its properties are applied immediately.
You do not need to restart the server process for the changes to take effect, unless you are
directed to do so. As of the current software release, only changes to the
PacketCaptureNativeLogging.properties and DiscoverNativeLogging.properties files
require you to restart the server process.
See “Server controls” on page 211.
Make sure that the configuration file that you upload contains valid property definitions that
are applicable to the type of server you want to configure. If you make a mistake when uploading
a log configuration file, use the preconfigured Restore Defaults setting to revert the log
configuration to its original installed state.
The Enforce Server administration console performs only minimal validation of the log
configuration files that you upload. It ensures that:
■ Configuration file names correspond to actual logging configuration file names.
■ Root level logging is enabled in the configuration file. This configuration ensures that some
basic logging functionality is always available for a server.
■ Properties in the file that define logging levels contain only valid values (such as INFO,
FINE, or WARNING).

If the server detects a problem with any of these items, it displays an error message and
cancels the file upload.
If the Enforce Server successfully uploads a log configuration file change to a detection server,
the administration console reports that the configuration change was submitted. If the detection
server then encounters any problems when tries to apply the configuration change, it logs a
system event warning to indicate the problem.

Table 13-3 Preconfigured log settings for the Enforce Server

Select a Diagnostic Log Setting value Description

Restore Defaults Restores log file parameters to their default values.

 Managing log files 303
Configuring server logging behavior

Table 13-3 Preconfigured log settings for the Enforce Server (continued)

Select a Diagnostic Log Setting value Description

Incident Reporting API SOAP Logging
Logs the entire SOAP request and response message for
most requests to the Incident Reporting API Web Service.
The logged messages are stored in the
webservices_soap.log file. To begin logging to this
file, edit the
c:\SymantecDLP\Protect\config\ManagerLogging.properties
file to set the com.vontu.enforce.

reportingapi.webservice.log.

WebServiceSOAPLogHandler.level property to INFO.

You can use the contents of webservices_soap.log

to diagnose problems when developing Incident Reporting
API Web Service clients. See the Symantec Data Loss
PreventionIncident Reporting API Developers Guide for
more information.

Custom Attribute Lookup Logging
Logs diagnostic information each time the Enforce Server
uses a lookup plug-in to populate custom attributes for an
incident. Lookup plug-ins populate custom attribute data
using LDAP, CSV files, or other data repositories. The
diagnostic information is recorded in the Tomcat log file
(\SymantecDLP\logs\tomcat\localhost.date.log)
and the IncidentPersister_0.log file.

See “About custom attributes” on page 1416.

See “About using custom attributes” on page 1417.

Table 13-4 Preconfigured log settings for detection servers

Select a Diagnostic Log Setting Detection server uses Description

value

Restore Defaults All detection servers Restores log file parameters to their
default values.

Discover Trace Logging Network Discover Servers Enables informational logging for
Network Discover scans. These log
messages are stored in
FileReader0.log.
 Managing log files 304
Configuring server logging behavior

Table 13-4 Preconfigured log settings for detection servers (continued)

Select a Diagnostic Log Setting Detection server uses Description

value

Detection Trace Logging All detection servers Logs information about each message
that the detection server processes.
This includes information such as:

■ The policies that were applied to

the message
■ The policy rules that were matched
in the message
■ The number of incidents that the
message generated.

When you enable Detection Trace

Logging, the resulting messages are
stored in the
detection_operational_trace_0.log
file.
Note: Trace logging can produce a
large amount of data, and the data is
stored in clear text format. Use trace
logging only when you need to debug
a specific problem.

Packet Capture Debug Logging Network Monitor Servers Enables basic debug logging for
packet capture with Network Monitor.
This setting logs information in the
PacketCapture.log file.

While this type of logging can produce

a large amount of data, the Packet
Capture Debug Logging setting limits
the log file size to 50 MB and the
maximum number of log files to 10.

If you apply this log configuration

setting to a server, you must restart
the server process to enable the
change.
 Managing log files 305
Configuring server logging behavior

Table 13-4 Preconfigured log settings for detection servers (continued)

Select a Diagnostic Log Setting Detection server uses Description

value

Email Prevent Logging
Network Prevent for Email servers
Enables full message logging for
Network Prevent for Email servers.
This setting logs the complete
message content and includes
execution and error tracing
information. Logged information is
stored in the SmtpPrevent0.log file.
Note: Trace logging can produce a
large amount of data, and the data is
stored in clear text format. Use trace
logging only when you need to debug
a specific problem.

See “Network Prevent for Email

operational log codes” on page 314.

See “Network Prevent for Email

originated responses and codes”
on page 318.

ICAP Prevent Message Processing Network Prevent for Web servers Enables operational and access
Logging logging for Network Prevent for Web.
This setting logs information in the
FileReader0.log file.

See “Network Prevent for Web

operational log files and event codes”
on page 310.

See “Network Prevent for Web access

log files and fields” on page 311.

Follow this procedure to change the log configuration for a Symantec Data Loss Prevention
server.
To configure logging properties for a server
1 Click the Configuration tab if it is not already selected.
2 If you want to configure logging properties for a detection server, select the server name
from the Select a Detection Server menu.
 Managing log files 306
Collecting server logs and configuration files

3 If you want to apply preconfigured log settings to a server, select the configuration name
from the Select a Diagnostic Configuration menu next to the server you want to
configure.
See Table 13-3 and Table 13-4 for a description of the diagnostic configurations.
4 If you instead want to use a customized log configuration file, click Browse... next to the
server you want to configure. Then select the logging configuration file to use from the
File Upload dialog, and click Open. You upload only logging configuration files, and not
configuration files that affect other server features.

Note: If the Browse button is unavailable because of a previous menu selection, click
Clear Form.

5 Click Configure Logs to apply the preconfigured setting or custom log configuration file
to the selected server.
6 Check for any system event warnings that indicate a problem in applying configuration
changes on a server.
See “Log collection and configuration screen” on page 301.

Note: The following debug log files are configured manually outside of the logging framework
available through the Enforce Server administration console:
ContentExtractionAPI_FileReader.log, ContentExtractionAPI_Manager.log,
ContentExtractionHost_FileReader.log, ContentExtractionHost_Manager.log,
machinelearning_native_filereader.log, and
machinelearning_training_native_manager.log. Refer to the entry for each of these log
files in debug log file list for configuration details. See “Debug log files” on page 297.

Collecting server logs and configuration files

Use the Collection tab of the System > Servers and Detectors > Logs screen to collect log
files and configuration files from one or more Symantec Data Loss Prevention servers. You
can collect files from a single detection server or from all detection servers, as well as from
the Enforce Server computer. You can limit the collected files to only those files that were last
updated in a specified range of dates.
The Enforce Server administration console stores all log and configuration files that you collect
in a single ZIP file on the Enforce Server computer. If you retrieve files from multiple Symantec
Data Loss Prevention servers, each server's files are stored in a separate subdirectory of the
ZIP file.
 Managing log files 307
Collecting server logs and configuration files

Checkboxes on the Collection tab enable you to collect different types of files from the selected
servers. Table 13-5 describes each type of file.

Table 13-5 File types for collection

File type Description

Operational Operational log files record detailed information about the tasks the software performs and any errors
Logs that occur while the software performs those tasks. You can use the contents of operational log files
to verify that the software functions as you expect it to. You can also use these files to troubleshoot
any problems in the way the software integrates with other components of your system.

For example, you can use operational log files to verify that a Network Prevent for Email Server
communicates with a specific MTA on your network.

Debug and Debug log files record fine-grained technical details about the individual processes or software
Trace Logs components that comprise Symantec Data Loss Prevention. The contents of debug log files are not
intended for use in diagnosing system configuration errors or in verifying expected software
functionality. You do not need to examine debug log files to administer or maintain an Symantec
Data Loss Prevention installation. However, Symantec Support may ask you to provide debug log
files for further analysis when you report a problem. Some debug log files are not created by default.
Symantec Support can explain how to configure the software to create the file if necessary.

Configuration Use the Configuration Files option to retrieve both logging configuration files and server feature
Files configuration files.

Logging configuration files define the overall level of logging detail that is recorded in server log files.
Logging configuration files also determine whether specific features or subsystem events are recorded
to log files.

For example, by default the Enforce console does not log SOAP messages that are generated from
Incident Reporting API Web service clients. The ManagerLogging.properties file contains a
property that enables logging for SOAP messages.

You can modify many common logging configuration properties by using the presets that are available
on the Configuration tab.

If you want to update a logging configuration file by hand, use the Configuration Files checkbox to
download the configuration files for a server. You can modify individual logging properties using a
text editor and then use the Configuration tab to upload the modified file to the server.

See “Configuring server logging behavior” on page 301.

The Configuration Files option retrieves the active logging configuration files and also any backup
log configuration files that were created when you used the Configuration tab. This option also
retrieves server feature configuration files. Server feature configuration files affect many different
aspects of server behavior, such as the location of a syslog server or the communication settings of
the server. You can collect these configuration files to help diagnose problems or verify server settings.
However, you cannot use the Configuration tab to change server feature configuration files. You
can only use the tab to change logging configuration files.
 Managing log files 308
Collecting server logs and configuration files

Table 13-5 File types for collection (continued)

File type Description

Agent Logs Use the Agent Logs option to collect DLP agent service and operational log files from an Endpoint
Prevent detection server. This option is available only for Endpoint Prevent servers. To collect agent
logs using this option, you must have already pulled the log files from individual agents to the Endpoint
Prevent detection server using a Pull Logs action.

Use the Agent List screen to select individual agents and pull selected log files to the Endpoint
Prevent detection server. Then use the Agent Logs option on this page to collect the log files.

When the logs are pulled from the endpoint, they are stored on the Endpoint Server in an unencrypted
format. After you collect the logs from the Endpoint Server, the logs are deleted from the Endpoint
Server and are stored only on the Enforce Server. You can only collect logs from one endpoint at a
time.

See “Using the Agent List screen” on page 1865.

Operational, debug, trace log files are stored in the server_identifier/logs subdirectory
of the ZIP file. server_identifier identifies the server that generated the log files, and it
corresponds to one of the following values:
■ If you collect log files from the Enforce Server, Symantec Data Loss Prevention replaces
server_identifier with the string Enforce. Note that Symantec Data Loss Prevention does
not use the localized name of the Enforce Server.
■ If a detection server’s name includes only ASCII characters, Symantec Data Loss Prevention
uses the detection server name for the server_identifier value.
■ If a detection server’s name contains non-ASCII characters, Symantec Data Loss Prevention
uses the string DetectionServer-ID-id_number for the server_identifier value. id_number
is a unique identification number for the detection server.
If you collect agent service log files or operational log files from an Endpoint Prevent server,
the files are placed in the server_identifier/agentlogs subdirectory. Each agent log file
uses the individual agent name as the log file prefix.
Follow this procedure to collect log files and log configuration files from Symantec Data Loss
Prevention servers.
To collect log files from one or more servers
1 Click the Collection tab if it is not already selected.
2 Use the Date Range menu to select a range of dates for the files you want to collect. Note
that the collection process does not truncate downloaded log files in any way. The date
range limits collected files to those files that were last updated in the specified range.
3 To collect log files from the Enforce Server, select one or more of the checkboxes next
to the Enforce Server entry to indicate the type of files you want to collect.
 Managing log files 309
About log event codes

4 To collect log files from one or all detection servers, use the Select a Detection Server
menu to select either the name of a detection server or the Collect Logs from All
Detection Servers option. Then select one or more of the checkboxes next to the menu
to indicate the type of files you want to collect.
5 Click Collect Logs to begin the log collection process.
The administration console adds a new entry for the log collection process in the Previous
Log Collections list at the bottom of the screen. If you are retrieving many log files, you
may need to refresh the screen periodically to determine when the log collection process
has completed.

Note: You can run only one log collection process at a time.

6 To cancel an active log collection process, click Cancel next to the log collection entry.
You may need to cancel log collection if one or more servers are offline and the collection
process cannot complete. When you cancel the log collection, the ZIP file contains only
those files that were successfully collected.
7 To download collected logs to your local computer, click Download next to the log collection
entry.
8 To remove ZIP files stored on the Enforce Server, click Delete next to a log collection
entry.
See “Log collection and configuration screen” on page 301.
See “About log files” on page 293.

About log event codes

Operational log file messages are formatted to closely match industry standards for the various
protocols involved. These log messages contain event codes that describe the specific task
that the software was trying to perform when the message was recorded. Log messages are
generally formatted as:

Timestamp [Log Level] (Event Code) Event description [event parameters]

■ See “Network Prevent for Web operational log files and event codes” on page 310.
■ See “Network Prevent for Email operational log codes” on page 314.
■ See “Network Prevent for Email originated responses and codes” on page 318.
 Managing log files 310
About log event codes

Network Prevent for Web operational log files and event codes
Network Prevent for Web log file names use the format of WebPrevent_OperationalX.log
(where X is a number). The number of files that are stored and their sizes can be specified by
changing the values in the FileReaderLogging.properties file. This file is in the
SymantecDLP\Protect\config directory. By default, the values are:

■ com.vontu.icap.log.IcapOperationalLogHandler.limit = 5000000
■ com.vontu.icap.log.IcapOperationalLogHandler.count = 5
Table 13-6 lists the Network Prevent for Web-defined operational logging codes by category.
The italicized part of the text contains event parameters.

Table 13-6 Status codes for Network Prevent for Web operational logs

Code Text and Description

Operational Events

1100 Starting Network Prevent for Web

1101 Shutting down Network Prevent for Web

Connectivity Events

1200 Listening for incoming connections at

icap_bind_address:icap_bind_port

Where:

■ icap_bind_address is the Network Prevent for Web bind address to which the server listens.
This address is specified with the Icap.BindAddress Advanced Setting.
■ icap_bind_port is the port at which the server listens. This port is set in the Server >
Configure page.

1201 Connection (id=conn_id) opened from

host(icap_client_ip:icap_client_port)

Where:

■ conn_id is the connection ID that is allocated to this connection. This ID can be helpful in
doing correlations between multiple logs.
■ icap_client_ip and icap_client_port are the proxy's IP address and port from which the
connect operation to Network Prevent for Web was performed.
 Managing log files 311
About log event codes

Table 13-6 Status codes for Network Prevent for Web operational logs (continued)

Code Text and Description

1202 Connection (id=conn_id) closed (close_reason)

Where:

■ conn_id is the connection ID that is allocated to the connect operation.

■ close_reason provides the reason for closing the connection.

1203 Connection states: REQMOD=N, RESPMOD=N,

OPTIONS=N, OTHERS=N

Where N indicates the number of connections in each state, when the message was logged.

This message provides the system state in terms of connection management. It is logged
whenever a connection is opened or closed.

Connectivity Errors

5200 Failed to create listener at icap_bind_address:icap_bind_port

Where:

■ icap_bind_address is the Network Prevent for Web bind address to which the server listens.
This address can be specified with the Icap.BindAddress Advanced Setting.
■ icap_bind_port is the port at which the server listens. This port is set on the Server >
Configure page.

5201 Connection was rejected from unauthorized host (host_ip:port)

Where host_ip and port are the proxy system IP and port address from which a connect attempt
to Network Prevent for Web was performed. If the host is not listed in the Icap.AllowHosts
Advanced setting, it is unable to form a connection.

See “About log files” on page 293.

Network Prevent for Web access log files and fields

Network Prevent for Web log file names use the format of WebPrevent_AccessX.log (where
X is a number). The number of files that are stored and their sizes can be specified by changing
the values in the FileReaderLogging.properties file. By default, the values are:
■ com.vontu.icap.log.IcapAccessLogHandler.limit = 5000000
■ com.vontu.icap.log.IcapAccessLogHandler.count = 5
A Network Prevent for Web access log is similar to a proxy server’s web access log. The “start”
log message format is:
 Managing log files 312
About log event codes

# Web Prevent starting: start_time

Where start_time format is date:time, for example: 13/Aug/2008:03:11:22:015-0700.

The description message format is:

# host_ip "auth_user" time_stamp "request_line" icap_status_code

request_size "referer" "user_agent" processing_time(ms) conn_id client_ip
client_port action_code icap_method_code traffic_source_code

Table 13-7 lists the fields. The values of fields that are enclosed in quotes in this example are
quoted in an actual message. If field values cannot be determined, the message displays -
or "" as a default value.

Table 13-7 Network Prevent for Web access log fields

Fields Explanation

host_ip IP address of the host that made the request.

auth_user Authorized user for this request.

time_stamp Time that Network Prevent for Web receives the request.

request_line Line that represents the request.

icap_status_code ICAP response code that Network Prevent for Web sends by for this
request.

request_size Request size in bytes.

referrer Header value from the request that contains the URI from which this request
came.

user_agent User agent that is associated with the request.

processing_time Request processing time in milliseconds. This value is the total of the
(milliseconds) receiving, content inspection, and sending times.

conn_id Connection ID associated with the request.

client_ip IP of the ICAP client (proxy).

client_port Port of the ICAP client (proxy).

 Managing log files 313
About log event codes

Table 13-7 Network Prevent for Web access log fields (continued)

Fields Explanation

action_code An integer representing the action that Network Prevent for Web takes.
Where the action code is one of the following:

■ 0 = UNKNOWN
■ 1 = ALLOW
■ 2 = BLOCK
■ 3 = REDACT
■ 4 = ERROR
■ 5 = ALLOW_WITHOUT_INSPECTION
■ 6 = OPTIONS_RESPONSE
■ 7 = REDIRECT

icap_method_code An integer representing the ICAP method that is associated with this
request. Where the ICAP method code is one of the following:

■ -1 = ILLEGAL
■ 0 = OPTIONS
■ 1 = REQMOD
■ 2 = RESPMOD
■ 3 = LOG

traffic_source_code An integer that represents the source of the network traffic. Where the
traffic source code is one of the following:

■ 1 = WEB
■ 2 = UNKNOWN

See “About log files” on page 293.

Network Prevent for Web protocol debug log files

To enable ICAP trace logging, set the Icap.EnableTrace Advanced setting to true and use
the Icap.TraceFolder Advanced setting to specify a directory to receive the traces. Symantec
Data Loss Prevention service must be restarted for this change to take effect.
Trace files that are placed in the specified directory have file names in the format:
timestamp-conn_id. The first line of a trace file provides information about the connecting host
IP and port along with a timestamp. File data that is read from the socket is displayed in the
format <<timestamp number_of_bytes_read. Data that is written to the socket is displayed
in the format >>timestamp number_of_bytes_written. The last line should note that the
connection has been closed.
 Managing log files 314
About log event codes

Note: Trace logging produces a large amount of data and therefore requires a large amount
of free disk storage space. Trace logging should be used only for debugging an issue because
the data that is written in the file is in clear text.

See “About log files” on page 293.

Network Prevent for Email log levels

Network Prevent for Email log file names use the format of EmailPrevent_OperationalX.log
(where X is a number). The number of files that are stored and their sizes can be specified by
changing the values in the FileReaderLogging.properties file. By default, the values are:
■ com.vontu.mta.log.SmtpOperationalLogHandler.limit = 5000000
■ com.vontu.mta.log.SmtpOperationalLogHandler.count = 5
At various log levels, components in the com.vontu.mta.rp package output varying levels of
detail. The com.vontu.mta.rp.level setting specifies log levels in the
RequestProcessorLogging.properties file which is stored in the
SymantecDLP\Protect\config directory. For example, com.vontu.mta.rp.level = FINE specifies
the FINE level of detail.
Table 13-8 describes the Network Prevent for Email log levels.

Table 13-8 Network Prevent for Email log levels

Level Guidelines

INFO General events: connect and disconnect notices, information on the messages that are
processed per connection.

FINE Some additional execution tracing information.

FINER Envelope command streams, message headers, detection results.

FINEST Complete message content, deepest execution tracing, and error tracing.

See “About log files” on page 293.

Network Prevent for Email operational log codes

Table 13-9 lists the defined Network Prevent for Email operational logging codes by category.
 Managing log files 315
About log event codes

Table 13-9 Status codes for Network Prevent for Email operational log

Code Description

Core Events

1100 Starting Network Prevent for Email

1101 Shutting down Network Prevent for Email

1102 Reconnecting to FileReader (tid=id)

Where id is the thread identifier.

The RequestProcessor attempts to re-establish its connection with the FileReader for detection.

1103 Reconnected to the FileReader successfully (tid=id)

The RequestProcessor was able to re-establish its connection to the FileReader.

Core Errors

5100 Could not connect to the FileReader (tid=id timeout=.3s)

An attempt to re-connect to the FileReader failed.

5101 FileReader connection lost (tid=id)

The RequestProcessor connection to the FileReader was lost.

Connectivity Events

1200 Listening for incoming connections (local=hostname)

Hostnames is an IP address or fully-qualified domain name.

1201 Connection accepted (tid=id cid=N

local=hostname:port
remote=hostname:port)

Where N is the connection identifier.

1202 Peer disconnected (tid=id cid=N

local=hostname:port
remote=hostname:port)

1203 Forward connection established (tid=id cid=N

local=hostname:port
remote=hostname:port)
 Managing log files 316
About log event codes

Table 13-9 Status codes for Network Prevent for Email operational log (continued)

Code Description

1204 Forward connection closed (tid=id cid=N

local=hostname:port
remote=hostname:port)

1205 Service connection closed (tid=id cid=N

local=hostname:port
remote=hostname:port messages=1 time=0.14s)

Connectivity Errors

5200 Connection is rejected from the unauthorized host (tid=id

local=hostname:port
remote=hostname:port)

5201 Local connection error (tid=id cid=N

local=hostname:port
remote=hostname:port reason=Explanation)

5202 Sender connection error (tid=id cid=N

local=hostname:port
remote=hostname:port reason=Explanation)

5203 Forwarding connection error (tid=id cid=N

local=hostname:port
remote=hostname:port reason=Explanation)

5204 Peer disconnected unexpectedly (tid=id cid=N

local=hostname:port
remote=hostname:port reason=Explanation)

5205 Could not create listener (address=local=hostname:port

reason=Explanation)

5206 Authorized MTAs contains invalid hosts: hostname,

hostname, ...

5207 MTA restrictions are active, but no MTAs are authorized

to communicate with this host
 Managing log files 317
About log event codes

Table 13-9 Status codes for Network Prevent for Email operational log (continued)

Code Description

5208 TLS handshake failed (reason=Explanation tid=id cid=N

local=hostname remote=hostname)

5209 TLS handshake completed (tid=id cid=N

local=hostname remote=hostname)

5210 All forward hosts unavailable (tid=id cid=N

reason=Explanation)

5211 DNS lookup failure (tid=id cid=N

NextHop=hostname reason=Explanation)

5303 Failed to encrypt incoming message (tid=id cid=N

local=hostname remote=hostname)

5304 Failed to decrypt outgoing message (tid=id cid=N

local=hostname remote=hostname)

Message Events

1300 Message complete (cid=N message_id=3 dlp_id=message_identifier

size=number sender=email_address recipient_count=N
disposition=response estatus=statuscode rtime=N
dtime=N mtime=N

Where:

■ Recipient_count is the total number of addressees in the To, CC, and BCC fields.
■ Response is the Network Prevent for Email response which can be one of: PASS, BLOCK,
BLOCK_AND_REDIRECT, REDIRECT, MODIFY, or ERROR.
■ Thee status is an Enhanced Status code.
See “Network Prevent for Email originated responses and codes” on page 318.
■ The rtime is the time in seconds for Network Prevent for Emailto fully receive the message
from the sending MTA.
■ The dtime is the time in seconds for Network Prevent for Email to perform detection on
the message.
■ The mtime is the total time in seconds for Network Prevent for Email to process the
message Message Errors.

Message Errors
 Managing log files 318
About log event codes

Table 13-9 Status codes for Network Prevent for Email operational log (continued)

Code Description

5300 Error while processing message (cid=N message_id=header_ID

dlp_id=message_identifier size=0 sender=email_address
recipient_count=N disposition=response estatus=statuscode
rtime=N dtime=N mtime=N reason=Explanation

Where header_ID is an RFC 822 Message-Id header if one exists.

5301 Sender rejected during re-submit

5302 Recipient rejected during re-submit

See “About log files” on page 293.

Network Prevent for Email originated responses and codes

Network Prevent for Email originates the following responses. Other protocol responses are
expected as Network Prevent for Email relays command stream responses from the forwarding
MTA to the sending MTA. Table 13-10 shows the responses that occur in situations where
Network Prevent must override the receiving MTA. It also shows the situations where Network
Preventgenerates a specific response to an event that is not relayed from downstream.
“Enhanced Status” is the RFC1893 Enhanced Status Code associated with the response.

Table 13-10 Network Prevent for Email originated responses

Code Enhanced Text Description

Status

250 2.0.0 Ok: Carry on. Success code that Network Prevent for Email uses.

221 2.0.0 Service The normal connection termination code that Network Prevent
closing. for Email generates if a QUIT request is received when no
forward MTA connection is active.

451 4.3.0 Error: This “general, transient” error response is issued when a
Processing (potentially) recoverable error condition arises. This error
error. response is issued when a more specific error response is not
available. Forward connections are sometimes closed, and
their unexpected termination is occasionally a cause of a code
451, status 4.3.0. However sending connections should remain
open when such a condition arises unless the sending MTA
chooses to terminate.
 Managing log files 319
About log event codes

Table 13-10 Network Prevent for Email originated responses (continued)

Code Enhanced Text Description

Status

421 4.3.0 Fatal: This “general, terminal” error response is issued when a fatal,
Processing unrecoverable error condition arises. This error results in the
error. immediate termination of any sender or receiver connections.
Closing
connection.

421 4.4.1 Fatal: That an attempt to connect the forward MTA was refused or
Forwarding otherwise failed to establish properly.
agent
unavailable.

421 4.4.2 Fatal: Closing connection. The forwarded MTA connection is lost in
Connection a state where further conversation with the sending MTA is
lost to not possible. The loss usually occurs in the middle of message
forwarding header or body buffering. The connection is terminated
agent. immediately.

451 4.4.2 Error: The forward MTA connection was lost in a state that may be
Connection recoverable if the connection can be re-established. The
lost to sending MTA connection is maintained unless it chooses to
forwarding terminate.
agent.

421 4.4.7 Error: The last command issued did not receive a response within
Request the time window that is defined in the
timeout RequestProcessor.DefaultCommandTimeout. (The time
exceeded. window may be from RequestProcessor.DotCommandTimeout
if the command issued was the “.”). The connection is closed
immediately.

421 4.4.7 Error: The connection was idle (no commands actively awaiting
Connection response) in excess of the time window that is defined in
timeout RequestProcessor.DefaultCommandTimeout.
exceeded.
 Managing log files 320
About log event codes

Table 13-10 Network Prevent for Email originated responses (continued)

Code Enhanced Text Description

Status

501 5.5.2 Fatal: A fatal violation of the SMTP protocol (or the constraints that
Invalid are placed on it) occurred. The violation is not expected to
transmission change on a resubmitted message attempt. This message is
request. only issued in response to a single command or data line that
exceeds the boundaries that are defined in
RequestProcessor.MaxLineLength.

502 5.5.1 Error: Defined but not currently used.

Unrecognized
command.

550 5.7.1 User This combination of code and status indicates that a Blocking
Supplied. response rule has been engaged. The text that is returned is
supplied as part of the response rule definition.

Note that a 4xx code and a 4.x.x enhanced status indicate a temporary error. In such cases
the MTA can resubmit the message to the Network Prevent for Email Server. A 5xx code and
a 5.x.x enhanced status indicate a permanent error. In such cases the MTA should treat the
message as undeliverable.
See “About log files” on page 293.
 Chapter 14
Using Symantec Data Loss
Prevention utilities
This chapter includes the following topics:

■ About Symantec Data Loss Prevention utilities

■ About Endpoint utilities

■ About DBPasswordChanger

About Symantec Data Loss Prevention utilities

Symantec provides a suite of utilities to help users accomplish those tasks that need to be
done on an infrequent basis. The utilities are typically used to perform troubleshooting and
maintenance tasks. They are also used to prepare data and files for use with the Symantec
Data Loss Prevention software.
The Symantec Data Loss Prevention utilities are provided for both Windows and Linux operating
systems. You use the command line to run the utilities on both operating systems. The utilities
operate in a similar manner regardless of operating system.
Table 14-1 describes how and when to use each utility.

Table 14-1 Symantec Data Loss Prevention utilities

Name Description

DBPasswordChanger Changes the encrypted password that the Enforce Server uses to connect to the Oracle
database.

See “About DBPasswordChanger” on page 323.

 Using Symantec Data Loss Prevention utilities 322
About Endpoint utilities

Table 14-1 Symantec Data Loss Prevention utilities (continued)

Name Description

sslkeytool Generates custom authentication keys to improve the security of the data that is transmitted
between the Enforce Server and detection servers. The custom authentication keys must be
copied to each Symantec Data Loss Prevention server.

See the topic "About the sslkeytool utility and server certificates" in the Symantec Data Loss
Prevention Installation Guide.

SQL Preindexer Indexes an SQL database or runs an SQL query on specific data tables within the database.
This utility is designed to pipe its output directly to the Remote EDM Indexer utility.

See “About the SQL Preindexer” on page 484.

Remote EDM Indexer Converts a comma-separated or tab-delimited data file into an exact data matching index.
The utility can be run on a remote machine to provide the same indexing functionality that is
available locally on the Enforce Server.

This utility is often used with the SQL Preindexer. The SQL Preindexer can run an SQL query
and pass the resulting data directly to the Remote EDM Indexer to create an EDM index.

See “About the Remote EDM Indexer” on page 484.

About Endpoint utilities

Table 14-2 describes those utilities that apply to the Endpoint products.
See “About agent password management”on page 1923 on page 1923.

Table 14-2 Endpoint utilities

Name Description

Service_Shutdown.exe This utility enables an administrator to turn off both the agent and the watchdog services on
an endpoint. (As a tamper-proofing measure, it is not possible for a user to stop either the
agent or the watchdog service.)

See “Shutting down the agent and the watchdog services on Windows endpoints” on page 1926.

Vontu_sqlite3.exe This utility provides an SQL interface that enables you to view or modify the encrypted
database files that the Symantec DLP Agent uses. Use this tool when you want to investigate
or make changes to the Symantec Data Loss Prevention files.

See “Inspecting the database files accessed by the agent” on page 1927.

Logdump.exe This tool lets you view the Symantec DLP Agent extended log files, which are hidden for
security reasons.

See “Viewing extended log files” on page 1928.

 Using Symantec Data Loss Prevention utilities 323
About DBPasswordChanger

Table 14-2 Endpoint utilities (continued)

Name Description

Start_agent This utility enables an administrator to start agents running on Mac endpoints that have been
shut down using the shutdown task.

See “Starting DLP Agents that run on Mac endpoints” on page 1933.

About DBPasswordChanger
Symantec Data Loss Prevention stores encrypted passwords to the Oracle database in a file
that is called DatabasePassword.properties, located in c:\SymantecDLP\Protect\config
(Windows) or/opt/SymantecDLP/Protect/config (Linux). Because the contents of the file
are encrypted, you cannot directly modify the file. The DBPasswordChanger utility changes
the stored Oracle database passwords that the Enforce Server uses.
Before you can use DBPasswordChanger to change the password to the Oracle database
you must:
■ Shut down the Enforce Server.
■ Change the Oracle database password using Oracle utilities.
See “Example of using DBPasswordChanger” on page 324.

DBPasswordChanger syntax
The DBPasswordChanger utility uses the following syntax:

DBPasswordChanger password_file new_oracle_password

All command-line parameters are required. The following table describes each command-line
parameter.
See “Example of using DBPasswordChanger” on page 324.

Table 14-3 DBPasswordChanger command-line parameters

Parameter Description

password_file Specifies the file that contains the encrypted password. By

default, this file is named DatabasePassword.properties
and is stored in \SymantecDLP\Protect\config (Windows)
or /opt/SymantecDLP/Protect/config (Linux).

new_oracle_password Specifies the new Oracle password to encrypt and store.

 Using Symantec Data Loss Prevention utilities 324
About DBPasswordChanger

Example of using DBPasswordChanger

If Symantec Data Loss Prevention was installed in the default location, then the
DBPasswordChanger utility is located at c:\SymantecDLP\Protect\bin (Windows) or
/opt/SymantecDLP/Protect/bin (Linux). You must be an Administrator (or root) to run
DBPasswordChanger.
For example, type:

DBPasswordChanger \SymantecDLP\Protect\bin\DatabasePassword.properties
protect_oracle

See “DBPasswordChanger syntax” on page 323.

 Section 4
Authoring policies

■ Chapter 15. Introduction to policies

■ Chapter 16. Overview of policy detection

■ Chapter 17. Creating policies from templates

■ Chapter 18. Configuring policies

■ Chapter 19. Administering policies

■ Chapter 20. Best practices for authoring policies

■ Chapter 21. Detecting content using Exact Data Matching (EDM)

■ Chapter 22. Detecting content using Indexed Document Matching (IDM)

■ Chapter 23. Detecting content using Vector Machine Learning (VML)

■ Chapter 24. Detecting content using Form Recognition - Sensitive Image Recognition

■ Chapter 25. Detecting Content using OCR - Sensitive Image Recognition

■ Chapter 26. Detecting content using data identifiers

■ Chapter 27. Detecting content using keyword matching

■ Chapter 28. Detecting content using regular expressions

■ Chapter 29. Detecting international language content

 Authoring policies 326

■ Chapter 30. Detecting file properties

■ Chapter 31. Detecting network incidents

■ Chapter 32. Detecting endpoint events

■ Chapter 33. Detecting described identities

■ Chapter 34. Detecting synchronized identities

■ Chapter 35. Detecting profiled identities

■ Chapter 36. Supported file formats for detection

■ Chapter 37. Library of system data identifiers

■ Chapter 38. Library of policy templates

 Chapter 15
Introduction to policies
This chapter includes the following topics:

■ About Data Loss Prevention policies

■ Policy components

■ Policy templates

■ Solution packs

■ Policy groups

■ Policy deployment

■ Policy severity

■ Policy authoring privileges

■ Data Profiles

■ User Groups

■ Policy template import and export

■ Workflow for implementing policies

■ Viewing, printing, and downloading policy details

About Data Loss Prevention policies

You implement policies to detect and prevent data loss. A Symantec Data Loss Prevention
policy combines detection rules and response actions. If a policy rule is violated, the system
generates an incident that you can report and act on. The policy rules you implement are
based on your information security objectives. The actions you take in response to policy
 Introduction to policies 328
About Data Loss Prevention policies

violations are based on your compliance requirements. The Enforce Server administration
console provides an intuitive, centralized, Web-based interface for authoring policies.
See “Workflow for implementing policies” on page 337.
Table 15-1 describes the policy authoring features provided by Symantec Data Loss Prevention.

Table 15-1 Policy authoring features

Feature Description

Intuitive policy The policy builder interface supports Boolean logic for detection configuration.
building
You can combine different detection methods and technologies in a single policy.

See “Detecting data loss” on page 340.

See “Best practices for authoring policies” on page 412.

Decoupled The system stores response rules and policies as separate entities.
response rules
You can manage and update response rules without having to change policies; you can reuse
response rules across policies.

See “About response rules” on page 1199.

Fine-grained policy The system provides severity levels for policy violations.
reporting
You can report the overall severity of a policy violation by the highest severity.

See “Policy severity” on page 333.

Centralized data The system stores data and group profiles separate from policies.
and group profiling
This separation enables you to manage and update profiles without changing policies.

See “Data Profiles” on page 334.

See “User Groups” on page 335.

Template-based The system provides 65 pre-built policy templates.

policy detection
You can use these templates to quickly configure and deploy policies.

See “Policy templates” on page 330.

Policy sharing The system supports policy template import and export.

You can share policy templates across environments and systems.

See “Policy template import and export” on page 336.

Role-based access The system provides role-based access control for various user and administrative functions.
control
You can create roles for policy authoring, policy administration, and response rule authoring.

See “Policy authoring privileges” on page 334.

 Introduction to policies 329
Policy components

Policy components
A valid policy has at least one detection or group rule with at least one match condition.
Response rules are optional policy components.
Policy components describes Data Loss Prevention policy components.

Table 15-2 Policy components

Component Use Description

Policy group Required A policy must be assigned to a single Policy Group.

See “Policy groups” on page 331.

Policy name Required The policy name must be unique within the Policy Group

See “Manage and add policies” on page 395.

Policy rule Required A valid policy must contain at least one rule that declares at least one
match condition.

See “Policy matching conditions” on page 349.

Data Profile May be Exact Data Matching (EDM), Indexed Document Matching (IDM), Vector
required Machine Learning (VML), and Form Recognition policies all require data
profiles.

See “Data Profiles” on page 334.

User group May be A policy requires a User Group only if a group method in the policy
required requires it.

Synchronized DGM rules and exceptions require a User Group.

See “User Groups” on page 335.

Policy description Optional A policy description helps users identify the purpose of the policy.

See “Configuring policies” on page 376.

Policy label Optional A policy label helps Veritas Data Insight business users identify the
purpose of the policy when using the Self-Service Portal.

See “Configuring policies” on page 376.

Response Rule Optional A policy can implement one or more response rules to report and
remediate incidents.

See “About response rules” on page 1199.

Policy exception Optional A policy can contain one or more exceptions to exclude data from
matching.

See “Exception conditions” on page 355.

 Introduction to policies 330
Policy templates

Table 15-2 Policy components (continued)

Component Use Description

Compound match Optional A policy rule or exception can implement multiple match conditions.
conditions
See “Compound conditions” on page 356.

Policy templates
Symantec Data Loss Prevention provides policy templates to help you quickly deploy detection
policies in your enterprise. You can share policies across systems and environments by
importing and exporting policy rules and exceptions as templates.
Using policy templates saves you time and helps you avoid errors and information gaps in
your policies because the detection methods are predefined. You can edit a template to create
a policy that precisely suits your needs. You can also export and import your own policy
templates.
Some policy templates are based on well-known sets of regulations, such as the Payment
Card Industry Security Standard, Gramm-Leach-Bliley, California SB1386, and HIPAA. Other
policy templates are more generic, such as Customer Data Protection, Employee Data
Protection, and Encrypted Data. Although the regulation-based templates can help address
the requirements of the relevant regulations, consult with your legal counsel to verify compliance.
See “Creating a policy from a template” on page 360.
Table 15-3 describes the system-defined policy templates provided by Symantec Data Loss
Prevention.

Table 15-3 System-defined policy templates

Policy template type Description

US Regulatory Enforcement See “US Regulatory Enforcement policy templates” on page 363.

General Data Protection Regulation See “General Data Protection Regulation policy templates” on page 365.

International Regulatory Enforcement See “International Regulatory Enforcement policy templates” on page 366.

Customer and Employee Data Protection See “Customer and Employee Data Protection policy templates”
on page 366.

Confidential or Classified Data Protection See “Confidential or Classified Data Protection policy templates”
on page 368.

Network Security Enforcement See “Network Security Enforcement policy templates” on page 369.

Acceptable Use Enforcement See “Acceptable Use Enforcement policy templates” on page 369.
 Introduction to policies 331
Solution packs

Table 15-3 System-defined policy templates (continued)

Policy template type Description

Imported Templates See “Policy template import and export” on page 336.

Solution packs
Symantec Data Loss Prevention provides solution packs for several industry verticals. A
solution pack contains configured policies, response rules, user roles, reports, protocols, and
the incident statuses that support a particular industry or organization. For a list of available
solution packs and instructions, refer to chapter 4, "Importing a solution pack" in the Symantec
Data Loss Prevention Installation Guide. You can import one solution pack to the Enforce
Server.
Once you have imported the solution pack, start by reviewing its policies. By default the solution
pack activates the policies it provides.
See “Manage and add policies” on page 395.

Policy groups
You deploy policies to detection servers using policy groups. Policy groups limit the policies,
incidents, and detection mechanisms that are accessible to specific users.
Each policy belongs to one policy group. When you configure a policy, you assign it to a policy
group. You can change the policy group assignment, but you cannot assign a policy to more
than one policy group. You deploy policy groups to one or more detection servers.
The Enforce Server is configured with a single policy group called the Default Policy Group.
The system deploys the default policy group to all detection servers. If you define a new policy,
the system assigns the policy to the default policy group, unless you create and specify a
different policy group. You can change the name of the default policy group. A solution pack
creates several policy groups and assigns policies to them.
After you create a policy group, you can link policies, Discover targets, and roles to the policy
group. When you create a Discover target, you must associate it with a single policy group.
When you associate a role with particular policy groups, you can restrict users in that role.
Policies in that policy group detect incidents and report them to users in the role that is assigned
to that policy group.
The relationship between policy groups and detection servers depends on the server type.
You can deploy a policy group to one or more Network Monitor, Network Prevent, or Endpoint
Servers. Policy groups that you deploy to an Endpoint Server apply to any DLP Agent that is
registered with that server. The Enforce Server automatically associates all policy groups with
all Network Discover Servers.
 Introduction to policies 332
Policy deployment

For Network Monitor and Network Prevent, each policy group is assigned to one or more
Network Monitor Servers, Network Prevent for Email Servers, or Network Prevent for Web
Servers. For Network Discover, policy groups are assigned to individual Discover targets. A
single detection server may handle as many policy groups as necessary to scan its targets.
For Endpoint Monitor, policy groups are assigned to the Endpoint Server and apply to all
registered DLP Agents.
See “Manage and add policy groups” on page 398.
See “Creating and modifying policy groups” on page 399.

Policy deployment
You can use policy groups to organize and deploy your policies in different ways. For example,
consider a situation in which your detection servers are set up across a system that spans
several countries. You can use policy groups to ensure that a detection server runs only the
policies that are valid for a specific location.
You can dedicate some of your detection servers to monitor internal network traffic and dedicate
others to monitor network exit points. You can use policy groups to deploy less restrictive
policies to servers that monitor internal traffic. At the same time, you can deploy stricter policies
to servers that monitor traffic leaving your network.
You can use policy groups to organize policies and incidents by business units, departments,
geographic regions, or any other organizational unit. For example, policy groups for specific
departments may be appropriate where security responsibilities are distributed among various
groups. In such cases, policy groups provide for role-based access control over the viewing
and editing of incidents. You deploy policy groups according to the required division of access
rights within your organization (for example, by business unit).
You can use policy groups for detection-server allocation, which may be more common where
security departments are centralized. In these cases, you would carefully choose the detection
server allocation for each role and reflect the server name in the policy group name. For
example, you might name the groups Inbound and Outbound, United States and International,
or Testing and Production.
In more complex environments, you might consider some combination of the following policy
groups for deploying policies:
■ Sales and Marketing - US
■ Sales and Marketing - Europe
■ Sales and Marketing - Asia
■ Sales and Marketing - Australia, New Zealand
■ Human Resources - US
 Introduction to policies 333
Policy severity

■ Human Resources - International

■ Research and Development
■ Customer service
Lastly, you can use policy groups to test policies before deploying them in production, to
manage legacy policies, and to import and export policy templates.
See “Policy groups” on page 331.
See “About role-based access control” on page 93.

Policy severity
When you configure a detection rule, you can select a policy severity level. You can then use
response rules to take action based on a severity level. For example, you can configure a
response rule to take action after a specified number of "High" severity violations.
See “About response rule conditions” on page 1210.
The default severity level is set to "High," unless you change it. The default severity level
applies to any condition that the detection rule matches. For example, if the default severity
level is set to "High," every detection rule violation is labeled with this severity level. If you do
not want to tag every violation with a specific severity, you can define the criteria by which a
severity level is established. In this case the default behavior is overridden. For example, you
can define the "High" severity level to be applied only after a specified number of condition
matches have occurred.
See “Defining rule severity” on page 383.
In addition, you can define multiple severity levels to layer severity reporting. For example,
you can set the "High" severity level after 100 matches, and the medium severity level to apply
after 50 matches.

Table 15-4 Rule severity levels

Rule severity level Description

High If a condition match occurs, it is labeled "High" severity.

Medium If a condition match occurs, it is labeled "Medium" severity.

Low If a condition match occurs, it is labeled "Low" severity.

Info If a condition match occurs, it is labeled "Info" severity.

 Introduction to policies 334
Policy authoring privileges

Policy authoring privileges

Policy authors configure and manage policies and their rules and exceptions. To author policies,
a user must be assigned to a role that grants the policy authoring privilege. This role can be
expanded to include management of policy groups, scanning targets, and credentials.
Response rule authoring privileges are separate credentials from policy authoring and
administration privileges. Whether or not policy authors have response rule authoring privileges
is based on your enterprise needs.
Table 15-5 describes the typical privileges for the policy and response rule authoring roles.

Table 15-5 Policy authoring privileges

Role privilege Description

Author Policies Add, configure, and manage policies.

Add, configure, and manage policy rules and exceptions.

Import and export policy templates.

Modify system-defined data identifiers and create custom data identifiers.

Add, configure, and manage User Groups.

Add response rules to policies (but do not create response rules).

See “About role-based access control” on page 93.

Enforce Server Add, configure, and manage policy groups.

Administration
Add, configure, and manage Data Profiles.

See “Configuring roles” on page 98.

Author Response Add, configure, and manage response rules (but do not add them to policies).
Rules
See “About response rule authoring privileges” on page 1215.

Data Profiles
Data Profiles are user-defined configurations that you create to implement Exact Data Matching
(EDM), Indexed Document Matching (IDM), Form Recognition, and Vector Machine Learning
(VML) policy conditions.
See “Data Loss Prevention policy detection technologies” on page 347.
Table 15-6 describes the types of Data Profiles that the system supports.
 Introduction to policies 335
User Groups

Table 15-6 Types of Data Profiles

Data Profile type Description

Exact Data Profile An Exact Data Profile is used for Exact Data Matching (EDM) policies. The Exact Data Profile
contains data that has been indexed from a structured data source, such as a database,
directory server, or CSV file. The Exact Data Profile runs on the detection server. If an EDM
policy is deployed to an endpoint, the DLP Agent sends the message to the detection server
for evaluation (two-tier detection).

See “About the Exact Data Profile and index” on page 426.

See “Introducing profiled Directory Group Matching (DGM)” on page 754.

See “About two-tier detection for EDM on the endpoint” on page 431.

Indexed Document An Indexed Document Profile is used for Indexed Document Matching (IDM) policies. The
Profile Indexed Document Profile contains data that has been indexed from a collection of confidential
documents. The Indexed Document Profile runs on the detection server. If an IDM policy is
deployed to an endpoint, the DLP Agent sends the message to the detection server for
evaluation (two-tier detection).

See “About the Indexed Document Profile” on page 515.

Vector Machine A Vector Machine Learning Profile is used for Vector Machine Learning (VML) policies. The
Learning Profile Vector Machine Learning Profile contains a statistical model of the features (keywords)
extracted from content that you want to protect. The VML profile is loaded into memory by
the detection server and DLP Agent. VML does not require two-tier detection.

See “About the Vector Machine Learning Profile” on page 565.

See “About the Vector Machine Learning Profile” on page 565.

Form Recognition A Form Recognition Profile is used for Form Recognition policies. The Form Recognition
Profile Profile contains blank images of forms you want to detect.

When you configure a profile, yoo specify a numeric value to represent the Fill Threshold.
This number is a value from 1-10. 1 represents a form that has been filled out minimally and
10 a form that is completely filled in. If the Fill Threshold is met or exceeded, an incident is
opened.

See “Managing Form Recognition profiles” on page 600.

User Groups
You define User Groups on the Enforce Server. User Groups contain user identity information
that you populate by synchronizing the Enforce Server with a group directory server (Microsoft
Active Directory).
You must have at least policy authoring or server administrator privileges to define User Groups.
You must define the User Groups before you synchronize users.
 Introduction to policies 336
Policy template import and export

Once you define a User Group, you populate it with users, groups, and business units from
your directory server. After the user group is populated, you associate it with the User/Sender
and Recipient detection rules or exceptions. The policy only applies to members of that User
Group.
See “Introducing synchronized Directory Group Matching (DGM)” on page 747.
See “Configuring directory server connections” on page 141.
See “Configuring User Groups” on page 748.

Policy template import and export

You can export and import policy templates to and from the Enforce Server. This feature lets
you share policy templates across environments, version existing policies, and archive legacy
policies.
Consider a scenario where you author and refine a policy on a test system and then export
the policy as a template. You then import this policy template to a production system for
deployment to one or more detection servers. Or, if you want to retire a policy, you export it
as a template for archiving, then remove it from the system.
See “Importing policy templates” on page 404.
See “Exporting policy detection as a template” on page 405.
A policy template is an XML file. The template contains the policy metadata, and the detection
and the group rules and exceptions. If a policy template contains more than one condition that
requires a Data Profile, the system imports only one of these conditions. A policy template
does not include policy response rules, or modified or custom data identifiers.
Table 15-7 describes policy template components.

Table 15-7 Components included in policy templates

Policy component Description Included in

Template

Policy metadata (name, The name of the template has to be less than 60 characters or YES
description, label) it does not appear in the Imported Templates list.

Described Content Matching If the template contains only DCM methods, it imports as YES
(DCM) rules and exceptions exported without changes.

Exact Data Matching (EDM) If the template contains multiple EDM or IDM match conditions, YES
and Indexed Document only one is exported.
Matching (IDM) conditions
If the template contains an EDM and an IDM condition, the
system drops the IDM.
 Introduction to policies 337
Workflow for implementing policies

Table 15-7 Components included in policy templates (continued)

Policy component Description Included in

Template

User Group User group methods are maintained on import only if the user NO
groups exist on the target before import.

Policy Group Policy groups do not export. On import you can select a local NO
policy group, otherwise the system assigns the policy to the
Default Policy group.

Response Rules You must define and add response rules to policies from the NO
local Enforce Server instance.

Data Profiles On import you must reference a locally defined Data Profile, NO
otherwise the system drops any methods that require a Data
Profile.

Custom data identifiers Modified and custom data identifiers do not export. NO

Custom protocols Custom protocols do not export. NO

Policy state Policy state (Active/Suspended) does not export. NO

Workflow for implementing policies

Policies define the content, event context, and identities you want to detect. Policies may also
define response rule actions if a policy is violated. Successful policy creation is a process that
requires careful analysis and proper configuration to achieve optimum results.
Table 15-8 describes the typical workflow for implementing Data Loss Prevention policies.

Table 15-8 Policy implementation process

Action Description

Familiarize yourself with the different types of detection See “Detecting data loss” on page 340.
technologies and methods that Symantec Data Loss
See “Data Loss Prevention policy detection technologies”
Prevention provides, and considerations for authoring
on page 347.
data loss prevention policies.
See “Policy matching conditions” on page 349.

See “Best practices for authoring policies” on page 412.

Develop a policy detection strategy that defines the type See “Develop a policy strategy that supports your data
of data you want to protect from data loss. security objectives” on page 414.
 Introduction to policies 338
Viewing, printing, and downloading policy details

Table 15-8 Policy implementation process (continued)

Action Description

Review the policy templates that ship with Symantec See “Policy templates” on page 330.
Data Loss Prevention, and any templates that you import
See “Solution packs” on page 331.
manually or by solution pack.

Create policy groups to control how your policies are See “Policy groups” on page 331.
accessed, edited, and deployed.
See “Policy deployment” on page 332.

To detect exact data or content or similar unstructured See “Data Profiles” on page 334.
data, create one or more Data Profiles.

To detect exact identities from a synchronized directory See “User Groups” on page 335.
server (Active Directory), configure one or more User
Groups.

Configure conditions for detection and group rules and See “Creating a policy from a template” on page 360.
exceptions.

Test and tune your policies. See “Test and tune policies to improve match accuracy”
on page 416.

Add response rules to the policy to take action when See “About response rules” on page 1199.
the policy is violated.

Manage the policies in your enterprise. See “Manage and add policies” on page 395.

Viewing, printing, and downloading policy details

You may be required to share high-level details about your policies with individuals who are
not Symantec Data Loss Prevention users. For example, you might be asked to provide policy
details to an information security officer in your company, or to and outside security auditor.
To facilitate such an action, you can view and print policy details in an easily readable format
from the Policy List screen. The policy detail view does not include any technical nomenclature
or branding specific to Symantec Data Loss Prevention. It displays the policy name, description,
label, group, status, version, and last modified date for the policy. It also displays the detection
and the response rules for that policy.
Any user with the Author Policies privilege for a given policy or set of policies can view and
print policy details.
See “Policy authoring privileges” on page 334.
Table 15-9 describes how to work with policy details.
 Introduction to policies 339
Viewing, printing, and downloading policy details

Table 15-9 Working with policy details

Action Description

View and print details for a single policy. See “Viewing and printing policy details”
on page 407.

Download details for all policies. See “Downloading policy details” on page 407.
 Chapter 16
Overview of policy detection
This chapter includes the following topics:

■ Detecting data loss

■ Detecting Symantec Information Centric Tagging (ICT) classifications

■ Data Loss Prevention policy detection technologies

■ Policy matching conditions

■ Detection messages and message components

■ Exception conditions

■ Compound conditions

■ Policy detection execution

■ Two-tier detection for DLP Agents

Detecting data loss

Symantec Data Loss Prevention detects data from virtually any type of message or file, any
user, sender, or recipient, wherever your data or endpoints exist. You can use Data Loss
Prevention to detect both the content and the context of data within your enterprise. You define
and manage your detection policies from the centralized, Web-based Enforce Server
administration console.
See “Content that can be detected” on page 341.
See “Files that can be detected” on page 341.
See “Protocols that can be monitored” on page 341.
See “Endpoint events that can be detected” on page 342.
See “Identities that can be detected” on page 342.
 Overview of policy detection 341
Detecting data loss

See “Languages that can be detected” on page 342.

Content that can be detected

Symantec Data Loss Prevention detects data and document content, including text, markup,
presentations, spreadsheets, archive files and their contents, email messages, database files,
designs and graphics, multimedia files, image-based forms and more. For example, the system
can open a compressed file and scan a Microsoft Word document within the compressed file
for the keyword "confidential." If the keyword is matched, the detection engine flags the message
as an incident.
Content-based detection is based on actual content, not the file itself. A detection server can
detect extracts or derivatives of protected or described content. This content may include
sections of documents that have been copied and pasted to other documents or emails. A
detection server can also identify sensitive data in a different file format than the source file.
For example, if a confidential Word file is fingerprinted, the detection engine can match the
content emailed in a PDF attachment.
See “Content matching conditions” on page 350.

Files that can be detected

Symantec Data Loss Prevention recognizes many types of files and attachments based on
their context, including file type, file name, and file size. Symantec Data Loss Prevention
identifies over 300 types of files, including word-processing formats, multimedia files,
spreadsheets, presentations, pictures, encapsulation formats, encryption formats, and others.
For file type detection, the system does not rely on the file extension to identify the file type.
For example, the system recognizes a Microsoft Word file even if a user changes the file
extension to .txt. In this case the detection engine checks the binary signature of the file to
match its type.
See “File property matching conditions” on page 351.

Protocols that can be monitored

Symantec Data Loss Prevention detects messages on the network by identifying the protocol
signature: email (SMTP), Web (HTTP), file transfer (FTP), newsgroups (NNTP), TCP, Telnet,
and SSL.
You can configure a detection server to listen on non-default ports for data loss violations. For
example, if your network transmits Web traffic on port 81 instead of port 80, the system still
recognizes the transmitted content as HTTP.
See “Protocol matching condition for network” on page 352.
 Overview of policy detection 342
Detecting Symantec Information Centric Tagging (ICT) classifications

Endpoint events that can be detected

Symantec Data Loss Prevention lets you detect data loss violations at several endpoint
destinations. These destinations include the local drive, CD/DVD drive, removable storage
devices, network file shares, Windows Clipboard, printers and faxes, and application files. You
can also detect protocol events on the endpoint for email (SMTP), Web (HTTP), and file transfer
(FTP) traffic.
For example, the DLP Agent (installed on each endpoint computer) can detect the copying of
a confidential file to a USB device. Or, the DLP Agent can allow the copying of files only to a
specific class of USB device that meets corporate encryption requirements.
See “Endpoint matching conditions” on page 352.

Identities that can be detected

Symantec Data Loss Prevention lets you detect the identity of data users, message senders,
and message recipients using a variety of methods. These methods include described identity
patterns and exact identities matched from a directory server or a corporate database.
For example, you can detect email messages sent by a specific user, or allow email messages
sent to or from a specific group of users as defined in your Microsoft Active Directory server.
See “Groups (identity) matching conditions” on page 353.

Languages that can be detected

Symantec Data Loss Prevention provides broad international support for detecting data loss
in many languages. Supported languages include most Western and Central European
languages, Hebrew, Arabic, Chinese (simplified and traditional), Japanese, Korean, and more.
The detection engine uses Unicode internally. You can build localized policy rules and
exceptions using any detection technology in any supported language.
See “Supported languages for detection” on page 75.
See “Detecting non-English language content” on page 706.

Detecting Symantec Information Centric Tagging (ICT)

classifications
Symantec Data Loss Prevention 15.0 supports the integration of Symantec Information Centric
Tagging 14.6 classifications.
 Overview of policy detection 343
Detecting Symantec Information Centric Tagging (ICT) classifications

About Symantec Information Centric Tagging

Symantec Information Centric Tagging (ICT) is a system that allows an enterprise to define a
data classification and labeling policy. Data classifications are comprised of tags that are
created with a three-part hierarchy: Company-Scope-Level. The administrator assigns an
acronym to each part. An example of a tag is: SYM-MKT-CONFID. The tags are tied to security
rules and user roles. An additional method of identifying data classifications is to define
watermarks.
Users apply these tags and watermarks to unstructured data--files and emails--labelling them
as they work. The classifications identify which data can be shared freely, which data require
special consideration, and so on.

About integrating Information Centric Tagging with Data Loss

Prevention
Integrating user-driven Information Centric Tagging with policy-driven Data Loss Prevention
enhances the protection that both approaches provide.
The integration of Information Centric Tagging for Data Loss Prevention 15.0 is manual. Once
an administrator defines classifications in Information Centric Tagging, the resulting tags and
watermarks are ready to be entered into Data Loss Prevention.
The Data Loss Prevention administrator enters the tag acronyms and watermarks text into
Data Loss Prevention detection rules. Scans find the tags and watermarks that match either
keywords or regular expressions. The detection rules containing the Information Centric Tagging
data can be added to policies that contain policy-driven criteria or exist on separate policies.
Response rules can be added as appropriate.
The addition of Information Centric Tagging tags and watermarks into Data Loss Prevention
does not require any special use of Data Loss Prevention features. The only prerequisite to
using the tagged-based rules is to change a system setting on the detection server and Endpoint
Agents. That setting enables the detection of metadata, where the tags reside. Data Loss
Prevention scans for tags when it reads files. Data Loss Prevention scans for watermarks
when it reads emails.
For supported file types and email version:
See “Integrating Symantec Information Centric Tagging with Data Loss Prevention” on page 344.
 Overview of policy detection 344
Detecting Symantec Information Centric Tagging (ICT) classifications

Integrating Symantec Information Centric Tagging with Data Loss

Prevention
Summary of Information Centric Tagging-Data Loss Prevention
integration steps
The Information Centric Tagging-Data Loss Prevention integration steps
1 Pre-requisite: The Information Centric Tagging administrator defines a data classification
system with a set of tags and watermarks.
2 Pre-requisite: Users tag information (files and emails) as they work.

Note: Use of the classification system takes place independently of any integration with
Data Loss Prevention.

3 The Data Loss Prevention administrator changes a system setting on detection servers
and Endpoint Agents to enable metadata detection.
4 The Data Loss Prevention administrator types the tags and watermarks into detection
rules and attaches the rules to policies.
5 When Data Loss Prevention runs, it reads the tags and watermarks and takes any defined
response actions.

How to integrate Information Centric Tagging with Data Loss Prevention

The table describes each step of the Information Centric Tagging-Data Loss Prevention
integration process.

Table 16-1 Information Centric Tagging-Data Loss Prevention integration steps

Actor/Tool/Action Notes

Information Centric Tagging pre-requisite actions:

1 Actor: ICT administrator Requirements:

Tool: Information Centric Tagging Administration ■ Information Centric Tagging 14.6 or greater
Console ■ Data Loss Prevention 15.0 or greater
Action: Define the tagging classifications at three Both systems require administrator access.
levels (Company/Scope/Level). Add any
watermarks.

Complete the classification system by applying

security rules and user roles.

Reference: Information Centric Tagging

Administration Console User Guide, v 14.6
 Overview of policy detection 345
Detecting Symantec Information Centric Tagging (ICT) classifications

Table 16-1 Information Centric Tagging-Data Loss Prevention integration steps (continued)

Actor/Tool/Action Notes

2 Actor: End users Users have classification privileges.

Tools: Information Centric Tagging plug-ins for
Microsoft Office applications or a Windows
Explorer context menu

Action: Apply the tags and/or watermarks to files

and emails as part of daily work.

Reference: Information Centric Tagging User

Guide v 14.6

Data Loss Prevention integration actions:

■ Actor: Data Loss Prevention administrator

■ Enforce Server Administration console
■ Reference: The linked instructions are in this Data Loss Prevention Administration Guide v 15.0

3 Action: To detect tags on the server, change the If you are detecting only watermarks, this step
system setting on every detection server to is not necessary.
enable detection of metadata, where the tags
reside. Restart each changed server.

See “Enabling server metadata detection”

on page 787.

4 Action: To detect tags on the Endpoint Agents, If you are detecting only watermarks, this step
change the system setting on each Endpoint is not necessary.
Agent group to enable detection of metadata,
where the tags reside.

See “Enabling endpoint metadata detection”

on page 787.

To complete the action, for each changed

Endpoint Agent group, select Update
Configuration to propagate the system setting
change. When an endpoint reconnects to the
server, the new configuration is active.

See “Viewing and managing agent groups”

on page 1856.
 Overview of policy detection 346
Detecting Symantec Information Centric Tagging (ICT) classifications

Table 16-1 Information Centric Tagging-Data Loss Prevention integration steps (continued)

Actor/Tool/Action Notes

5 Action: Choose the most useful detection
(search) method(s) and enter the tags and
watermarks into detection rules.
See “Configuring the Content Matches Keyword
condition” on page 692.
See “Configuring the Content Matches Regular
Expression condition” on page 702.
Guidance for Keyword matching:
■ For each tag, enter the acronyms
concatenated, separated by hyphens.
Example: "SYM-ENG-SECRET"
If you are doing a more generic search, you
do not need to enter all three levels.
■ For email watermarks, enter the syntax as
created in Information Centric Tagging.
Example: "Symantec-Confidential"
Search on either the Subject or Body.

6 Action: Add the detection rules to policies. Add None

response rules, if desired.

7 Action: Run Data Loss Prevention.
Note: All detection channels are supported, both
on-prem and in-cloud.
Supported file formats and email version:
■ Data Loss Prevention reads tags in these file
formats only:
■ Microsoft Office binary format (pre-2008,
DOC, PPT, XLS)
■ XML format (2008-forward, DOCX, PPTX,
XLSX)
■ PDF files
■ Exception: Files that were encrypted in
Information Centric Tagging using RMS
or Ionic are not read.
■ Data Loss Prevention detects watermarks
(but not tags) in Office 365 emails.

Best practices for the ICT-DLP integration

As you integrate Information Centric Tagging with Data Loss Prevention, keep in mind these
best practices:
■ Have the same administrator configure both the Information Centric Tagging classifications
and the Data Loss Prevention rules and policies.
■ As the Information Centric Tagging classification tags are defined, write down the
company-scope-level acronyms. Then, use that list for data entry of the tag acronyms into
Data Loss Prevention rules.
■ Over time, as you edit or add Information Centric Tagging classifications, be sure to review
the classifications already entered into Data Loss Prevention. Confirm that both sets of
 Overview of policy detection 347
Data Loss Prevention policy detection technologies

classifications still match. Since this integration is manual, changes to one system do not
propagate to the other system.
■ Consider the relative importance of level. Do you need to enter into a detection rule the
tags for the documents that are classified as "PUBLIC"?

Troubleshooting the ICT-DLP integration

If Data Loss Prevention scans have not discovered any Information Centric Tagging tagged
documents, consider possible causes:
■ The metadata detection flag is not enabled for the Enforce detection server.
■ The metadata detection flag is not enabled for the Agent Group.
■ The documents are not tagged.
To confirm that a document is tagged, you can try the instructions in the table. A tag appears
as a name-value pair; a watermark uses a text string format.

Table 16-2 How to view Information Centric Tagging tags and watermarks in documents

Document type Viewing an ICT tag

Microsoft Office document (pre-2008) View the document properties:

■ Select File->Properties

Adobe PDF file View the file properties:

1 Open the file in Adobe Reader or Adobe

Acrobat.

2 Select File->Properties->Custom

Note: The tag value that is displayed in PDF files

is a B64 encoded string. To confirm the value of
the string, you can copy and paste it into the
Enforce decoder.

See “Best practices for using metadata detection” on page 788.

Data Loss Prevention policy detection technologies

Symantec Data Loss Prevention provides several types of detection technologies to help you
author policies to detect data loss. Each type of detection technology provides unique
capabilities. Often you combine technologies in policies to achieve precise detection results.
In addition, Symantec Data Loss Prevention provides you with several ways to extend policy
detection and match any type of data, content, or files you want.
 Overview of policy detection 348
Data Loss Prevention policy detection technologies

See “About Data Loss Prevention policies” on page 327.

See “Best practices for authoring policies” on page 412.
Table 16-3 lists the various types of the detection technologies and customizations provided
by Data Loss Prevention.

Table 16-3 Data Loss Prevention detection technologies

Technology Description

Exact Data Matching (EDM) Use EDM to detect personally identifiable information.

See “Introducing Exact Data Matching (EDM)” on page 422.

Indexed Document Matching Use IDM to detect exact files and file contents, and derivative content.
(IDM)
See “Introducing Indexed Document Matching (IDM)” on page 512.

Vector Machine Learning Use VML to detect similar document content.

(VML)
See “Introducing Vector Machine Learning (VML)” on page 564.

Form Recognition Use Form Recognition to detect images of forms that belong to a gallery associated
with a Form Recognition policy.

See “About Form Recognition detection” on page 595.

Directory Group Matching Use DGM to detect exact identities synchronized from a directory server or profiled
(DGM) from a database.

See “Introducing synchronized Directory Group Matching (DGM)” on page 747.

See “Introducing profiled Directory Group Matching (DGM)” on page 754.

Described Content Matching Use DCM to detect message content and context, including:
(DCM)
■ Data Identifiers to match content using precise patterns and data validators.
See “Introducing data identifiers” on page 612.
■ Keywords to detect content using key words, key phrases, and keyword dictionaries.
See “Introducing keyword matching” on page 686.
■ Regular Expressions to detect characters, patterns, and strings.
See “Introducing regular expression matching” on page 700.
■ File properties to detect files by type, name, size, and custom type.
See “Introducing file property detection” on page 711.
■ User, sender, and recipient patterns to detect described identities.
See “Introducing described identity matching” on page 737.
■ Protocol signatures to detect network traffic.
See “Introducing protocol monitoring for network” on page 723.
■ Destinations, devices, and protocols to detect endpoint events.
See “Introducing endpoint event detection” on page 727.
 Overview of policy detection 349
Policy matching conditions

Table 16-3 Data Loss Prevention detection technologies (continued)

Technology Description

Custom policy detection Data Loss Prevention provides methods for customizing and extending detection,
methods including:

■ Custom Data Identifiers

Implement your own data identifier patterns and system-defined validators.
See “Introducing data identifiers” on page 612.
■ Custom script validators for Data Identifiers
Use the Symantec Data Loss Prevention Scripting Language to validate custom
data types.
See “Workflow for creating custom data identifiers” on page 666.
■ Custom file type identification
Use the Symantec Data Loss Prevention Scripting Language to detect custom file
types.
See “About custom file type identification” on page 712.
■ Custom endpoint device detection
Detect or allow any endpoint device using regular expressions.
See “About endpoint device detection” on page 729.
■ Custom network protocol detection
Define custom TCP ports to tap.
See “Introducing protocol monitoring for network” on page 723.
■ Custom content extraction
Use a plug-in to identify custom file formats and extract file contents for analysis
by the detection server.
See “Overview of detection file format support” on page 759.

Policy matching conditions

Symantec Data Loss Prevention provides several types of match conditions, each offering
unique detection capabilities. You implement match conditions in policies as rules or exceptions.
Detection rules use conditions to match message content or context. Group rules use conditions
to match identities. You can also use conditions as detection and group policy exceptions.
See “Exception conditions” on page 355.
Table 16-4 lists the various types of policy matching conditions provided by Data Loss
Prevention.

Table 16-4 Policy match condition types

Condition type Description

Content See “Content matching conditions” on page 350.

 Overview of policy detection 350
Policy matching conditions

Table 16-4 Policy match condition types (continued)

Condition type Description

File property See “File property matching conditions” on page 351.

Protocol See “Protocol matching condition for network” on page 352.

Endpoint See “Endpoint matching conditions” on page 352.

Groups (identity) See “Groups (identity) matching conditions” on page 353.

Content matching conditions

Symantec Data Loss Prevention provides several conditions to match message content. Certain
content conditions require an associated Data Profile and index. For content detection, you
can match on individual message components, including header, body, attachments, and
subject for some conditions.
See “Detection messages and message components” on page 354.
See “Content that can be detected” on page 341.
Table 16-5 lists the content matching conditions that you can use without a Data Profile and
index.

Table 16-5 Content matching conditions

Content rule type Description

Content Matches Regular Match described content using regular expressions.

Expression
See “Introducing regular expression matching” on page 700.

See “Configuring the Content Matches Regular Expression condition” on page 702.

Content Matches Keyword Match described content using keywords, key phrases, and keyword dictionaries

See “Introducing keyword matching” on page 686.

See “Configuring the Content Matches Keyword condition” on page 692.

Content Matches Data Match described content using Data Identifier patterns and validators.
Identifier
See “Introducing data identifiers” on page 612.

See “Configuring the Content Matches data identifier condition” on page 628.

Table 16-6 lists the content matching conditions that require a Data Profile and index.
See “Data Profiles” on page 334.
See “Two-tier detection for DLP Agents” on page 358.
 Overview of policy detection 351
Policy matching conditions

Table 16-6 Index-based content matching conditions

Content rule type Description

Content Matches Exact Data Match exact data profiled from a structured data source such as a database or CSV
From an Exact Data Profile file.
(EDM)
See “Introducing Exact Data Matching (EDM)” on page 422.

See “Configuring the Content Matches Exact Data policy condition” on page 448.
Note: This condition requires two-tier detection on the endpoint. See “About two-tier
detection for EDM on the endpoint” on page 431.

Content Matches Document
Signature From an Indexed
Document Profile (IDM)
Match files and file contents exactly or partially using fingerprinting
See “Introducing Indexed Document Matching (IDM)” on page 512.
See “Configuring the Content Matches Document Signature policy condition”
on page 545.
Note: This condition requires two-tier detection on the endpoint. See “About the
Indexed Document Profile” on page 515.

Detect using Vector Machine Match file contents with features similar to example content you have trained.
Learning profile (VML)
See “Introducing Vector Machine Learning (VML)” on page 564.

See “Configuring the Detect using Vector Machine Learning Profile condition”
on page 579.

File property matching conditions

Symantec Data Loss Prevention provides several conditions to match file properties, including
file type, file size, and file name.
See “Files that can be detected” on page 341.

Table 16-7 File property match conditions

Condition type Description

Message Attachment or File Match specific file formats and document attachments.
Type Match
See “About file type matching” on page 711.

See “Configuring the Message Attachment or File Type Match condition” on page 715.

Message Attachment or File Match files or attachments over or under a specified size.
Size Match
See “About file size matching” on page 713.

See “Configuring the Message Attachment or File Size Match condition” on page 716.
 Overview of policy detection 352
Policy matching conditions

Table 16-7 File property match conditions (continued)

Condition type Description

Message Attachment or File Match files or attachments that have a specific name or match wildcards.
Name Match
See “About file name matching” on page 714.

See “Configuring the Message Attachment or File Name Match condition”

on page 717.

Message/Email Properties and Classify Microsoft Exchange email messages based on specific message attributes
Attributes (MAPI attributes).

Custom File Type Signature Match custom file types based on their binary signature using scripting.

See “About custom file type identification” on page 712.

See “Enabling the Custom File Type Signature condition in the policy console”
on page 719.

Protocol matching condition for network

Symantec Data Loss Prevention provides the single Protocol Monitoring condition to match
network traffic for policy detection rules and exceptions.
See “Protocols that can be monitored” on page 341.

Table 16-8 Protocol matching condition for network monitoring

Match condition Description

Protocol Monitoring Match incidents on the network transmitted using a specified protocol, including
SMTP, FTP, HTTP/S, IM, and NNTP.

See “Introducing protocol monitoring for network” on page 723.

See “Configuring the Protocol Monitoring condition for network detection” on page 724.

Endpoint matching conditions

Symantec Data Loss Prevention provides several conditions for matching endpoint events.
See “Endpoint events that can be detected” on page 342.
 Overview of policy detection 353
Policy matching conditions

Table 16-9 Endpoint matching conditions

Condition Description

Protocol or Endpoint Match endpoint messages transmitted using a specified transport protocol or when
Monitoring data is moved or copied to a particular destination.

See “Introducing endpoint event detection” on page 727.

See “Configuring the Endpoint Monitoring condition” on page 730.

Endpoint Device Class or ID Match endpoint events occurring on specified hardware devices.

See “Introducing endpoint event detection” on page 727.

See “Configuring the Endpoint Device Class or ID condition” on page 733.

Endpoint Location Match endpoint events depending if the DLP Agent is on or off the corporate network.

See “Introducing endpoint event detection” on page 727.

See “Configuring the Endpoint Location condition” on page 732.

Groups (identity) matching conditions

Symantec Data Loss Prevention provides several conditions for matching the identity of users
and groups, and message senders and recipients.
The sender and recipient pattern rules are reusable across policies. The Directory Group
Matching (DGM) rules let you match on sender and recipients derived from Active Directory
(synchronized DGM) or from an Exact Data Profile (profiled DGM).
See “Identities that can be detected” on page 342.
See “Two-tier detection for DLP Agents” on page 358.

Table 16-10 Available group rules for identity matching

Group rule Description

Sender/User Matches Pattern Match message senders and users by email address, user ID, IM screen name,
and IP address.

See “Introducing described identity matching” on page 737.

See “Configuring the Sender/User Matches Pattern condition” on page 739.

Recipient Matches Pattern Match message recipients by email or IP address, or Web domain.

See “Introducing described identity matching” on page 737.

See “Configuring the Recipient Matches Pattern condition” on page 742.

 Overview of policy detection 354
Detection messages and message components

Table 16-10 Available group rules for identity matching (continued)

Group rule Description

Sender/User based on a Match message senders and users from a synchronized directory server.
Directory Server Group
See “Introducing synchronized Directory Group Matching (DGM)” on page 747.

See “Configuring the Sender/User based on a Directory Server Group condition”

on page 751.

Sender/User based on a
Directory from: an Exact Data
Profile
Match message senders and users from a profiled directory server.
See “Introducing profiled Directory Group Matching (DGM)” on page 754.
See “Configuring the Sender/User based on a Profiled Directory condition”
on page 756.
Note: This condition requires two-tier detection on the endpoint. See “About two-tier
detection for profiled DGM” on page 754.

Recipient based on a Directory Match message recipients from a synchronized directory server.
Server Group
See “Introducing synchronized Directory Group Matching (DGM)” on page 747.

See “Configuring the Recipient based on a Directory Server Group condition”

on page 752.
Note: This condition requires two-tier detection on the endpoint. See “About two-tier
detection for synchronized DGM” on page 748.

Recipient based on a Directory Match message recipients from a profiled directory server.
from: an Exact Data Profile
See “Configuring Exact Data profiles for DGM” on page 755.
See “Configuring the Recipient based on a Profiled Directory condition” on page 757.
Note: This condition requires two-tier detection on the endpoint. See “About two-tier
detection for profiled DGM” on page 754.

Detection messages and message components

Data Loss Prevention detection servers and DLP Agents receive input data for analysis in the
form of messages. The system determines the message type; for example, an email or a Word
document. Depending on the message type, the system either parses the message content
into components (header, subject, body, attachments), or it leaves the message intact. The
system evaluates the message or message components to see if any policy match conditions
apply. If a condition applies and it supports component matching, the system evaluates the
content against each selected message component. If the condition does not support component
matching, the system evaluates the entire message against the match condition.
See “Selecting components to match on” on page 386.
 Overview of policy detection 355
Exception conditions

The content-based conditions support cross-component matching. You can configure the DCM
content conditions to match across all message components. The EDM condition matches on
message envelope, body, and attachments. The document conditions match on the message
body and attachments, except File Type and Name which only match on the attachment.
Protocol, endpoint, and identity conditions match on the entire message, as does any condition
evaluated by the DLP Agent. The subject component only applies to SMTP email or NNTP
messages.
Table 16-11 summarizes the component matching supported by each match condition type.

Table 16-11 Message components to match on

Condition type Envelope Subject Body Attachment(s)

Described content (DCM) match match match match

conditions for content detection:

Keyword, Data Identifier, Regular

Expression

Exact Data Matching (EDM) match match match

Indexed Document Matching match match

(IDM)

Vector Machine Learning (VML) match match

Form Recognition match

File Size (DCM) match match

File Type and File Name (DCM) match

Protocol (DCM) match (entire message)

Endpoint (DCM) match (entire message)

Identity (DCM and DGM) match (entire message)

Any condition evaluated by the match (entire message)

DLP Agent

Exception conditions
Symantec Data Loss Prevention provides policy exceptions to exclude messages and message
components from matching. You can use exception conditions to refine the scope of your
detection and group rules.
See “Use a limited number of exceptions to narrow detection scope” on page 418.
 Overview of policy detection 356
Compound conditions

Warning: Do not use multiple compound exceptions in a single policy. Doing so can cause
detection to run out of memory. If you find that the policy needs multiple compound exceptions
to produce matches, you should reconsider the design of the matching conditions.

The system evaluates an inbound message or message component against policy exceptions
before policy rules. If the exception supports cross-component matching (content-based
exceptions), the exception can be configured to match on individual message components.
Otherwise, the exception matches on the entire message.
If an exception is met, the system ejects the entire message or message component containing
the content that triggered the exception. The ejected message or message component is no
longer available for evaluation against policy rules. The system does not discard only the
matched content or data item; it discards the entire message or message component that
contained the excepted item.

Note: Symantec Data Loss Prevention does not support match-level exceptions, only component
or message-level exceptions.

For example, consider a policy that has a detection rule with one condition and an exception
with one condition. The rule matches messages containing Microsoft Word attachments and
generates an incident for each match. The exception excludes from matching messages from
ceo@company.com. An email from ceo@company.com that contains a Word attachment is
excepted from matching and does not trigger an incident. The detection exception condition
excluding ceo@company.com messages takes precedence over the detection rule match
condition that would otherwise match on the message.
See “Policy detection execution” on page 357.
You can implement any condition as an exception, except the EDM condition Content Matches
Exact Data From. In addition, Network Prevent for Web does not support synchronized DGM
exceptions. You can implement IDM as an exception, but the exception excludes exact files
from matching, not file contents. To exclude file contents, you "whitelist" it. VML can be used
as an exception if the content is from the same category.
See “Adding an exception to a policy” on page 387.
See “CAN-SPAM Act policy template” on page 1087.
See “White listing file contents to exclude from partial matching” on page 527.

Compound conditions
A valid policy must declare at least one rule that defines at least one match condition. The
condition matches input data to detect data loss. A rule with a single condition is a simple rule.
 Overview of policy detection 357
Policy detection execution

Optionally, you can declare multiple conditions within a single detection or group rule. A rule
with multiple conditions is a compound condition.
For compound conditions, each condition in the rule must match to trigger a violation. Thus,
for a single policy that declares one rule with two conditions, if one condition matches but the
other does not, detection does not report a match. If both conditions match, detection reports
a match, assuming that the rule is set to count all matches. In programmatic terms, two or
more conditions in the same rule are ANDed together.
Like rules, you can declare multiple conditions within a single exception. In this case, all
conditions in the exception must match for the exception to apply.
See “Policy detection execution” on page 357.
See “Use compound conditions to improve match accuracy” on page 418.
See “Exception conditions” on page 355.

Policy detection execution

You can include any combination of detection rules, group rules, and exceptions in a single
policy. A detection server evaluates policy exceptions first. If any exception is met, the entire
message or message component matching the exception is ejected and is no longer available
for policy matching.
The detection server evaluates the detection and group rules in the policy on a per-rule basis.
In programmatic terms, where you have a single policy definition, the connection between
conditions in the same rule or exception is AND (compound conditions). The connection
between two or more rules of the same type is OR (for example, 2 detection rules). But, if you
combine rules of different type in a single policy (for example, 1 detection rule and 1 group
rule), the connection between the rules is AND. In this configuration both rules must match to
trigger an incident. However, exception conditions created across the "Detection" and "Groups"
tabs are connected by an implicit OR.
See “Compound conditions” on page 356.
See “Exception conditions” on page 355.
Table 16-12 summarizes the policy condition execution logic for the detection server for various
policy configurations.

Table 16-12 Policy condition execution logic

Policy configuration Logic Description

Compound conditions AND If a single rule or exception in a policy contains two or more
match conditions, all conditions must match.
 Overview of policy detection 358
Two-tier detection for DLP Agents

Table 16-12 Policy condition execution logic (continued)

Policy configuration Logic Description

Rules or exceptions of same OR If there are two detection rules in a single policy, or two group
type rules in a single policy, or two exceptions of the same type
(detection or group), the rules or exceptions are independent
of each other.

Rules of different type AND If one or more detection rules is combined with one or more
group rules in a single policy, the rules are dependent.

Exceptions of different type OR If one or more detection exceptions is combined with one or
more group exceptions in a single policy, the exceptions are
independent.

Two-tier detection for DLP Agents

Symantec Data Loss Prevention uses a two-tier detection architecture to analyze activity on
endpoints for some index-based match conditions.
Two-tier detection requires communication and data transfer between the DLP Agent and the
Endpoint Server to detect incidents. If a match condition requires two-tier detection, the condition
is not evaluated locally on the endpoint by the DLP Agent. Instead, the DLP Agent sends the
data to the Endpoint Server for policy evaluation.
See “Guidelines for authoring Endpoint policies” on page 1716.
The effect of two-tier detection is that policy evaluation is delayed for the time it takes the data
to be sent to and evaluated by the Endpoint Server. If the DLP Agent is not connected to the
network or cannot communicate with the Endpoint Server, the condition requiring two-tier
detection is not evaluated until the DLP Agent connects. This delay can impact performance
of the DLP Agent if the message is a large file or attachment.
See “Troubleshooting policies” on page 408.
Two-tier detection has implications for the kinds of policies you author for endpoints. You can
reduce the potential bottleneck of two-tier detection by being aware of the detection conditions
that require two-tier detection and author your endpoint policies in such a way to eliminate or
reduce the need for two-tier detection.
See “Author policies to limit the potential effect of two-tier detection” on page 419.
Table 16-13 lists the detection conditions that require two-tier detection on the endpoint.
 Overview of policy detection 359
Two-tier detection for DLP Agents

Note: You cannot combine an Endpoint Prevent: Notify or Block response rule with two-tier
match conditions, including Exact Data Matching (EDM), Directory Group Matching (DGM),
and Indexed Document Matching (IDM) when two-tier detection is enabled. If you do, the
system displays a warning for both the detection condition and the response rule.

Table 16-13 Policy matching conditions requiring two-tier detection

Detection technology Match condition Description

Exact Data Matching (EDM) Content Matches Exact Data from See “Introducing Exact Data Matching
an Exact Data Profile (EDM)” on page 422.

See “About two-tier detection for EDM

on the endpoint” on page 431.

Profiled Directory Group Matching Sender/User based on a Directory See “Introducing profiled Directory
(DGM) from an Exact Data Profile Group Matching (DGM)” on page 754.

Recipient based on a Directory from See “About two-tier detection for

an Exact Data Profile profiled DGM” on page 754.

Synchronized Directory Group Recipient based on a Directory See “Introducing synchronized

Matching (DGM) Server Group Directory Group Matching (DGM)”
on page 747.

See “About two-tier detection for

synchronized DGM” on page 748.

Indexed Document Matching (IDM)
Content Matches Document See “Introducing Indexed Document
Signature from an Indexed Document Matching (IDM)” on page 512.
Profile
See “Two-tier IDM detection”
on page 515.
Note: Two-tier detection for IDM only
applies if it is enabled on the Endpoint
Server (two_tier_idm = on). If Endpoint
IDM is enabled (two_tier_idm = off),
two-tier detection is not used.
 Chapter 17
Creating policies from
templates
This chapter includes the following topics:

■ Creating a policy from a template

■ US Regulatory Enforcement policy templates

■ General Data Protection Regulation policy templates

■ International Regulatory Enforcement policy templates

■ Customer and Employee Data Protection policy templates

■ Confidential or Classified Data Protection policy templates

■ Network Security Enforcement policy templates

■ Acceptable Use Enforcement policy templates

■ Columbia Personal Data Regulatory Enforcement policy template

■ Choosing an Exact Data Profile

■ Choosing an Indexed Document Profile

Creating a policy from a template

You can create a policy from a system-provided template or from a template you import to the
Enforce Server.
See “Policy templates” on page 330.
See “Policy template import and export” on page 336.
 Creating policies from templates 361
Creating a policy from a template

Table 17-1 Create a policy from a template

Action Description

Add a policy from a template. See “Adding a new policy or policy template” on page 375.

Choose the template you want to At the Manage > Policies > Policy List > New Policy - Template List screen the
use. system lists all policy templates.
System-provided template categories:

■ See “US Regulatory Enforcement policy templates” on page 363.

■ See “General Data Protection Regulation policy templates” on page 365.
■ See “International Regulatory Enforcement policy templates” on page 366.
■ See “Customer and Employee Data Protection policy templates” on page 366.
■ See “Confidential or Classified Data Protection policy templates” on page 368.
■ See “Network Security Enforcement policy templates” on page 369.
■ See “Acceptable Use Enforcement policy templates” on page 369.
■ See “Columbia Personal Data Regulatory Enforcement policy template”
on page 371.
Imported Templates appear individually after import:

■ See “Importing policy templates” on page 404.

Click Next to configure the policy. For example, select the Webmail policy template and click Next.

See “Configuring policies” on page 376.

Choose a Data Profile (if
prompted).
If the template relies on one or more Data Profiles, the system prompts you to
select each:
■ Exact Data Profile
See “Choosing an Exact Data Profile” on page 371.
■ Indexed Document Profile
See “Choosing an Indexed Document Profile” on page 373.
If you do not have a Data Profile, you can either:

■ Cancel the policy definition process, define the profile, and resume creating the
policy from the template.
■ Click Next to configure the policy.
On creation of the policy, the system drops any rules or exceptions that rely on
the Data Profile.

Note: You should use a profile if a template calls for it.

 Creating policies from templates 362
Creating a policy from a template

Table 17-1 Create a policy from a template (continued)

Action Description

Edit the policy name or If you intend to modify a system-defined template, you may want to change the
description (optional). name so you can distinguish it from the original.

See “Configuring policies” on page 376.

Note: If you want to export the policy as a template, the policy name must be less
than 60 characters. If it is more, the template does not appear in the Imported
Templates section of the Template List screen.

Note: The Policy Label field is reserved for the Veritas Data Insight Self-Service
Portal.

Select a policy group (if If you have defined a policy group, select it from the Policy Group list.
necessary).
See “Creating and modifying policy groups” on page 399.

If you have not defined a policy group, the system deploys the policy to the Default
Policy Group.

Edit the policy rules or exceptions The Configure Policy screen displays the rules and exceptions (if any) provided
(if necessary). by the policy.

You can modify, add, and remove policy rules and exceptions to meet your
requirements.

See “Configuring policy rules” on page 380.

See “Configuring policy exceptions” on page 389.

Save the policy and export it Click Save to save the policy.
(optional).
You can export policy detection as a template for sharing or archiving.

See “Exporting policy detection as a template” on page 405.

For example, if you changed the configuration of a system-defined policy template,

you may want to export it for sharing across environments.

Test and tune the policy Test and tune the policy using data the policy should and should not detect.
(recommended).
Review the incidents that the policy generates. Refine the policy rules and
exceptions as necessary to reduce false positives and false negatives.

Add response rules (optional). Add response rules to the policy to report and remediate violations.

See “Implementing response rules” on page 1216.

Note: Response rules are not included in policy templates.
 Creating policies from templates 363
US Regulatory Enforcement policy templates

US Regulatory Enforcement policy templates

Symantec Data Loss Prevention provides several policy templates supporting US Regulatory
Enforcement guidelines.
See “Creating a policy from a template” on page 360.

Table 17-2 US Regulatory Enforcement policy templates

Policy template Description

CAN-SPAM Act Establishes requirements for sending commercial email.

See “CAN-SPAM Act policy template” on page 1087.

Defense Message System (DMS) GENSER Detects information classified as confidential.

Classification
See “Defense Message System (DMS) GENSER Classification
policy template” on page 1096.

Export Administration Regulations (EAR) Enforces the U.S. Department of Commerce Export Administration
Regulations (EAR).

See “Export Administration Regulations (EAR) policy template”

on page 1100.

FACTA 2003 (Red Flag Rules) Enforces sections 114 and 315 (or Red Flag Rules) of the Fair
and Accurate Credit Transactions Act (FACTA) of 2003.

See “FACTA 2003 (Red Flag Rules) policy template” on page 1101.

Gramm-Leach-Bliley This policy limits sharing of consumer information by financial

institutions.

See “Gramm-Leach-Bliley policy template” on page 1150.

HIPAA and HITECH (including PHI) This policy enforces the US Health Insurance Portability and
Accountability Act (HIPAA).

See “HIPAA and HITECH (including PHI) policy template”

on page 1152.

International Traffic in Arms Regulations (ITAR) This policy enforces the US Department of State ITAR provisions.

See “International Traffic in Arms Regulations (ITAR) policy

template” on page 1158.

NASD Rule 2711 and NYSE Rules 351 and 472 This policy protects the name(s) of any companies that are involved
in an upcoming stock offering.

See “NASD Rule 2711 and NYSE Rules 351 and 472 policy
template” on page 1161.
 Creating policies from templates 364
US Regulatory Enforcement policy templates

Table 17-2 US Regulatory Enforcement policy templates (continued)

Policy template Description

NASD Rule 3010 and NYSE Rule 342 This policy monitors brokers-dealers communications.
See “NASD Rule 3010 and NYSE Rule 342 policy template”
on page 1163.

NERC Security Guidelines for Electric Utilities This policy detects the information that is outlined in the North
American Electric Reliability Council (NERC) security guidelines
for the electricity sector.

See “NERC Security Guidelines for Electric Utilities policy template”

on page 1164.

Office of Foreign Assets Control (OFAC) This template detects communications involving targeted OFAC
groups.

See “Office of Foreign Assets Control (OFAC) policy template”

on page 1167.

OMB Memo 06-16 and FIPS 199 Regulations This template detects information that is classified as confidential.

See “OMB Memo 06-16 and FIPS 199 Regulations policy template”
on page 1168.

Payment Card Industry Data Security Standard This template detects credit card number data.

See “Payment Card Industry (PCI) Data Security Standard policy

template” on page 1170.

Sarbanes-Oxley This template detects sensitive financial data.

See “Sarbanes-Oxley policy template” on page 1177.

SEC Fair Disclosure Regulation This template detects data disclosure of material financial
information.

See “SEC Fair Disclosure Regulation policy template” on page 1180.

State Data Privacy This template detects breaches of state-mandated confidentiality.

See “State Data Privacy policy template” on page 1184.

US Intelligence Control Markings (CAPCO) and This template detects authorized terms to identify classified
DCID 1/7 information in the US Federal Intelligence community.

See “US Intelligence Control Markings (CAPCO) and DCID 1/7

policy template” on page 1190.
 Creating policies from templates 365
General Data Protection Regulation policy templates

General Data Protection Regulation policy templates

Symantec Data Loss Prevention provides several policy template for General Data Protection
Regulation (GDPR) compliance.
See “Creating a policy from a template” on page 360.

Table 17-3
Policy template Description

General Data Protection Regulations (Banking and This policy protects personal identifiable information related
Finance) to banking and finance.

See “General Data Protection Regulation (Banking and

Finance)” on page 1107.

General Data Protection Regulation (Digital Identity) This policy protects personal identifiable information related
to digital identity.

See “General Data Protection Regulation (Digital Identity)”

on page 1121.

General Data Protection Regulation (Government This policy protects personal identifiable information related
Identification) to government identification.

See “General Data Protection Regulation (Government

Identification)” on page 1121.

General Data Protection Regulation (Healthcare and This policy protects personal identifiable information related
Insurance) to healthcare and insurance.
See “General Data Protection Regulation (Healthcare and
Insurance)” on page 1136.

General Data Protection Regulation (Personal Profile) This policy protects personal identifiable information related
to personal profile data.

See “General Data Protection Regulation (Personal

Profile)” on page 1145.

General Data Protection Regulation (Travel) This policy protects personal identifiable information related
to travel.

See “General Data Protection Regulation (Travel)”

on page 1145.
 Creating policies from templates 366
International Regulatory Enforcement policy templates

International Regulatory Enforcement policy

templates
Symantec Data Loss Prevention provides several policy templates for International Regulatory
Enforcement.
See “Creating a policy from a template” on page 360.

Table 17-4 International Regulatory Enforcement policy templates

Policy template Description

Caldicott Report This policy protects UK patient information.

See “Caldicott Report policy template” on page 1085.

Data Protection Act 1998 This policy protects personal identifiable information.

See “Data Protection Act 1998 policy template” on page 1092.

EU Data Protection Directives This policy detects personal data specific to the EU directives.

See “Data Protection Directives (EU) policy template” on page 1094.

Human Rights Act 1998 This policy enforces Article 8 of the act for UK citizens.

See “Human Rights Act 1998 policy template” on page 1156.

PIPEDA This policy detects Canadian citizen customer data.

See “PIPEDA policy template” on page 1172.

Customer and Employee Data Protection policy

templates
Symantec Data Loss Prevention provides several policy templates for Customer and Employee
Data Protection.
See “Creating a policy from a template” on page 360.

Table 17-5 Customer and Employee Data Protection policy templates

Policy template Description

Canadian Social Insurance Numbers This policy detects patterns indicating Canadian social insurance
numbers.

See “Canadian Social Insurance Numbers policy template” on page 1086.

 Creating policies from templates 367
Customer and Employee Data Protection policy templates

Table 17-5 Customer and Employee Data Protection policy templates (continued)

Policy template Description

Credit Card Numbers This policy detects patterns indicating credit card numbers.
See “Credit Card Numbers policy template” on page 1090.

Customer Data Protection This policy detects customer data.

See “Customer Data Protection policy template” on page 1091.

Employee Data Protection This policy detects employee data.

See “Employee Data Protection policy template” on page 1098.

Individual Taxpayer Identification Numbers This policy detects IRS-issued tax processing numbers.
(ITIN)
See “Individual Taxpayer Identification Numbers (ITIN) policy template”
on page 1157.

SWIFT Codes This policy detects codes banks use to transfer money across
international borders.

See “SWIFT Codes policy template” on page 1187.

UK Drivers License Numbers This policy detects UK Drivers License Numbers.

See “UK Drivers License Numbers policy template” on page 1188.

UK Electoral Roll Numbers This policy detects UK Electoral Roll Numbers.

See “UK Electoral Roll Numbers policy template” on page 1188.

UK National Insurance Numbers This policy detects UK National Insurance Numbers.

See “UK National Insurance Numbers policy template” on page 1189.

UK National Health Service Number This policy detects personal identification numbers issued by the NHS.

See “UK National Health Service (NHS) Number policy template”

on page 1189.

UK Passport Numbers This policy detects valid UK passports.

See “UK Passport Numbers policy template” on page 1189.

UK Tax ID Numbers This policy detects UK Tax ID Numbers.

See “UK Tax ID Numbers policy template” on page 1190.

US Social Security Numbers This policy detects patterns indicating social security numbers.

See “US Social Security Numbers policy template” on page 1191.

 Creating policies from templates 368
Confidential or Classified Data Protection policy templates

Confidential or Classified Data Protection policy

templates
Symantec Data Loss Prevention provides several policy templates for Confidential or Classified
Data Protection.
See “Creating a policy from a template” on page 360.

Table 17-6 Confidential or Classified Data Protection policy templates

Policy template Description

Confidential Documents This policy detects company-confidential documents.

See “Confidential Documents policy template” on page 1089.

Design Documents This policy detects various types of design documents.

See “Design Documents policy template” on page 1097.

Encrypted Data This policy detects the use of encryption by a variety of methods.

See “Encrypted Data policy template” on page 1099.

Financial Information This policy detects financial data and information.

See “Financial Information policy template” on page 1105.

Merger and Acquisition Agreements This policy detects information and communications about upcoming merger
and acquisition activity.

See “Merger and Acquisition Agreements policy template” on page 1160.

Price Infomation This policy detects specific SKU and pricing information.

See “Price Information policy template” on page 1174.

Project Data This policy detects discussions of sensitive projects.

See “Project Data policy template” on page 1174.

Proprietary Media Files This policy detects various types of video and audio files.

See “Proprietary Media Files policy template” on page 1174.

Publishing Documents This policy detects various types of publishing documents.

See “Publishing Documents policy template” on page 1175.

Resumes This policy detects active job searches.

See “Resumes policy template” on page 1177.

 Creating policies from templates 369
Network Security Enforcement policy templates

Table 17-6 Confidential or Classified Data Protection policy templates (continued)

Policy template Description

Source Code This policy detects various types of source code.

See “Source Code policy template” on page 1183.

Symantec DLP Awareness and Avoidance This policy detects any communications that refer to Symantec DLP or
other data loss prevention systems and possible avoidance of detection.

See “Symantec DLP Awareness and Avoidance policy template”

on page 1187.

Network Security Enforcement policy templates

Symantec Data Loss Prevention provides several policy templates for Network Security
Enforcement.
See “Creating a policy from a template” on page 360.

Table 17-7 Network Security Enforcement policy templates

Policy template Description

Common Spyware Upload Sites This policy detects access to common spyware upload Web sites.

See “Common Spyware Upload Sites policy template” on page 1088.

Network Diagrams This policy detects computer network diagrams.

See “Network Diagrams policy template” on page 1165.

Network Security This policy detects evidence of hacking tools and attack planning.

See “Network Security policy template” on page 1166.

Password Files This policy detects password file formats.

See “Password Files policy template” on page 1170.

Acceptable Use Enforcement policy templates

Symantec Data Loss Prevention provides several policy templates for allowing acceptable
uses of information.
See “Creating a policy from a template” on page 360.
 Creating policies from templates 370
Acceptable Use Enforcement policy templates

Table 17-8 Acceptable Use Enforcement policy templates

Policy template Description

Competitor Communications This policy detects forbidden communications with competitors.

See “Competitor Communications policy template” on page 1089.

Forbidden Websites This policy detects access to specified Web sites.

See “Forbidden Websites policy template” on page 1105.

Gambling This policy detects any reference to gambling.

See “Gambling policy template” on page 1106.

Illegal Drugs This policy detects conversations about illegal drugs and controlled
substances.

See “Illegal Drugs policy template” on page 1157.

Media Files This policy detects various types of video and audio files.

See “Media Files policy template” on page 1159.

Offensive Language This policy detects the use of offensive language.

See “Offensive Language policy template” on page 1166.

Racist Language This policy detects the use of racist language.

See “Racist Language policy template” on page 1176.

Restricted Files This policy detects various file types that are generally inappropriate to send
out of the company.

See “Restricted Files policy template” on page 1176.

Restricted Recipients This policy detects communications with specified recipients.

See “Restricted Recipients policy template” on page 1176.

Sexually Explicit Language This policy detects sexually explicit content.

See “Sexually Explicit Language policy template” on page 1182.

Violence and Weapons This policy detects violent language and discussions about weapons.

See “Violence and Weapons policy template” on page 1192.

Webmail This policy detects the use of a variety of Webmail services.

See “Webmail policy template” on page 1192.

Yahoo Message Board Activity This policy detects Yahoo message board activity.

See “Yahoo Message Board Activity policy template” on page 1193.

 Creating policies from templates 371
Columbia Personal Data Regulatory Enforcement policy template

Table 17-8 Acceptable Use Enforcement policy templates (continued)

Policy template Description

Yahoo and MSN Messengers on Port This policy detects Yahoo IM and MSN Messenger activity.
80
See “Yahoo and MSN Messengers on Port 80 policy template” on page 1194.

Columbia Personal Data Regulatory Enforcement

policy template
Symantec Data Loss Prevention provides a policy templates for the enforcement of Columbian
personal data regulations.
See “Creating a policy from a template” on page 360.

Table 17-9 Columbia Personal Data Regulatory Enforcement policy template

Policy template Description

Columbian Personal Data Protection Law 1581 This policy detects violations of the Columbian Personal
Data Protection Law 1581.

See “Colombian Personal Data Protection Law 1581 policy

template” on page 1088.

Choosing an Exact Data Profile

If the policy template you select implements Exact Data Matching (EDM), the system prompts
you to choose an Exact Data Profile. Table 17-10 lists the policy templates that are based on
Exact Data Profiles.
If you do not have an Exact Data Profile, you can cancel policy creation and define a profile.
Or, you can choose not to use an Exact Data Profile. In this case the system disables the
associated EDM detection rules in the policy template. You can use any DCM rules or
exceptions the policy template provides.
See “Introducing Exact Data Matching (EDM)” on page 422.
See “About the Exact Data Profile and index” on page 426.
 Creating policies from templates 372
Choosing an Exact Data Profile

To choose an Exact Data Profile

1 Select an Exact Data Profile from the list of available profiles.
2 Click Next to continue with creating the policy from the template.
Click Previous to return to the list of policy templates.
See “Creating a policy from a template” on page 360.

Note: When the system prompts you to select an Exact Data Profile, the display lists the data
columns to include in the profile to provide the highest level of accuracy. If data fields in your
Exact Data Profile are not represented in the selected policy template, the system displays
those fields for content matching when you define the detection rule

Table 17-10 Policy templates that implement Exact Data Matching (EDM)

Policy template Description

Caldicott Report See “Caldicott Report policy template” on page 1085.

Customer Data Protection See “Customer Data Protection policy template” on page 1091.

Data Protection Act 1988 See “Data Protection Act 1998 policy template” on page 1092.

Employee Data Protection See “Employee Data Protection policy template” on page 1098.

EU Data Protection Directives See “Data Protection Directives (EU) policy template” on page 1094.

Export Administration Regulations (EAR) See “Export Administration Regulations (EAR) policy template”
on page 1100.

FACTA 2003 (Red Flag Rules) See “FACTA 2003 (Red Flag Rules) policy template” on page 1101.

General Data Protection Regulations (Banking See “General Data Protection Regulation (Banking and Finance)”
and Finance) on page 1107.

General Data Protection Regulations (Digital See “General Data Protection Regulation (Digital Identity)” on page 1121.
Identity)

General Data Protection Regulations See “General Data Protection Regulation (Government Identification)”
(Government Identification) on page 1121.

General Data Protection Regulations See “General Data Protection Regulation (Healthcare and Insurance)”
(Healthcare and Insurance) on page 1136.

General Data Protection Regulations See “General Data Protection Regulation (Personal Profile)” on page 1145.
(Personal Profile)

General Data Protection Regulations (Travel) See “General Data Protection Regulation (Travel)” on page 1145.
 Creating policies from templates 373
Choosing an Indexed Document Profile

Table 17-10 Policy templates that implement Exact Data Matching (EDM) (continued)

Policy template Description

Gramm-Leach-Bliley See “Gramm-Leach-Bliley policy template” on page 1150.

HIPAA and HITECH (including PHI) See “HIPAA and HITECH (including PHI) policy template” on page 1152.

Human Rights Act 1998 See “Human Rights Act 1998 policy template” on page 1156.

International Traffic in Arms Regulations See “International Traffic in Arms Regulations (ITAR) policy template”
(ITAR) on page 1158.

Payment Card Industry Data Security See “Payment Card Industry (PCI) Data Security Standard policy
Standard template” on page 1170.

PIPEDA See “PIPEDA policy template” on page 1172.

Price Information See “Price Information policy template” on page 1174.

Resumes See “Resumes policy template” on page 1177.

State Data Privacy See “SEC Fair Disclosure Regulation policy template” on page 1180.

Choosing an Indexed Document Profile

If the policy template you chose uses Indexed Document Matching (IDM) detection, the system
prompts you to select the Document Profile.
See “Introducing Indexed Document Matching (IDM)” on page 512.
To use a Document Profile
1 Select the Document Profile from the list of available profiles.
2 Click Next to create the policy from the template.
See “Creating a policy from a template” on page 360.
If you do not have a Document Profile, you can cancel policy creation and define the Document
Profile. Or, you can choose to not use a Document Profile. In this case the system disables
any IDM rules or exceptions for the policy instance. If the policy template contains DCM rules
or exceptions, you may use them.
See “About the Indexed Document Profile” on page 515.

Table 17-11 Policy templates that implement Indexed Document Matching (IDM)

Policy template Description

CAN-SPAM Act (IDM exception) See “CAN-SPAM Act policy template” on page 1087.
 Creating policies from templates 374
Choosing an Indexed Document Profile

Table 17-11 Policy templates that implement Indexed Document Matching (IDM) (continued)

Policy template Description

NASD Rule 2711 and NYSE Rules 351 See “NASD Rule 2711 and NYSE Rules 351 and 472 policy template”
and 472 on page 1161.

NERC Security Guidelines for Electric See “NERC Security Guidelines for Electric Utilities policy template”
Utilities on page 1164.

Sarbanes-Oxley See “Sarbanes-Oxley policy template” on page 1177.

SEC Fair Disclosure Regulation See “SEC Fair Disclosure Regulation policy template” on page 1180.

Confidential Documents See “Confidential Documents policy template” on page 1089.

Design Documents See “Design Documents policy template” on page 1097.

Financial Information See “Financial Information policy template” on page 1105.

Project Data See “Project Data policy template” on page 1174.

Proprietary Media Files See “Proprietary Media Files policy template” on page 1174.

Publishing Documents See “Publishing Documents policy template” on page 1175.

Source Code See “Source Code policy template” on page 1183.

Network Diagrams See “Network Diagrams policy template” on page 1165.

 Chapter 18
Configuring policies
This chapter includes the following topics:

■ Adding a new policy or policy template

■ Configuring policies

■ Adding a rule to a policy

■ Configuring policy rules

■ Defining rule severity

■ Configuring match counting

■ Selecting components to match on

■ Adding an exception to a policy

■ Configuring policy exceptions

■ Configuring compound match conditions

■ Input character limits for policy configuration

Adding a new policy or policy template

As a policy author you can define a new policy from scratch or from a template.
See “Workflow for implementing policies” on page 337.
 Configuring policies 376
Configuring policies

To add a new policy or a policy template

1 Click New at the Manage > Polices > Policy List screen.
See “Manage and add policies” on page 395.
2 Choose the type of policy you want to add at the New Policy screen.
Select Add a blank policy to add a new empty policy.
See “Policy components” on page 329.
Select Add a policy from a template to add a policy from a template.
See “Policy templates” on page 330.
3 Click Next to configure the policy or the policy template.
See “Configuring policies” on page 376.
See “Creating a policy from a template” on page 360.
Click Cancel to not add a policy and return to the Policy List screen.

Configuring policies
The Manage > Policies > Policy List > Configure Policy screen is the home page for
configuring policies.
Table 18-1 describes the workflow for configuring policies.

Table 18-1 Configuring policies

Action Description

Define a new policy, or edit an existing policy. Add a new blank policy.

See “Adding a new policy or policy template” on page 375.

Create a policy from a template.

See “Creating a policy from a template” on page 360.

Select an existing policy at the Manage > Policies > Policy

List screen to edit it.

See “Manage and add policies” on page 395.

Enter a policy Name and Description. The policy name must be unique in the policy group you deploy
the policy to.

See “Input character limits for policy configuration” on page 393.

Note: The Policy Label field is reserved for the Veritas Data
Insight Self-Service Portal.
 Configuring policies 377
Configuring policies

Table 18-1 Configuring policies (continued)

Action Description

Select the Policy Group from the list where the The Default Policy Group is selected if there is no policy group
policy is to be deployed. configured.

See “Creating and modifying policy groups” on page 399.

Set the Status for the policy. You can enable (default setting) or disable a policy. A disabled
policy is deployed but is not loaded into memory to detect
incidents.

See “Manage and add policies” on page 395.

Add a rule to the policy, or edit an existing rule. Click Add Rule to add a rule.

See “Adding a rule to a policy” on page 378.

Select an existing rule to edit it.

Configure the rule with one or more conditions. For a valid policy, you must configure at least one rule that
declares at least one condition. Compound conditions and
exceptions are optional.

See “Configuring policy rules” on page 380.

Optionally, add one or more policy exceptions, or Click Add Exception to add it.
edit an existing exception.
See “Adding an exception to a policy” on page 387.d

Select an existing exception to edit it.

Configure any exception(s). See “Configuring policy exceptions” on page 389.

Save the policy configuration. Click Save to save the policy configuration to the Enforce Server
database.

See “Policy components” on page 329.

Export the policy as a template. Optionally, you can export the policy rules and exceptions as a
template.

See “Exporting policy detection as a template” on page 405.

Add one or more response rules to the policy. You configure response rules independent of policies.

See “Configuring response rules” on page 1221.

See “Adding an automated response rule to a policy”

on page 405.
 Configuring policies 378
Adding a rule to a policy

Adding a rule to a policy

At the Manage > Policies > Policy List > Configure Policy – Add Rule screen you add one
or more rules to a policy.
You can add two types of rules to a policy: detection and group. If two or more rules in a policy
are the same type, the system connects them by OR. If two or more rules in the same policy
are different types, the system connects them by AND.
See “Policy detection execution” on page 357.

Note: Exceptions are added separate from rules. See “Adding an exception to a policy”
on page 387.

To add one or more rules to a policy

1 Choose the type of rule (detection or group) to add to the policy.
To add a detection rule, select the Detection tab and click Add Rule.
To add a group (identity) rule, select the Groups tab and click Add Rule.
See “Policy matching conditions” on page 349.
2 Select the detection or the group rule you want to implement from the list of rules.
See Table 18-2 on page 378.
3 Select the prerequisite component, if required.
If the policy rule requires a Data Profile, Data Identifier, or User Group select it from
the list.
4 Click Next to configure the policy rule.
See “Configuring policy rules” on page 380.

Table 18-2 Adding policy rules

Rule Prerequisite Description

Content match conditions

Content Matches Regular See “Introducing regular expression matching”

Expression on page 700.

Content Matches Exact Data Exact Data Profile See “About the Exact Data Profile and index”
on page 426.

See “Choosing an Exact Data Profile” on page 371.

Content Matches Keyword See “Introducing keyword matching” on page 686.

 Configuring policies 379
Adding a rule to a policy

Table 18-2 Adding policy rules (continued)

Rule Prerequisite Description

Content Matches Document Indexed Document See “Introducing Indexed Document Matching (IDM)”
Signature Profile on page 512.

See “Choosing an Indexed Document Profile”

on page 373.

Content Matches Data Identifier Data Identifier See “Introducing data identifiers” on page 612.

See “Selecting a data identifier breadth” on page 629.

Detect using Vector Machine VML Profile See “Introducing Vector Machine Learning (VML)”
Learning on page 564.

See “Configuring VML profiles and policy conditions”

on page 568.

Context match conditions

Contextual Attributes Cloud For information about contextual attributes for Cloud
Applications and API Detection Application and API Detection Appliance incidents,
Appliance only) see http://www.symantec.com/docs/DOC9451.

File Properties match conditions

Message Attachment or File See “About file type matching” on page 711.
Type Match

Message Attachment or File See “About file size matching” on page 713.
Size Match

Message Attachment or File See “About file name matching” on page 714.
Name Match

Custom File Type Signature Rule enabled See “About custom file type identification” on page 712.

Custom script See “Enabling the Custom File Type Signature

condition in the policy console” on page 719.

Protocol and Endpoint match conditions

Protocol Monitoring Custom protocols (if any) See “Introducing protocol monitoring for network”
on page 723.

Endpoint Monitoring See “About endpoint protocol monitoring” on page 727.

Endpoint Device Class or ID Custom device(s) See “About endpoint device detection” on page 729.

Endpoint Location See “About endpoint location detection” on page 729.

 Configuring policies 380
Configuring policy rules

Table 18-2 Adding policy rules (continued)

Rule Prerequisite Description

Form Recognition

Detect using Form Recognition Form Recognition Profile See “About Form Recognition detection” on page 595.
Profile
See “Configuring the Form Recognition detection rule”
on page 599.

Groups (Identities) match conditions

Sender/User Matches Pattern See “Introducing described identity matching”

on page 737.
Recipient Matches Pattern

Sender/User based on a User Group See “Introducing synchronized Directory Group

Directory Server Group Matching (DGM)” on page 747.

Recipient based on a Directory See “Configuring User Groups” on page 748.

Server Group

Sender/User based on a Exact Data Profile See “Introducing profiled Directory Group Matching
Directory from: (DGM)” on page 754.

Recipient based on a Directory See “Configuring Exact Data profiles for DGM”
from: on page 755.

Configuring policy rules

At the Manage > Policies > Policy List > Configure Policy – Edit Rule screen, you configure
a policy rule with one or more match conditions. The configuration of each rule condition
depends on its type.
See Table 18-4 on page 381.

Table 18-3 Configuring policy rules

Step Action Description

Step 1 Add a rule to a policy, or modify See “Adding a rule to a policy” on page 378.
a rule.
To modify an existing rule, select the rule in the policy builder interface at
the Configure Policy – Edit Rule screen.

Step 2 Name the rule, or modify a In the General section of the rule, enter a name in the Rule Name field,
name. or modify the name of an existing rule.
 Configuring policies 381
Configuring policy rules

Table 18-3 Configuring policy rules (continued)

Step Action Description

Step 3 Set the rule severity. In the Severity section of the rule, select or modify a "Default" severity
level.

In addition to the default severity, you can add multiple severity levels to
a rule.

See “Defining rule severity” on page 383.

Step 4 Configure the match condition. In the Conditions section of the rule, you configure one or more match
conditions for the rule. The configuration of a condition depends on its
type.

See Table 18-4 on page 381.

Step 5 Configure match counting (if If the rule calls for it, configure how you want to count matches.
required).
See “Configuring match counting” on page 384.

Step 6 Select components to match on If the rule is content-based, select one or more available content rules to
(if available). match on.

See “Selecting components to match on” on page 386.

Step 7 Add and configure one or more To define a compound rule, Add another match condition from the Also
additional match conditions Match list.
(optional).
Configure the additional condition according to its type (Step 4).

See “Configuring compound match conditions” on page 392.

Note: All conditions in a single rule must match to trigger an incident. See
“Policy detection execution” on page 357.

Step 8 Save the policy configuration. When you are done cofiguring the rule, click OK.

This action returns you to the Configure Policy screen where you can
Save the policy.

See “Manage and add policies” on page 395.

Table 18-4 lists each of the available match conditions and provides links to topics for
configuring each condition.

Table 18-4 Configuring policy match conditions

Rule Description

Content match conditions

 Configuring policies 382
Configuring policy rules

Table 18-4 Configuring policy match conditions (continued)

Rule Description

Content Matches Regular Expression See “Configuring the Content Matches Regular Expression condition”
on page 702.

Content Matches Exact Data from an See “Configuring the Content Matches Exact Data policy condition”
Exact Data Profile on page 448.

Content Matches Keyword See “Configuring the Content Matches Keyword condition” on page 692.

Content Matches Document Signature See “Configuring the Content Matches Document Signature policy
condition” on page 545.

Content Matches Data Identifier See “Configuring the Content Matches data identifier condition” on page 628.

Detect using Vector Machine Learning See “Configuring the Detect using Vector Machine Learning Profile
profile condition” on page 579.

Detect using Form Recognition profile See “Configuring the Form Recognition detection rule” on page 599.

File Properties match conditions

Message Attachment or File Type See “Configuring the Message Attachment or File Type Match condition”
Match on page 715.

Message Attachment or File Size Match See “Configuring the Message Attachment or File Size Match condition”
on page 716.

Message Attachment or File Name See “Configuring the Message Attachment or File Name Match condition”
Match on page 717.

Custom File Type Signature See “Configuring the Custom File Type Signature condition” on page 719.

Protocol match conditions

Network Monitoring See “Configuring the Protocol Monitoring condition for network detection”
on page 724.

Endpoint Monitoring See “Configuring the Endpoint Monitoring condition” on page 730.

Endpoint Device Class or ID See “Configuring the Endpoint Device Class or ID condition” on page 733.

Endpoint Location See “Configuring the Endpoint Location condition” on page 732.

Groups match conditions

Sender/User Matches Pattern See “Configuring the Sender/User Matches Pattern condition” on page 739.

Recipient Matches Pattern See “Configuring the Recipient Matches Pattern condition” on page 742.
 Configuring policies 383
Defining rule severity

Table 18-4 Configuring policy match conditions (continued)

Rule Description

Sender/User based on a Directory See “Configuring the Sender/User based on a Directory Server Group
Server Group condition” on page 751.

Sender/User based on a Directory from See “Configuring the Sender/User based on a Profiled Directory condition”
an Exact Data Profile on page 756.

Recipient based on a Directory Server See “Configuring the Recipient based on a Directory Server Group
Group condition” on page 752.

Recipient based on a Directory from an See “Configuring the Recipient based on a Profiled Directory condition”
Exact Data Profile on page 757.

Defining rule severity

The system assigns a severity level to a policy rule violation. The default setting is "High." You
can configure the default, and add one or more additional severity levels.
See “Policy severity” on page 333.
Policy rule severity works with the Severity response rule condition. If you set the default
policy rule severity level to "High" and define additional severity levels, the system does not
assign the additional severity to the incident based on match count. The result is that if you
have a response rule set to a match count severity level that is less than the default "High"
severity, the response rule does not execute
See “Configuring the Severity response condition” on page 1235.
To define policy rule severity
1 Configure a policy rule.
See “Configuring policy rules” on page 380.
2 Select a Default level from the Severity list.
The default severity level is the baseline level that the system reports. The system applies
the default severity level to any rule match, unless additional severity levels override the
default setting.
3 Click Add Severity to define additional severity levels for the rule.
If you add a severity level it is based on the match count.
 Configuring policies 384
Configuring match counting

4 Select the desired severity level, choose the match count range, and enter the match
count.
For example, you can set a Medium severity with X range to match after 100 matches
have been counted.
5 If you add an additional severity level, you can select it to be the default severity.
6 To remove a defined severity level, click the X icon beside the severity definition.

Configuring match counting

Some conditions let you specify how you want to count matches. Count all matches is the
default behavior. You can configure the minimum number of matches required to cause an
incident. Or, you can count all matches as one incident. If a condition supports match counting,
you can configure this setting for both policy rules and exceptions.
See Table 18-6 on page 385.

Table 18-5 Configuring match counting

Parameter Condition Incident description

type

Check for Simple This configuration reports a match count of 1 if there are one or more matches; it
existence does not count multiple matches. For example, 10 matches are one incident.

Compound This configuration reports a match count of 1 if there are one or more matches
and ALL conditions in the rule or exception are set to check for existence.
 Configuring policies 385
Configuring match counting

Table 18-5 Configuring match counting (continued)

Parameter Condition Incident description

type

Count all Simple This configuration reports a match count of the exact number of matches detected
matches by the condition. For example, 10 matches count as 10 incidents.

Compound This configuration reports a match count of the sum of all condition matches in
the rule or exception. The default is one incident per condition match and applies
if any condition in the rule or exception is set to count all matches.

For example, if a rule has two conditions and one is set to count all matches and
detects four matches, and the other condition is set to check for existence and
detects six matches, the reported match count is 10. If a third condition in the rule
detects a match, the match count is 11.

Only report You can change the default one incident per match count by specifying the
incidents with minimum number of matches required to report an incident.
at least _
For example, in a rule with two conditions, if you configure one condition to count
matches
all matches and specify five as the minimum number of matches for each condition,
a sum of 10 matches reported by the two conditions generates two incidents. You
must be consistent and select this option for each condition in the rule or exception
to achieve this behavior.
Note: The count all matches setting applies to each message component you
match on. For example, consider a policy where you specify a match count of 3
and configure a keyword rule that matches on all four message components
(default setting for this condition). If a message is received with two instances of
the keyword in the body and one instance of the keyword in the envelope, the
system does not report this as a match. However, if three instances of the keyword
appear in an attachment (or any other single message component), the system
would report it as a match.

Count all unique Only count Unique match counting is new for Symantec Data Loss Prevention version 11.6
matches unique and is only available for Data Identifiers.
matches
See “About unique match counting” on page 625.

Table 18-6 Conditions that support match counting

Condition Description

Content Matches Regular See “Introducing regular expression matching” on page 700.
Expression
See “Configuring the Content Matches Regular Expression condition” on page 702.

Content Matches Keyword See “Introducing keyword matching” on page 686.

See “Configuring the Content Matches Keyword condition” on page 692.

 Configuring policies 386
Selecting components to match on

Table 18-6 Conditions that support match counting (continued)

Condition Description

Content Matches Document See “Configuring the Content Matches Document Signature policy condition”
Signature (IDM) on page 545.

Content Matches Data Identifier See “Introducing data identifiers” on page 612.

See “Configuring the Content Matches data identifier condition” on page 628.

See “Configuring unique match counting” on page 648.

Recipient Matches Pattern See “Introducing described identity matching” on page 737.

See “Configuring the Recipient Matches Pattern condition” on page 742.

Selecting components to match on

The availability of one or more message components to match on depends on the type of rule
or exception condition you implement.
See “Detection messages and message components” on page 354.

Table 18-7 Match on components

Component Description

Envelope If the condition supports matching on the Envelope component, select it to match on the message
metadata. The envelope contains the header, transport information, and the subject if the message
is an SMTP email.

If the condition does not support matching on the Envelope component, this option is grayed out.

If the condition matches on the entire message, the Envelope is selected and cannot be deselected,
and the other components cannot be selected.

Subject Certain detection conditions match on the Subject component for some types of messages.

See “Detection messages and message components” on page 354.

For the detection conditions that support subject component matching, you can match on the Subject
for the following types of messages:

■ SMTP (email) messages from Network Monitor or Network Prevent for Email.
■ NNTP messages from Network Monitor.

To match on the Subject component, you must select (check) the Subject component and uncheck
(deselect) the Envelope component for the policy rule. If you select both components, the system
matches the subject twice because the message subject is included in the envelope as part of the
header.
 Configuring policies 387
Adding an exception to a policy

Table 18-7 Match on components (continued)

Component Description

Body If the condition matches on the Body message component, select it to match on the text or content
of the message.

Attachment(s) If the condition matches on the Attachment(s) message component, select it to detect content in
files sent by, downloaded with, or attached to the message.

Adding an exception to a policy

At the Manage > Policies > Policy List > Configure Policy – Add Exception screen you
add one or more exception conditions to a policy. Policy exceptions are executed before policy
rules. If there is an exception match, the entire message is discarded.
See “Exception conditions” on page 355.

Note: You can create exceptions for all policy conditions, except the EDM condition Content
Matches Exact Data From. In addition, Network Prevent for Web does not support
synchronized DGM exceptions.

To add an exception to a policy

1 Add an exception to a policy.
To add a detection rule exception, select the Detection tab and click Add Exception.
To add a group rule exception, select the Groups tab and click Add Exception.
2 Select the policy exception to implement.
The Add Detection Exception screen lists all available detection exceptions that you
can add to a policy.
The Add Group Exception screen lists all available group exceptions that you can add
to a policy.
See Table 18-8 on page 388.
3 If necessary, choose the profile, data identifier, or user group.
4 Click Next to configure the exception.
See “Configuring policy exceptions” on page 389.
 Configuring policies 388
Adding an exception to a policy

Table 18-8 Selecting a policy exception

Exception Prerequisite Description

Content

Content Matches Regular See “Introducing regular expression matching” on page 700.
Expression

Content Matches Keyword See “Introducing keyword matching” on page 686.

Content Matches Document Indexed Document See “Choosing an Indexed Document Profile” on page 373.
Signature Profile

Content Matches Data Identifier Data Identifier See “Introducing data identifiers” on page 612.

See “Selecting a data identifier breadth” on page 629.

Detect using Vector Machine VML Profile See “Configuring VML policy exceptions” on page 580.
Learning profile
See “Configuring VML profiles and policy conditions”
on page 568.

File Properties

Message Attachment or File Type See “About file type matching” on page 711.
Match

Message Attachment or File Size See “About file size matching” on page 713.
Match

Message Attachment or File Name See “About file name matching” on page 714.
Match

Custom File Type Signature Condition enabled See “About custom file type identification” on page 712.

Custom script
added

Protocol and Endpoint

Network Protocol See “Introducing protocol monitoring for network” on page 723.

Endpoint Protocol, Destination, See “About endpoint protocol monitoring” on page 727.
Application

Endpoint Device Class or ID See “About endpoint device detection” on page 729.

Endpoint Location See “About endpoint location detection” on page 729.

Form Recognition
 Configuring policies 389
Configuring policy exceptions

Table 18-8 Selecting a policy exception (continued)

Exception Prerequisite Description

Detect using Form Recognition Form Recognition See “About Form Recognition detection” on page 595.
Profile Profile
See “Configuring the Form Recognition exception rule”
on page 600.

Group (identity)

Sender/User Matches Pattern See “Introducing described identity matching” on page 737.

Recipient Matches Pattern

Sender/User based on a Directory User Group See “Introducing synchronized Directory Group Matching
Server Group (DGM)” on page 747.

Recipient based on a Directory See “Configuring User Groups” on page 748.

Server Group
Note: Network Prevent for Web does not support this type
of exception. Use profiled DGM instead.

Sender/User based on a Directory Exact Data Profile See “Introducing profiled Directory Group Matching (DGM)”
from: on page 754.

Recipient based on a Directory See “Configuring Exact Data profiles for DGM” on page 755.
from:

Configuring policy exceptions

At the Manage > Policies > Policy List > Configure Policy – Edit Exception screen you
configure one or more conditions for a policy exception.
See Table 18-10 on page 390.
If an exception condition matches, the system discards the matched component from the
system. This component is no longer available for evaluation.
See “Exception conditions” on page 355.

Table 18-9 Configure policy exceptions

Step Action Description

Step 1 Add a new policy exception, or See “Adding an exception to a policy” on page 387.
edit an existing exception.
Select an existing policy exception to modify it.
 Configuring policies 390
Configuring policy exceptions

Table 18-9 Configure policy exceptions (continued)

Step Action Description

Step 2 Name the exception, or edit an In the General section, enter a unique name for the exception, or modify
existing name or description. the name of an existing exception.
Note: The exception name is limited to 60 characters.

Step 3 Select the components to apply If the exception is content-based, you can match on the entire message
the exception to (if available). or on individual message components.

See “Detection messages and message components” on page 354.

Select one of the Apply Exception to options:

■ Entire Message
This option applies the exception to the entire message.
■ Matched Components Only
This option applies the exception to each message component you
select from the Match On options in the Conditions section of the
exception.

Step 4 Configure the exception condition. In the Conditions section of the Configure Policy - Edit Exception
screen, define the condition for the policy exception. The configuration
of a condition depends on the exception type.

See Table 18-10 on page 390.

Step 5 Add one or more additional
conditions to the exception
(optional).
You can add conditions until the exception is structured as desired.
See “Configuring compound match conditions” on page 392.
To add another condition to an exception, select the condition from the
Also Match list.

Click Add and configure the condition.

Step 6 Save and manage the policy. Click OK to complete the exception definition process.

Click Save to save the policy.

See “Manage and add policies” on page 395.

Table 18-10 lists the exception conditions that you can configure, with links to configuration
details.

Table 18-10 Policy exception conditions available for configuration

Exception Description

Content
 Configuring policies 391
Configuring policy exceptions

Table 18-10 Policy exception conditions available for configuration (continued)

Exception Description

Content Matches Regular Expression See “Configuring the Content Matches Regular Expression condition”
on page 702.

Content Matches Keyword See “Configuring the Content Matches Keyword condition” on page 692.

Content Matches Document Signature See “Configuring the Content Matches Document Signature policy
condition” on page 545.

Content Matches Data Identifier See “Configuring the Content Matches data identifier condition”
on page 628.

Detect using Vector Machine Learning Profile See “Configuring VML policy exceptions” on page 580.

File Properties

Message Attachment or File Type Match See “Configuring the Message Attachment or File Type Match condition”
on page 715.

Message Attachment or File Size Match See “Configuring the Message Attachment or File Size Match condition”
on page 716.

Message Attachment or File Name Match See “Configuring the Message Attachment or File Name Match condition”
on page 717.

Custom File Type Signature See “Configuring the Custom File Type Signature condition” on page 719.

Protocol and Endpoint

Network Protocol See “Configuring the Protocol Monitoring condition for network detection”
on page 724.

Endpoint Protocol or Destination See “Configuring the Endpoint Monitoring condition” on page 730.

Endpoint Device Class or ID See “Configuring the Endpoint Device Class or ID condition” on page 733.

Endpoint Location See “Configuring the Endpoint Location condition” on page 732.

Form Recognition

Detect using Form Recognition profile See “Configuring the Form Recognition exception rule” on page 600.

Group (identity)

Sender/User Matches Pattern See “Configuring the Sender/User Matches Pattern condition”
on page 739.

Recipient Matches Pattern See “Configuring the Recipient Matches Pattern condition” on page 742.
 Configuring policies 392
Configuring compound match conditions

Table 18-10 Policy exception conditions available for configuration (continued)

Exception Description

Sender/User based on a Directory Server See “Configuring the Sender/User based on a Directory Server Group
Group condition” on page 751.

Recipient based on a Directory Server Group See “Configuring the Recipient based on a Directory Server Group
condition” on page 752.

Sender/User based on a Directory from an See “Configuring the Sender/User based on a Profiled Directory
EDM Profile condition” on page 756.

Recipient based on a Directory from and See “Configuring the Recipient based on a Profiled Directory condition”
EDM Profile on page 757.

Configuring compound match conditions

You can create compound match conditions for policy rules and exceptions.
See “Configuring compound match conditions” on page 392.
The detection engine connects compound conditions with an AND. All conditions in the rule
or exception must be met to trigger or except an incident.
See “Policy detection execution” on page 357.
You are not limited to the number of match conditions you can include in a rule or exception.
However, the multiple conditions you declare in a single rule or exception should be logically
associated. Do not mistake compound rules or exceptions with multiple rules or exceptions in
a policy.
See “Use compound conditions to improve match accuracy” on page 418.

Table 18-11 Configure a compound policy rule or exception

Step Action Description

Step 1 Modify or configure an You can add one or more additional match conditions to a policy rule at the
existing policy rule or Configure Policy – Edit Rule screen.
exception.
You can add one or more additional match conditions to a rule or exception
at the Configure Policy – Edit Rule or Configure Policy – Edit Exception
screen.

Step 2 Select an additional match Select the additional match condition from the Also Match list.
condition.
This list appears at the bottom of the Conditions section for an existing rule
or exception.
 Configuring policies 393
Input character limits for policy configuration

Table 18-11 Configure a compound policy rule or exception (continued)

Step Action Description

Step 3 Review the available The system lists all available additional conditions you can add to a policy
conditions. rule or exception.

See “Adding a rule to a policy” on page 378.

See “Adding an exception to a policy” on page 387.

Step 4 Add the additional Click Add to add the additional match condition to the policy rule or exception.
condition.
Once added, you can collapse and expand each condition in a rule or
exception.

Step 5 Configure the additional See “Configuring policy rules” on page 380.
condition.
See “Configuring policy exceptions” on page 389.

Step 6 Select the same or any If the condition supports component matching, specify where the data must
component to match. match to generate or except an incident.

Same Component – The matched data must exist in the same component
as the other condition(s) that also support component matching to trigger a
match.

Any Component – The matched data can exist in any component that you
have selected.

See “About cross-component matching” on page 624.

Step 6 Repeat this process to You can add as many conditions to a rule or exception as you need.
additional match conditions
All conditions in a single rule or exception must match to trigger an incident,
to the rule or exception.
or to trigger the exception.

Step 7 Save the policy. Click OK to close the rule or exception configuration screen.

Click Save to save the policy configuration.

Input character limits for policy configuration

When configuring a policy, consider the following input character limits for policy configuration
components.
 Configuring policies 394
Input character limits for policy configuration

Table 18-12 Input character limits for policy configuration

Configuration element Input character limit

Name of a policy component, including: 60 characters

■ Policy Note: To import a policy as a template, the policy name must be less than
■ Rule 60 characters, otherwise it does not appear in the Imported Templates
■ Exception list.

■ Group
■ Condition

Description of policy component. 255 characters

Name of Data Profile, including: 255 characters

■ Exact Data
■ Indexed Document
■ Vector Machine Learning
■ Form Recognition

Data Identifier pattern limits 100 characters per line

See “Using the data identifier pattern language” on page 669.

 Chapter 19
Administering policies
This chapter includes the following topics:

■ Manage and add policies

■ Manage and add policy groups

■ Creating and modifying policy groups

■ Importing policies

■ Exporting policies

■ Cloning policies

■ Importing policy templates

■ Exporting policy detection as a template

■ Adding an automated response rule to a policy

■ Removing policies and policy groups

■ Viewing and printing policy details

■ Downloading policy details

■ Troubleshooting policies

■ Updating EDM and IDM profiles to the latest version

■ Updating policies after upgrading to the latest version

Manage and add policies

The Manage > Policies > Policy List screen is the home page for adding and managing
policies. You implement policies to detect and report data loss.
 Administering policies 396
Manage and add policies

See “Workflow for implementing policies” on page 337.

Table 19-1 lists and describes the actions you can take at the Policy List screen.

Table 19-1 Policy List screen actions

Action Description

Add a policy Click New to create a new policy.

See “Adding a new policy or policy template” on page 375.

Modify a policy Click the policy name or edit icon to modify an existing policy.

See “Configuring policies” on page 376.

Activate a policy Select the policy or policies you want to activate, then click Activate in the policy list
toolbar.

Make a policy inactive Select the policy or policies you want to make inactive, then click Suspend in the policy
list toolbar.
Note: By default, all solution pack policies are activated on installation of the solution
pack.

Sort policies Click any column header to sort the policy list.

Filter policies You can filter your policy list by Status, Name, Description, or Policy Group.

To filter your policy list, click Filter in the policy list toolbar, then select or enter your filter
criteria in the appropriate column or columns.

To remove filters from your policy list, click Clear in the policy list toolbar.

Remove a policy Select the policy or policies you want to remove, then click Delete in the policy list toolbar.

You can also click the red X icon at the end of the policy row to delete an individual
policy.
Note: You cannot remove a policy that has active incidents.

See “Removing policies and policy groups” on page 406.

Import and export policies You can import and export policies using the Import and Export buttons in the policy
list toolbar.

See “Importing policies” on page 400.

See “Exporting policies” on page 402.

Export and import policy You can export and import policy templates for reuse when authoring new policies.
templates
See “Importing policy templates” on page 404.

See “Exporting policy detection as a template” on page 405.

 Administering policies 397
Manage and add policies

Table 19-1 Policy List screen actions (continued)

Action Description

Download policy details Click Download Details in the policy list toolbar to download details for the selected
policies in the Policy List. Symantec Data Loss Prevention exports the policy details
as HTML files in a ZIP archive. Open the archive to view and print policy details.

See “Downloading policy details” on page 407.

View and print policy details To view policy details for a single policy, click the printer icon at the end of the policy
row. To print the policy details, use the print feature of your web browser.

See “Viewing and printing policy details” on page 407.

Clone a policy Select the policy or policies you want to clone, then click Clone in the policy list toolbar.

See “Cloning policies” on page 403.

Assign policies to a policy You can assign individual or multiple policies to a policy group from the policy list page.
group
Select the policy or policies you want to assign to a policy group, then click Assign
Group in the policy list toolbar. Select the policy group from the drop-down list.

See “Policy groups” on page 331.

Table 19-2 lists and describes the display fields at the Policy List screen.

Table 19-2 Policy List screen display fields

Column Description

Status The status column displays one of three states for the policy:

■ Misconfigured Policy:
The policy icon is a yellow caution sign.
See “Policy components” on page 329.
■ Active Policy:
The policy icon is green. An active policy can detect incidents.
■ Suspended Policy
The policy icon is red. A suspended policy is deployed but does not detect incidents.

Name View and sort by the name of the policy.

See “About Data Loss Prevention policies” on page 327.

Description View the description of the policy.

See “Policy templates” on page 330.

Policy Group View and sort by the policy group to which the policy is deployed.

See “Policy groups” on page 331.

 Administering policies 398
Manage and add policy groups

Table 19-2 Policy List screen display fields (continued)

Column Description

Last Modified View and sort by the date the policy was last updated.
See “Policy authoring privileges” on page 334.

Manage and add policy groups

The System > Servers and Detectors > Policy Groups screen lists the configured policy
groups in the system.
From the Policy Groups screen you manage existing policy groups and add new ones.

Table 19-3 Policy Groups screen actions

Action Description

Add a policy group Click Add Policy Group to define a new policy group.

See “Policy groups” on page 331.

Modify a policy group To modify an existing policy group, click the name of the group, or click the pencil icon to
the far right of the row.

See “Creating and modifying policy groups” on page 399.

Remove a policy group Click the red X icon to the far right of the row to delete that policy group from the system.
A dialog box confirms the deletion.
Note: If you delete a policy group, you delete any policies that are assigned to that group.

See “Removing policies and policy groups” on page 406.

View policies in a group To view the policies deployed to an existing policy group, navigate to the System > Servers
and Detectors > Policy Groups > Configure Policy Group screen.

See “Creating and modifying policy groups” on page 399.

Table 19-4 Policy Groups screen display fields

Column Description

Name The name of the policy group.

Description The description of the policy group.

Available Servers and The detection server or cloud detector to which the policy group is deployed.
Detectors
See “Policy deployment” on page 332.
 Administering policies 399
Creating and modifying policy groups

Table 19-4 Policy Groups screen display fields (continued)

Column Description

Last Modified The date the policy group was last modified.

Actions You can edit or delete policy groups using the icons in the Actions column.

Creating and modifying policy groups

At the System > Servers and Detectors > Policy Groups screen you configure a new policy
group or modify an existing one.
See “Policy groups” on page 331.
To configure a policy group
1 Add a new policy group, or modify an existing one.
See “Manage and add policy groups” on page 398.
2 Enter the Name of the policy group, or modify an existing name.
Use an informative name. Policy authors and Enforce Server administrators rely on the
policy group name when they associate the policy group with policies, roles, targets.
The name value is limited to 256 characters.
3 Enter a Description of the policy group, or modify an exiting description of an existing
policy group.
4 Select one or more Servers and Detectors to assign the policy group to.
The system displays a check box for each detection server currently configured and
registered with the Enforce Server.
■ Select (check) the All Servers or Detectors option to assign the policy group to all
detection servers and cloud detectors in your system. If you leave this checkbox
unselected, you can assign the policy group to individual servers.
The All Discover Servers entry is not configurable because the system automatically
assigns all policy groups to all Network Discover Servers. This feature lets you assign
policy groups to individual Discover targets.
See “Configuring the required fields for Network Discover targets” on page 1534.
■ Deselect (uncheck) the All Servers or Detectors option to assign the policy group to
individual detection servers.
The system displays a check box for each server currently configured and registered
with the Enforce Server.
 Administering policies 400
Importing policies

Select each individual detection server to assign the policy group.

5 Click Save to save the policy group configuration.

Note: The Policies in this Group section of the Polices Group screen lists all the policies in
the policy group. You cannot edit these entries. When you create a new policy group, this
section is blank. After you deploy one or more policies to a policy group (during policy
configuration), the Policies in this Group section displays each policy in the policy group.

See “Configuring policies” on page 376.

See “Policy deployment” on page 332.

Importing policies
You can export policies from an Enforce Server and import them to another Enforce Server.
This feature makes it easier to move policies from one environment to another. For example,
you can export policies from your test environment and import them into your production
environment.

About importing policies

To import policies, you must have the Import Policies privilege. To enable this privilege, you
must also have the Server Administration, Author Policies, Author Response Rules, and
All Policy Groups privileges.
See “Configuring roles” on page 98.
When you import a policy, please note the following points:
■ The policy is imported in the same state in which it was exported. For example, if a policy
was active when it was exported, it will be active when you import it. The only exception
to this behavior is for pre-existing policies on system to which you are importing the policy
(the "target system"). If the existing policy is active, then the imported policy will also be
active, regardless of its state on the exporting system.
■ Imported policies will overwrite existing policies that have the same name. You can change
the name of the exported policy in the XML file if you want to import it without overwriting
the existing policy.
■ If the policy group to which the exported policy belonged exists on the target system, the
policy will be added to that policy group, or overwrite a policy of the same name in that
group. If the policy group does not exist on the target system, it will be created upon import.
If the policy exists on the target system, but it belongs to a different policy group, the
imported policy will be assigned to a newly created policy group on the target system, and
will not overwrite the existing policy.
 Administering policies 401
Importing policies

■ When you import a policy, you can choose whether or not to import its response rules if
those rules conflict with existing response rules on the target system.
■ The Policy Import Preview page will display warnings about any policy elements that will
be created or overwritten when you import the policy.
■ You can only import one policy at a time.
To import a policy
1 Navigate to Manage > Policies > Policy List.
2 Click Import.
The Import Policy page appears.
3 Click Browse to select the exported policy file you want to import.
4 Click Import Policy.
The Policy import preview page appears. This page will warn you of any policy elements
that may be overwritten when you import this policy. If the policy you are importing includes
any response rules among the elements that may be overwritten, you can exclude those
response rules from import on this page.
5 Click Proceed with import.
The policy is imported. If the policy has any unresolved references, the Policy References
Check page appears.
You can resolve any unresolved policy references on this page.
See “About policy references” on page 401.

About policy references

Policies are exported in XML format. The XML policy files contain policy metadata, references
to any data profiles, response rules, data identifiers, and the detection and group rules and
exceptions. The files do not contain the actual data profiles, directory connections, credentials,
or FlexResponse plug-ins. You must provide those items on the system into which you are
importing the policy.
When you import a policy, Symantec Data Loss Prevention will alert you to any unresolved
references on the Policy References Check page. The Policy References Check page
displays at the end of the policy import process. You can also view this page by clicking the
unresolved references icon on the Policy List and Policy Edit pages.
To resolve policy references, click the edit (pencil) icon on the Policy References Check
page. Symantec Data Loss Prevention displays the appropriate edit page for each unresolved
reference.Table 19-5 provides information about resolving policy references.
 Administering policies 402
Exporting policies

Table 19-5 Resolving policy references

Unresolved policy reference Resolution

Policy group where no detection server is specified: Select detection servers for the policy group.

Directory connection with missing credentials: Provide the credentials for the directory connection.

EDM profile with missing source file and index: Specify the correct data source file.

IDM profile with missing import path and file name: Specify the correct data source.

Remote IDM profile with missing credentials: Provide the credentials for the remote IDM profile.

VML profile with trained profile and related data Provide the trained profile and its related data, train
missing: and accept the VML profile.

Form Recognition profile with missing gallery ZIP Provide the gallery ZIP archive.
archive:

Endpoint quarantine response rule with missing Provide the credentials for the endpoint quarantine
saved credentials: response rule.

Response rule with a missing Server FlexResponse Deploy the Server FlexResponse JAR file on the
plug-in: target system.

See “Deploying a Server FlexResponse plug-in”

on page 1586.

Exporting policies
You can export your policy data to an XML file to easily share policies between Enforce Servers.

About policy export

Policies are exported in XML format. The XML policy files contain policy metadata, references
to any data profiles, response rules, data identifiers, and the detection and group rules and
exceptions. The files do not contain the actual data profiles, directory connections, credentials,
or FlexResponse plug-ins. You must copy those items to the system into which you are importing
the policy.
You can export policies individually or multiply. To export policies, you must have the Author
Policies privilege.
See “Configuring roles” on page 98.
Exported policies include the following items:
■ Policy name, description, and policy group
 Administering policies 403
Cloning policies

■ Policy rules, including Form Recognition, EDM, IDM, and VML definitions
■ Endpoint locations and devices
■ Sender and recipient patterns
■ Response rules
■ Data identifiers
■ Custom protocols
Exported policies do not include the following items:
■ Credentials
■ Form Recognition, EDM, IDM, or VML indexes
■ Form Recognition, EDM or IDM data source files
■ VML training files
■ FlexResponse plug-ins
To export policies
1 Navigate to Manage > Policies > Policy List.
2 Take one of the following actions:
■ To export a single policy, click the export icon for that policy.
■ To export multiple policies to a ZIP archive, select the policies you want to export, then
click Export.

3 Symantec Data Loss Prevention exports your policy or policies using the following naming
conventions:
■ For single policies, the naming convention is
ENFORCEHOSTNAME-POLICYNAME-DATE-TIME.XML.

■ For bulk policy export, the naming convention is

ENFORCEHOSTNAME-policies-DATE-TIME.ZIP.

Cloning policies
You can clone policies from the Policy List page.
Cloned policies are exact copies of the original policy. They include the following items:
■ Modified policy name, description, and policy group.
Cloned policies appear in the Policy List as Copy N of original policy name.
■ Policy rules, including Form Recognition, EDM, IDM, and VML definitions
 Administering policies 404
Importing policy templates

■ Endpoint locations and devices

■ Sender and recipient patterns
■ Response rules
■ Data identifiers
■ Custom protocols

Note: You must have policy authoring privileges to clone policies.

For information about importing and exporting policies and policy templates, see these topics:
See “Exporting policies” on page 402.
See “Importing policies” on page 400.
See “Exporting policy detection as a template” on page 405.
See “Importing policy templates” on page 404.

Importing policy templates

You can import one or more policy templates to the Enforce Server. You must have policy
system privileges to import policy templates.
See “Policy template import and export” on page 336.
See “Exporting policy detection as a template” on page 405.
To import one or more policy templates to the Enforce Server
1 Place one or more policy templates XML file(s) in the
\SymantecDLP\Protect\config\templates directory on the Enforce Server host.

You can import multiple policy templates by placing them all in the templates directory.
2 Make sure that the directory and file(s) are readable by the "protect" system user.
3 Log on to the Enforce Server Administration Console with policy authoring privileges.
4 Navigate to Manage > Policies > Policy List and click Add Policy.
5 Choose the option Add a policy from a template and click Next.
6 Scroll down to the bottom of the template list to the Imported Templates section.
You should see an entry for each XML file you placed in the templates directory.
7 Select the imported policy template and click Next to configure it.
See “Configuring policies” on page 376.
 Administering policies 405
Exporting policy detection as a template

Exporting policy detection as a template

You can export policy detection rules and exceptions in a template (XML file). You cannot
export policy response rules. You can only export one policy template at a time.
See “Policy template import and export” on page 336.
To export a policy as a template
1 Log on to the Enforce Server administration console with administrator privileges.
2 Navigate to the Manage > Policies > Policy List > Configure Policy screen for the policy
you want to export.
3 At the bottom of the Configure Policy screen, click the Export this policy as a template
link.
4 Save the policy to a local or network destination of your choice.
For example, the system exports a policy named Webmail to the policy template file
Webmail.xml which you can save to your local drive.

See “Importing policy templates” on page 404.

For information about importing, exporting, and cloning policies, see these topics:
See “Exporting policies” on page 402.
See “Importing policies” on page 400.
See “Cloning policies” on page 403.

Adding an automated response rule to a policy

You can add one or more automated response rules to a policy to take action when that policy
is violated.
See “About response rules” on page 1199.

Note: Smart response rules are executed manually and are not deployed with policies.

To add an automated response rule to a policy

1 Log on to the Enforce Server administration console with policy authoring privileges.
See “Policy authoring privileges” on page 334.
2 Navigate to the Manage > Policies > Policy List > Configure Policy screen for the policy
you want to add a response rule to.
 Administering policies 406
Removing policies and policy groups

3 Select the response rule you want to add from those available in the drop-down menu.
Policies and response rules are configured separately. To add a response rule to a policy,
the response rule must first be defined and saved independently.
See “Implementing response rules” on page 1216.
4 Click Add Response Rule to add the response rule to the policy.
5 Repeat the process to add additional response rules to the policy.
6 Save the policy when you are done adding response rules.
7 Verify that the policy status is green after adding the response rule to the policy.
See “Manage and add policies” on page 395.

Note: If the policy status is a yellow caution sign, the policy is misconfigured. The system does
not support certain pairings of detection rules and automated response rule actions. See
Table 73-2 on page 1717.

Removing policies and policy groups

Consider the following guidelines before you delete a policy or a policy group from the Enforce
Server.

Table 19-6 Guidelines for removing policies and policy groups

Action Description Guideline

Remove a If you attempt to delete a policy that has If you want to delete a policy, you must first delete all
policy associated incidents, the system does incidents that are associated with that policy from the
not let you remove the policy. Enforce Server.

See “Manage and add policies” on page 395.

An alternative is to create an undeployed policy group (one

that is not assigned to any detection servers). This method
is useful to maintain legacy policies and incidents for review
without keeping these policies in a deployed policy group.

See “Policy template import and export” on page 336.

 Administering policies 407
Viewing and printing policy details

Table 19-6 Guidelines for removing policies and policy groups (continued)

Action Description Guideline

Remove a If you attempt to delete a policy group Before you delete a policy group, remove any policies from
policy group that contains one or more policies, the that group by either deleting them or assigning them to
system displays an error message. And, different policy groups.
the policy group is not deleted.
See “Manage and add policy groups” on page 398.

If you want to remove a policy group, create a maintenance

policy group and move the policies you want to remove to
the maintenance group.

See “Creating and modifying policy groups” on page 399.

See “About Data Loss Prevention policies” on page 327.

See “Policy groups” on page 331.

Viewing and printing policy details

You can view and print policy details for a single policy from the Policy List screen.
You must have the Author Policies privilege for the policies you want to view and print.
See “Policy authoring privileges” on page 334.
See “Viewing, printing, and downloading policy details” on page 338.
To view and print policy details
1 Navigate to Manage > Policies > Policy List and click the printer icon at the end of the
policy row.
The Policy Snapshot screen appears.
2 View the general policy information, detection rules, and response rules on the Policy
Snapshot screen.
3 To print the policy details, use the Print command in your web browser from the Policy
Snapshot screen.

Downloading policy details

You can download a ZIP archive of details for policies in the Policy List. The ZIP archive
contains HTML documents with details for each selected policy on the Policy List, as well as
an index file to make it easier to find the policy details you want. The files are titled using the
policy ID, such as 123.html. The index file is titled downloaded_policies_DATE.html, and it
 Administering policies 408
Troubleshooting policies

contains the policy name, description, status, policy group, and last modified date of all selected
policies in the download, as well as links to the policy details.
You must have the Author Policies privilege for the policies you want to download.
See “Policy authoring privileges” on page 334.
See “Viewing, printing, and downloading policy details” on page 338.
To download policy details
1 Navigate to Manage > Policies > Policy List, select the policy or policies you want, then
click Download Details.
2 In the Open File dialog box, click select Save File, then click OK.
3 To view details for a policy, extract the files from the ZIP archive, then open the file you
want to view. Use the index file to search through the downloaded policies by policy name,
description, status, policy group, or last modified date.
The Policy Snapshot screen appears.
4 To print the policy details, use the Print command in your web browser from the Policy
Snapshot screen.

Troubleshooting policies
Table 19-7 lists log files to consult for troubleshooting policies.

Table 19-7 Log files for troubleshooting policies

Log file Description

VontuMonitor.log Logs when policies and profiles are sent from the Enforce Server to
detection servers and endpoint servers. Displays JRE errors.

See “Debug log files” on page 297.

detection_operational.log Log the loading of policies and detection execution.

detection_operational_trace.log See “Operational log files” on page 294.

FileReader.log Logs when an index file is loaded into memory. For EDM, look for the
line "loaded database profile." For IDM look for the line: "loaded
document profile."

See “Debug log files” on page 297.

Indexer.log Logs the operations of the Indexer process to generate EDM and IDM
indexes.

See “Debug log files” on page 297.

 Administering policies 409
Updating EDM and IDM profiles to the latest version

See “About log files” on page 293.

See “Log collection and configuration screen” on page 301.
See “Configuring server logging behavior” on page 301.
See “Collecting server logs and configuration files” on page 306.
See “Log files for troubleshooting VML training and policy detection” on page 586.
See “Advanced server settings” on page 245.
See “Advanced agent settings” on page 1804.

Updating EDM and IDM profiles to the latest version

Symantec Data Loss Prevention version 14.0 provides several significant updates to Exact
Data Matching (EDM) and Indexed Document Matching (IDM) technologies.
To use these new features on an upgraded system, you must reindex your data and document
sources. Before deploying an index into production, you should test the updated profile and
policies based on it to ensure that they detect data loss as expected on the upgraded system.
Table 19-8 lists the reindexing requirements for updating your EDM and IDM profiles to version
14.0 and provides links for more information.

Table 19-8 Reindexing requirements for EDM and IDM data profiles

Technology and features Required action(s) More information

Exact Data Matching (EDM) If you have existing Exact Data profiles supporting
EDM policies and you want to use new EDM
■ Multi-token matching
features, before upgrading the detection server(s)
■ Proportional proximity
you must:
range
■ Reindex each structured data source using a
14.0-compatible EDM indexer, and
■ Load each index into a 14.0-generated Exact
Data profile.
See “Updating EDM indexes to the
latest version” on page 470.
In addition, refer to the chapter
"Updating EDM indexes to the latest
version" in the Symantec Data Loss
Prevention Administration Guide and
the online Help.

Indexed Document If you have existing Indexed Document profiles Or, refer to the topic "Using Agent IDM
Matching (IDM) supporting IDM policies and you want to use after upgrade to version 14.0" in the
Agent IDM, after upgrading to 14.0 you must: Symantec Data Loss Prevention
■ Exact match IDM on the
Administration Guide and the online
endpoint (Agent IDM) ■ Disable two-tier detection on the Endpoint
Help.
Server, and
■ Reindex each document data source so that
the endpoint index is generated and deployed
to the Endpoint Server for download by the
DLP Agent.
 Administering policies 410
Updating policies after upgrading to the latest version

Updating policies after upgrading to the latest version

Several policy templates were updated at Symantec Data Loss Prevention 12.5. If you are
upgrading from a release prior to version 12.5, on upgrade the system updates the
system-defined policy templates. Policies you have created based on an upgraded policy
template are not changed so that configurations you have made are not overwritten. If you
have created policies based on one or more of the updated policy templates, you should update
your policies so that they are current.
The HIPAA and HITECH (including PHI) and the Caldicott Report policy templates are
updated with recent Drug, Disease, and Treatment keyword list terminology based on
information from the U.S. Federal Drug Administration (FDA) and other sources. Symantec
recommends that you update policies derived from these templates with the updated Drug,
Disease, and Treatment keyword lists.
See “Updating the Drug, Disease, and Treatment keyword lists for your HIPAA and Caldicott
policies” on page 696.
In addition, policy templates that use data identifier patterns to detect Social Security Numbers
(SSNs) are updated to use the Randomized US SSN data identifier, which detects both
traditional and randomized SSNs. Symantec recommends that you update your SSN policies
to use the Randomized US SSN data identifier.
See “Updating policies to use the Randomized US SSN data identifier” on page 665.
Table 19-9 lists the policy templates updated for this release of Symantec Data Loss Prevention.

Table 19-9 Policy templates updated in Data Loss Prevention version 12.5

Updated template Updated component(s) Policy description

Caldicott Report Drug, Disease, and Treatment See “Caldicott Report policy template” on page 1085.
keyword lists

Customer Data Protection Randomized US SSN data See “Customer Data Protection policy template”
identifier on page 1091.

Employee Data Protection Randomized US SSN data See “Employee Data Protection policy template”
identifier on page 1098.

FACTA 2003 (Red Flag Randomized US SSN data See “FACTA 2003 (Red Flag Rules) policy template”
Rules) identifier on page 1101.

Gramm-Leach-Bliley Randomized US SSN data See “Gramm-Leach-Bliley policy template”

identifier on page 1150.
 Administering policies 411
Updating policies after upgrading to the latest version

Table 19-9 Policy templates updated in Data Loss Prevention version 12.5 (continued)

Updated template Updated component(s) Policy description

HIPAA and HITECH (including Drug, Disease, and Treatment See “HIPAA and HITECH (including PHI) policy
PHI) keyword lists template” on page 1152.

Randomized US SSN data

identifier

State Data Privacy Randomized US SSN data See “State Data Privacy policy template” on page 1184.
identifier

US Social Security Numbers Randomized US SSN data See “US Social Security Numbers policy template”
identifier on page 1191.
 Chapter 20
Best practices for authoring
policies
This chapter includes the following topics:

■ Best practices for authoring policies

■ Develop a policy strategy that supports your data security objectives

■ Use a limited number of policies to get started

■ Use policy templates but modify them to meet your requirements

■ Use the appropriate match condition for your data loss prevention objectives

■ Test and tune policies to improve match accuracy

■ Start with high match thresholds to reduce false positives

■ Use a limited number of exceptions to narrow detection scope

■ Use compound conditions to improve match accuracy

■ Author policies to limit the potential effect of two-tier detection

■ Use policy groups to manage policy lifecycle

■ Follow detection-specific best practices

Best practices for authoring policies

This section provides general policy authoring best practices for Symantec Data Loss
Prevention. This section assumes that the reader has general familiarity with policy authoring,
including the configuration, testing, and deployment of policies, detection rules, match
conditions, and policy exceptions
 Best practices for authoring policies 413
Best practices for authoring policies

See “About Data Loss Prevention policies” on page 327.

See “Detecting data loss” on page 340.
Best practices are not intended to provide detailed troubleshooting guidance. Rather, it is goal
of this section to provide best practices that, when followed, will proactively help to reduce the
need for policy troubleshooting and support.

Table 20-1 Summary of policy authoring best practices

Best practice Description

Develop a policy strategy that supports your data security See “Develop a policy strategy that supports your data
objectives. security objectives” on page 414.

Use a limited number of policies to get started. See “Use a limited number of policies to get started”
on page 414.

Use policy templates but modify them to meet your See “Use policy templates but modify them to meet your
requirements. requirements” on page 415.

Use policy groups to manage policy lifecycle. See “Use policy groups to manage policy lifecycle”
on page 420.

Use the appropriate match condition for your data loss See “Use the appropriate match condition for your data
prevention objectives. loss prevention objectives” on page 415.

Test and tune policies to improve match accuracy. See “Test and tune policies to improve match accuracy”
on page 416.

Start with high match thresholds to reduce false positives. See “Start with high match thresholds to reduce false
positives” on page 417.

Use a limited number of exceptions to narrow detection See “Use a limited number of exceptions to narrow
scope. detection scope” on page 418.

Use compound conditions to improve match accuracy. See “Use compound conditions to improve match
accuracy” on page 418.

Author policies to limit the potential effect of two-tier See “Author policies to limit the potential effect of two-tier
detection. detection” on page 419.

Follow detection-specific best practices. See “Follow detection-specific best practices” on page 420.
 Best practices for authoring policies 414
Develop a policy strategy that supports your data security objectives

Develop a policy strategy that supports your data

security objectives
The goal of detection is to achieve accurate results based on true policy matches. Well-authored
policies should accurately detect the data you want to protect with minimal false positives.
Through the use of well-defined policies that implement the right type and combination of rules,
conditions, and exceptions, you can achieve accurate detection results and prevent the loss
of the most critical data in your enterprise
There are two general approaches to developing a data loss prevention policy strategy:
■ Information-driven – Identify sensitive data and author policies to prevent it from being lost.
■ Regulation-driven– Review government and industry regulations and author policies to
comply with them.
Table 20-2 describes these two approaches in more detail.

Table 20-2 Policy detection approaches

Approach Description

Information-driven With this approach you start by identifying specific data items and data combinations you
want to protect. Examples of such data may include fields profiled from a database, a list of
keywords, a set of users, or a combination of these elements. You then group similar data
items together and create policies to identify and protect them. This approach works best
when you have limited access to the data or no particular concerns about a given regulation.

Regulation-driven With this approach you begin with a policy template based on the regulations with which you
must comply. Examples of such templates may include HIPAA or FACTA. Also, begin with
a large set of data (such as customer or employee data). Use the high-level requirements
stipulated by the regulations as the basis for this approach. Then, decide what sensitive data
items and documents in your enterprise meet these requirements. These data items become
the conditions for the detection rules and exceptions in your policies.

Use a limited number of policies to get started

The policy detection rules you implement are based on your organization's information security
objectives. The actions you take in response to policy violations are based on your organization's
compliance requirements. In general you should start small with policy detection. Enable one
or two policy templates, or a few simple conditions, such as keyword matching. Review the
incidents each policy detects. Tune the results before you implement response rules to take
action.
Generally it is better to have fewer policies that are configured to address specific data loss
prevention objectives rather than many policies that attempt to address all of your security
 Best practices for authoring policies 415
Use policy templates but modify them to meet your requirements

requirements. Having too many policies can impact the performance of the system and can
lead to too many false positives.
See “Test and tune policies to improve match accuracy” on page 416.

Use policy templates but modify them to meet your

requirements
Policy templates provide an excellent starting point for authoring policies. Symantec Data Loss
Prevention provides 65 pre-built policy templates that contain detection rules and conditions
for many different types of use cases, including regulatory compliance, data protection, security
enforcement, and acceptable use scenarios.
You should use the system-provided policy templates as starting points for your policies. Doing
so will save time and help you avoid errors and information gaps in your policies since the
detection methods are predefined. However, for most situations you will want to modify the
policy template and tailor it for your specific environment. Deploying a policy template
out-of-the-box without configuring it for your environment is not recommended.
See “Creating a policy from a template” on page 360.

Use the appropriate match condition for your data

loss prevention objectives
To prevent data loss, it is necessary to accurately detect all types of confidential data wherever
that data is stored, copied, or transmitted. To meet your data security objectives, you need to
implement the appropriate detection methods for the type of data you want to protect. The
recommendation is to determine the detection methods that work best for you, and tune the
policies as necessary based on the results of your detection testing.
Table 20-3 describes the primary use case for each type of policy match condition provided
by Data Loss Prevention.

Table 20-3 Match conditions compared

Type of data you want to protect Condition Matching

Personally Identifiable Information (PII), such as EDM Exact profiled data

SSNs, CCNs, and Driver's License numbers
Data Identifiers Described, validated data patterns
 Best practices for authoring policies 416
Test and tune policies to improve match accuracy

Table 20-3 Match conditions compared (continued)

Type of data you want to protect Condition Matching

Confidential documents, such as Microsoft Word, IDM Exact file contents

PowerPoint, PDF, etc.
Partial file contents (derivative)

VML Similar file contents

Confidential files and images, such as CAD IDM Exact file

drawings
File Properties File context (type, name, size)

Words and phrases, such as "Confidential" or Keywords Exact words, phrases, proximity
"Proprietary"

Characters, strings, text Regular Expressions Described text

Network and endpoint communications Protocol and Endpoint Protocols, destinations, monitoring

Determined by the identity of the user, sender, Synchronized DGM Exact identity from LDAP server
recipient
Profiled DGM Exact profiled identity

Sender/user, recipient Described identity patterns

Describes a document, such as author, title, date, Content-based conditions File type metadata
etc.

Test and tune policies to improve match accuracy

When you create detection policies, there are two common detection problems to avoid. If you
create a policy that is too general or too broad, it generates incidents when no real match has
occurred (false positive). On the other hand, if a policy has rules that are too specific or narrow
about the data it detects, the policy may miss some of the matches you intend to catch (false
negatives). Table 20-4 describes these common problems in more detail.
To reduce false positives and negatives, you need to tune your policies. The best way to tune
detection is to identify a single, specific use case that is a priority, such as protecting source
code for a particular product. You then create a single policy—either from scratch or based
on a template, depending on your DLP strategy—containing one or two detection rules and
test the policy to see how many (quantity) and the types (quality) of incidents the policy
generates. Based on these initial results, you adjust the detection rule(s) as needed. If the
policy generates more false positives than you want, make the detection rule(s) more specific
by fine-tuning the existing match conditions, adding additional match conditions, and creating
policy exceptions. If the policy does not detect some incidents, make the detection condition(s)
less specific.
 Best practices for authoring policies 417
Start with high match thresholds to reduce false positives

As your policies mature, it is important to continuously test and tune them to ensure ongoing
accuracy.
See “Follow detection-specific best practices” on page 420.

Table 20-4 Common detection problems to avoid

Problem Cause Description

False positives Policy rules too False positives create high costs in time and resources that are required to
general or broad investigate and resolve apparent incidents that are not actual incidents. Since
many organizations do not have the capacity to manage excess false positives,
it is important that your policies define contextual rules to improve accuracy.

For example, a policy is designed to protect customer names and generates an

incident for anything that contains a first and last name. Since most messages
contain a name—in many cases both first and last names—this policy is too broad
and general. Although it may catch all instances of customer names being sent
outside the network, this policy will return too many false positives by detecting
email messages that do not divulge protected information. First and last names
require a much greater understanding of context to determine if the data is
confidential

False Policy rules too False negatives obscure gaps in security by allowing data loss, the potential for
negatives tight or narrow financial losses, legal exposure, and damage to the reputation of an organization.
False negatives are especially dangerous because you do not know you have
lost sensitive data.

For example, a policy that contains a keyword match on the word "confidential"
but also contains a condition that excludes all Microsoft Word documents would
be too narrow and be suspect to false negatives because it would likely miss
detecting many actual incidents contained in such documents

See “Start with high match thresholds to reduce false positives” on page 417.
See “Use a limited number of exceptions to narrow detection scope” on page 418.
See “Use compound conditions to improve match accuracy” on page 418.

Start with high match thresholds to reduce false

positives
For content-based detection rules, there is a configuration setting that lets you "count all
matches" but only report an incident after a threshold number of matches has been reached.
The general recommendation is to start with high match thresholds for your content-based
detection policies. As you tune your policies you can reduce the match thresholds to be more
precise.
 Best practices for authoring policies 418
Use a limited number of exceptions to narrow detection scope

See “Configuring match counting” on page 384.

Use a limited number of exceptions to narrow

detection scope
You can implement exception conditions for any detection rule, except EDM rules. The limited
use of exception conditions can help to reduce false positives by narrowing the scope of policy
detection. However, if you need to use several exceptions in a single policy to achieve the
desired detection results, reconsider the design of the policy. Make sure the policy is
well-defined and uses the proper match conditions.

Caution: Too many compound exceptions in a policy can cause system performance issues.
You should avoid the use of compound exceptions as much as possible.

It is important to understand how exception conditions work so you can use them properly.
Exception conditions disqualify messages from creating incidents. Exception conditions are
checked first by the detection server before match conditions. If the exception condition matches,
the system immediately discards the entire message or message component that met the
exception. There is no support for match-level exceptions. Once the message or message
component is discarded by meeting an exception, the data is no longer available for policy
evaluation.
See “Exception conditions” on page 355.
See “Use compound conditions to improve match accuracy” on page 418.

Use compound conditions to improve match accuracy

Compound conditions can help you improve the match accuracy of your policies. Suppose
you are concerned about Microsoft Word documents leaving the network. Initially, you add a
policy that uses an attachment type condition to catch all Word files. You quickly discover that
too many messages contain Word file attachments that do not divulge protected information.
When you examine the incidents more closely, you realize that you are more concerned with
Word files that contain the word CONFIDENTIAL. In this case you can convert the attachment
type condition to a compound rule by adding a keyword rule for the word CONFIDENTIAL.
Such a configuration would achieve more accurate detection results.
See “Compound conditions” on page 356.
 Best practices for authoring policies 419
Author policies to limit the potential effect of two-tier detection

Author policies to limit the potential effect of two-tier

detection
The Exact Data Matching (EDM) and profiled Directory Group Matching (DGM) conditions
require two-tier detection. For these conditions, the DLP Agent must send the data to the
Endpoint Server for evaluation. Indexed Document Matching (IDM) uses two-tier detection if
it is enabled.
See “Two-tier detection for DLP Agents” on page 358.
On the endpoint the DLP Agent executes the least expensive rules first. If you are deploying
a policy to the endpoint that requires two-tier detection, you can author the policy in such a
way to limit the potential effect of two-tier detection.
Table 20-5 provides some considerations for authoring policies to limit the potential effect of
two-tier detection.
See “Detection messages and message components” on page 354.

Table 20-5 Policy configurations for two-tier detection rules

Two-tier match condition Policy configuration

Exact Data Matching (EDM)
For EDM policies, consider including Data Identifier rules OR'd with EDM rules.
For example, for a policy that uses an EDM condition to match social security
numbers, you could add a second rule that uses the SSN Data Identifier condition.
The Data Identifier does not require two-tier detection and is evaluated locally by
the DLP Agent. If the DLP Agent is not connected to the Endpoint Server when
the DLP Agent receives the data, the DLP Agent can still perform SSN pattern
matching based on the Data Identifier condition.

See “Combine Data Identifiers with EDM rules to limit the impact of two-tier
detection” on page 510.

For example policy configurations, each of the policy templates that provide EDM
conditions also provide corresponding Data Identifier conditions.

See “Choosing an Exact Data Profile” on page 371.

 Best practices for authoring policies 420
Use policy groups to manage policy lifecycle

Table 20-5 Policy configurations for two-tier detection rules (continued)

Two-tier match condition Policy configuration

Indexed Document Matching For IDM policies that match file contents, consider using VML rules OR'd with IDM
(IDM) rules. VML rules do not require two-tier detection and are executed locally by the
DLP Agent. If you do not need to match file contents exactly, you may want to use
VML instead of IDM.

See “Use the appropriate match condition for your data loss prevention objectives”
on page 415.

If you are only concerned with file matching, not file contents, consider using
compound file property rules instead of IDM. File property rules do not require
two-tier detection.

See “Use compound file property rules to protect design and multimedia files”
on page 720.

Directory Group Matching (DGM) For the synchronized DGM Recipient condition, consider including a Recipient
Matches Pattern condition OR'd with the DGM condition. The pattern condition
does not require two-tier detection and is evaluated locally by the DLP Agent.

See “About two-tier detection for synchronized DGM” on page 748.

Use policy groups to manage policy lifecycle

Use policy groups to test policies before using them in production. Create a test policy group
to which only you have access. Then, create policies and add them to the test policy group.
Review the incidents your test policies capture. After you tune the policies and confirm that
they capture the expected incidents, you can rename the policy group and grant the appropriate
roles access to it. You can also use policy groups to manage legacy policies, as well as policies
you want to import or export.
See “Policy groups” on page 331.
See “Removing policies and policy groups” on page 406.

Follow detection-specific best practices

In additional to these general policy authoring considerations, you should be aware of and
keep in mind policy tuning considerations specific to each type of match condition.
Table 20-6 lists detection specific considerations, with links to topics for more information.
 Best practices for authoring policies 421
Follow detection-specific best practices

Table 20-6 Best practices for specific detection methods

Detection method Description

EDM See “Best practices for using EDM” on page 501.

IDM See “Best practices for using IDM” on page 547.

VML See “Best practices for using VML” on page 587.

Data identifiers See “Best practices for using data identifiers” on page 681.

Keywords See “Best practices for using keyword matching” on page 697.

Regular expressions See “Best practices for using regular expression matching” on page 703.

Non-English language See “Best practices for detecting non-English language content” on page 707.
detection

File properties See “Best practices for using file property matching” on page 720.

Network protocols See “Best practices for using network protocol matching” on page 725.

Endpoint events See “Best practices for using endpoint detection” on page 736.

Described identities See “Best practices for using described identity matching” on page 744.

Synchronized DGM See “Best practices for using synchronized DGM” on page 753.

Profiled DGM See “Best practices for using profiled DGM” on page 758.

Metadata detection See “Best practices for using metadata detection” on page 788.
 Chapter 21
Detecting content using
Exact Data Matching (EDM)
This chapter includes the following topics:

■ Introducing Exact Data Matching (EDM)

■ Configuring Exact Data profiles

■ Configuring EDM policies

■ Using multi-token matching

■ Updating EDM indexes to the latest version

■ Memory requirements for EDM

■ Remote EDM indexing

■ Best practices for using EDM

Introducing Exact Data Matching (EDM)

Exact Data Matching (EDM) is designed to protect your most sensitive content. You can use
EDM to detect personally identifiable information (PII)—such as social security numbers, bank
account numbers, credit card numbers—confidential customer and employee records, and
other confidential data stored in a structured data source, such as a database, directory server,
or a structured data file such as CSV or spreadsheet.
To implement EDM policies, you identify and prepare the data you want to protect. You create
an Exact Data Profile and index the structured data source using the Enforce Server
administration console, or remotely using the Remote EDM Indexer. During the indexing
process, the system fingerprints the data by accessing and extracting the text-based content,
 Detecting content using Exact Data Matching (EDM) 423
Introducing Exact Data Matching (EDM)

normalizing it, and securing it using a nonreversible hash. You can schedule indexing on a
regular basis so the data is current.
Once you have profiled the data, you configure the Content Matches Exact Data condition
to match individual pieces of the indexed data. For increased accuracy you can configure the
condition to match combinations of data fields from a particular record. The EDM policy condition
matches on data coming from the same row or record of data. For example, you can configure
the EDM policy condition to look for any three of First Name, Last Name, SSN, Account Number,
or Phone Number occurring together in a message and corresponding to a record from your
customer database.
Once the policy is deployed to one or more detection servers, the system can detect the data
you have profiled in either structured or unstructured format. For example, you could deploy
the EDM policy to a Network Discover Server and scan data repositories for confidential data
matching data records in the index. Or, you could deploy the EDM policy to a Network Prevent
for Email Server to detect records in email communications and attachments, such as Microsoft
Word files. If the attachment is a spreadsheet, such as Microsoft Excel, the EDM policy can
detect the presence of confidential records there as well.
See “About the Exact Data Profile and index” on page 426.

About using EDM to protect content

To understand how EDM works, consider the following example. Your company maintains an
employee database that contains the following column fields:
■ First Name
■ Last Name
■ SSN
■ Date of Hire
■ Salary
In a structured data format such as a database, each row represents one record, with each
record containing values for each column data field. In this example, each row in the database
contains information for one employee, and you can use EDM to protect each record. For
example, one row in the data source file contains the following pipe ("|") delimited record:
First Name | Last Name | SSN | Date of hire | Salary
Bob | Smith | 123-45-6789 | 05/26/99 | $42500

You create an Exact Data Profile and index the data source file. When you configure the profile,
you map the data field columns to system-defined patterns and validate the data. You then
configure the EDM policy condition that references the Exact Data Profile. In this example, the
condition matches if a message contains all five data fields.
 Detecting content using Exact Data Matching (EDM) 424
Introducing Exact Data Matching (EDM)

The detection server reports a match if it detects the following in any inbound message:
Bob Smith 123-45-6789 05/26/99 $42500
But, a message containing the following does not match because that record is not in the
index:
Betty Smith 000-00-0000 05/26/99 $42500
If you limited the condition to matching only the Last Name, SSN, and Salary column fields,
the following message is a match because it meets the criteria:
Robert, Smith, 123-45-6789, 05/29/99, $42500
Finally, the following message contents do not match because the value for the SSN is not
present in the profile:
Bob, Smith, 415-789-0000, 05/26/99, $42500
See “Configuring Exact Data profiles” on page 431.

EDM policy features

EDM policy matching involves searching for indexed content in a given message and generating
an incident if a match is found within the defined proximity range.
Policy matching features of EDM include the following:
■ You can select any number of columns to be matched from a given data source.
■ You can define exclude combinations so that matches against those combinations are not
reported.
■ When creating the index, the system provides pattern validation for social security numbers,
credit card numbers, U.S. and Canada phone numbers and ZIP codes, email and IP
addresses, numbers, and percents.
■ There is an editable stop word dictionary you can use to prevent single token stopwords
from matching.
■ The system provides match highlighting at the incident snapshot screen.
■ You can use a where clause in the EDM rule and matches that do not satisfy the where
clause are ignored.
■ You can use Data Owner Exception to ignore detection based on the sender or recipient's
email address or domain.
■ You can use profiled Directory Group Matching (DGM) to match on senders or recipients
of data based on email address, IM handle, or Windows user name.
■ Proximity matching range that is proportional to the number of required matches set in the
policy condition.
 Detecting content using Exact Data Matching (EDM) 425
Introducing Exact Data Matching (EDM)

■ Full support for single- and multi-token cell indexing and matching. A multi-token is a cell
that is indexed that contains two or more words.
See “EDM policy templates” on page 425.

EDM policy templates

Symantec Data Loss Prevention provides several policy templates that feature EDM. If you
use one of these templates, the system lets you validate your Exact Data Profile against the
template when you are configuring the profile.
■ Caldicott Report
See “Caldicott Report policy template” on page 1085.
■ Customer Data Protection
See “Customer Data Protection policy template” on page 1091.
■ Data Protection Act 1988
See “Data Protection Act 1998 policy template” on page 1092.
■ Employee Data Protection
See “Employee Data Protection policy template” on page 1098.
■ EU Data Protection Directives
See “Data Protection Directives (EU) policy template” on page 1094.
■ Export Administration Regulations (EAR)
See “Export Administration Regulations (EAR) policy template” on page 1100.
■ FACTA 2003 (Red Flag Rules)
See “FACTA 2003 (Red Flag Rules) policy template” on page 1101.
■ Gramm-Leach-Bliley
See “Gramm-Leach-Bliley policy template” on page 1150.
■ HIPAA and HITECH (including PHI)
See “HIPAA and HITECH (including PHI) policy template” on page 1152.
■ Human Rights Act 1998
See “Human Rights Act 1998 policy template” on page 1156.
■ International Traffic in Arms Regulations (ITAR)
See “International Traffic in Arms Regulations (ITAR) policy template” on page 1158.
■ Payment Card Industry Data Security Standard
See “Payment Card Industry (PCI) Data Security Standard policy template” on page 1170.
■ PIPEDA
See “PIPEDA policy template” on page 1172.
■ Price Information
 Detecting content using Exact Data Matching (EDM) 426
Introducing Exact Data Matching (EDM)

See “Price Information policy template” on page 1174.

■ Resumes
See “Resumes policy template” on page 1177.
■ State Data Privacy
See “SEC Fair Disclosure Regulation policy template” on page 1180.
See “Creating and modifying Exact Data Profiles” on page 438.
See “Leverage EDM policy templates when possible” on page 507.

About the Exact Data Profile and index

The Exact Data Profile is the user-defined configuration you create to index the data source
and map the data. The index is a secure file (or set of files) that contains hashes of the exact
data values from each field in your data source, along with information about those data values.
The index does not contain the data values themselves.
The index that is generated consists of 12 binary DataSource.rdx files, each with space to fit
into random access memory (RAM) on the detection server(s). By default, Symantec Data
Loss Prevention stores index files in \SymantecDLP\Protect\index (on Windows) or in
/var/SymantecDLP/index (on Linux) on the Enforce Server.

Symantec Data Loss Prevention automatically deploys EDM indexes (*.rdx files) to the index
directory on all detection servers. When an active policy that references an EDM profile is
deployed to a detection server, the detection server loads the corresponding EDM index into
RAM. If a new detection server is added after an index has been created, the *.rdx files in
the index folder on the Enforce Server are deployed to the index folder on the new detection
server. You cannot manually deploy index files to detection servers.
At run-time during detection, the system converts input content into hashed data values using
the same algorithm it employs for indexes. It then compares data values from input content to
those in the appropriate index file(s), identifying matches.
See “Creating and modifying Exact Data Profiles” on page 438.
See “Memory requirements for EDM” on page 475.

About the exact data source file

The data source file is a flat file containing data in a standard delimited format (pipe or tab)
that has been extracted from a database, spreadsheet, or other structured data source, and
cleansed for profiling. You upload the data source file to the Enforce Server when you are
defining the Exact Data Profile. For example, by exporting data from a database (performing
a "data dump"), the resulting *.dat file can be used as the data source for your EDM profile.
See “Creating the exact data source file for EDM” on page 433.
 Detecting content using Exact Data Matching (EDM) 427
Introducing Exact Data Matching (EDM)

You can use the SQL pre-indexer to index the data source directly. However, this approach
has limitations because in most cases the data must first be cleansed before it is indexed.
See “Remote EDM indexing” on page 483.
The data source file must contain at least one unique column field. Some examples of unique
column fields include social security number, drivers license number, and credit card number.
See “Best practices for using EDM” on page 501.
The maximum number of columns that a single data source file can have is 32. If the data
source file has more than 32 columns, the Enforce Server administration console produces
an error message at the profile screen, and the data source file is not indexed. The maximum
number of rows is 4 billion - 2(2^32-2) and the total number of cells in a single data source file
should not exceed 6 billion cells. If your data source file is larger than this, split it into multiple
files and index each separately.
Table 21-1 summarizes size limitations for EDM data source files.

Note: The format for the data source file should be a text-based format containing pipe- or
tab-delimited contents. In general you should avoid using a spreadsheet format for the data
source file (such as XLS or XLSX) because such programs use scientific notation to render
numbers.

Table 21-1 EDM data source file size limitations

Data source file Limit Description

Columns 32 The data source file cannot have more than 32 columns. If it does, the system
does not index it.

Cells 6 billion The data source file cannot have more than 6 billion data cells. If it does, the
system does not index it.

Rows 4 billion - The maximum number of rows supported is 4 billion - 2(2^32-2).

2(2^32-2)

About cleansing the exact data source file

Once you have created the data source file, you must prepare the data for indexing by cleansing
it. It is critical that you cleanse the data source file to ensure that your EDM policies are as
accurate as possible. You can use tools such as Stream Editor (sed) and AWK to cleanse the
data source file. Melissa Data provides good tools for normalizing data in the data source,
such as addresses.
Table 21-2 provides the workflow for cleansing the data source file for indexing.
 Detecting content using Exact Data Matching (EDM) 428
Introducing Exact Data Matching (EDM)

Table 21-2 Workflow for cleansing the data source file

Step Action Description

1 Prepare the data source file for indexing. See “Preparing the exact data source file for
indexing” on page 435.

2 Ensure that the data source has at least See “Ensure data source has at least one column
one column that is unique data. of unique data” on page 503.

3 Remove incomplete and duplicate See “Cleanse the data source file of blank columns
records. Do not fill empty cells with and duplicate rows” on page 504.
bogus data.

4 Remove improper characters. See “Remove ambiguous character types from the
data source file” on page 504.

5 Verify that the data source file is below

the error threshold.

About using System Fields for data source validation

Column headings in your data source are useful for visual reference. However, they do not
tell Symantec Data Loss Prevention what kind of data the columns contain. To do this, you
use the Field Mappings section of the Exact Data Profile to specify mappings between fields
in your data source. You can also use field mappings to specify fields that the system recognizes
in the system-provided policy templates. The Field Mappings section also gives you advanced
options for specifying custom fields and validating the data in those fields.
See “Mapping Exact Data Profile fields” on page 442.
Consider the following example use of field mappings. Your company wants to protect employee
data, including employee social security numbers. You create a Data Loss Prevention policy
based on the Employee Data Protection template. The policy requires an exact data index
with fields for social security numbers and other employee data. You prepare your data source
and then create the Exact Data Profile. To validate the data in the social security number
field, you map this column field in your index to the "Social Security Number" system field
pattern. The system then validates all data in that field using the Social Security Number
validator to ensure that each data item is a social security number
Using the system-defined field patterns to validate your data is critical to the accuracy of your
EDM policies. If there is no system-defined field pattern that corresponds to one or more data
fields in your index, you can define custom fields and choose the appropriate validator to
validate the data.
See “Map data source column to system fields to leverage validation” on page 506.
 Detecting content using Exact Data Matching (EDM) 429
Introducing Exact Data Matching (EDM)

About index scheduling

After you have indexed an exact data source extract, its schema cannot be changed because
the *.rdx index file is binary. If the data source changes, or the number of columns or data
mapping of the exact data source file changes, you must create a new EDM index and update
the policies that reference the changed data. In this case you can schedule the indexing to
keep the index in sync with the data source.
The typical use case is as follows. You extract data from a database to a file and cleanse it.
This is your data source file. Using the Enforce Server administration console you define an
Exact Data Profile and index the data source file. The system generates the *.rdx index files
and deploys them to one or more detection servers. However, if you know that the data changes
frequently, you need to generate a new data source file weekly or monthly to keep up with the
changes to the database. In this case, you can use index scheduling to automate the indexing
of the data source file so you do not have to return to the Enforce Server administration console
and reindex the updated data source. Your only task is to drop an updated and cleansed data
source file to the Enforce Server for scheduled indexing.
See “Configuring Exact Data profiles” on page 431.
See “Scheduling Exact Data Profile indexing” on page 445.
See “Use scheduled indexing to automate profile updates” on page 508.

About the Content Matches Exact Data From condition

The Content Matches Exact Data From an Exact Data Profile condition is the detection
component you use to implement EDM policies. When you define this condition, you select
the EDM profile on which the condition is based. You also select the rows you want to use in
your condition, as well as any WHERE clause limitations.

Note: You cannot use the Content Matches Exact Data From an Exact Data Profile condition
as a policy exception. Data Loss Prevention does not support the use of the EDM condition
as a policy exception.

See “Configuring the Content Matches Exact Data policy condition” on page 448.

About Data Owner Exception

Although EDM does not support the explicit use of match exceptions in policies, EDM does
support criteria-based matching exceptions. This feature of EDM is known as Data Owner
Exception. Data owner exception lets you tag or authorize a specific field in an Exact Data
Profile as the data owner. At run-time if the sender or recipient of the data is authorized as a
data owner, the condition does not trigger a match and the data is allowed to be sent or received
by the data owner
 Detecting content using Exact Data Matching (EDM) 430
Introducing Exact Data Matching (EDM)

You implement data owner exception by including either the email address field or domain
address field in your Exact Data Profile. In the EDM policy condition, you specify the field as
either the sender or recipient data owner. An authorized data owner, identified by his or her
email address or a domain address, who is a sender can send his or her own confidential
information without triggering an EDM match or incident. This means that the sender can send
any information that is contained in the row where his or her email address or domain is
specified. Authorized data owner recipients can be specified individually or all recipients in the
list can be allowed to receive the data without triggering a match.
As a policy author, data owner exception gives you the flexibility to allow data owners to use
their own data legitimately. For example, if data owner exception is enabled, an employee can
send an email containing his or her own confidential information (such as an account number)
without triggering a match or an incident. Similarly, if data owner exception is configured for
a recipient, the system does not trigger an EDM match or incident if the data owner is receiving
his or her own information, such as someone outside the company is sending an email to the
data owner containing his or her account number.
See “About upgrading EDM deployments” on page 431.
See “Creating the exact data source file for Data Owner Exception” on page 434.
See “Configuring Data Owner Exception for EDM policy conditions” on page 451.

About profiled Directory Group Matching (DGM)

Profiled Directory Group Matching (DGM) is a specialized implementation of EDM that is used
to detect the exact identity of a message user, sender, or recipient that has been profiled from
a directory server or database
Profiled DGM leverages EDM technology to detect identities that you have indexed from your
database or directory server using an Exact Data Profile. For example, you can use profiled
DGM to identify network user activity or to analyze content associated with particular users,
senders, or recipients. Or, you can exclude certain email addresses from analysis. Or, you
might want to prevent certain people from sending confidential information by email.
To implement profiled DGM, your exact data source file must contain one or more of the
following fields:
■ Email address
■ IP address
■ Windows user name
■ IM name (AOL, Yahoo, MSN)
If you include the email address field in the DGM profile, the field appears in the Directory
EDM drop-down list at the incident snapshot screen in the Enforce Server administration
console, which facilitates remediation.
 Detecting content using Exact Data Matching (EDM) 431
Configuring Exact Data profiles

See “Creating the exact data source file for profiled DGM” on page 434.
See “Include an email address field in the Exact Data Profile for profiled DGM” on page 511.
See “Use profiled DGM for Network Prevent for Web identity detection” on page 511.

About two-tier detection for EDM on the endpoint

The EDM index is server-based. If you deploy a policy containing an EDM condition to the
DLP Agent on the endpoint, the system uses two-tier detection to evaluate data for matching.
In this case the EDM detection condition is not evaluated locally by the DLP Agent. Instead,
the DLP Agent sends the data to the Endpoint Server for evaluation against the index. If the
endpoint is offline, the message cannot be sent until the server is available, which can affect
endpoint performance.
See “Two-tier detection for DLP Agents” on page 358.
To check if two-tier detection is being used, check the
\SymantecDLP\Protect\logs\debug\FileReader.log on the Endpoint Server to see if any
EDM indexes are being loaded. Look for the line "loaded database profile."
See “Troubleshooting policies” on page 408.

About upgrading EDM deployments

To take advantage of the latest EDM enhancements, you must upgrade your servers to
Symantec Data Loss Prevention version 14.0 and you must reindex your EDM data sources
using the 14.0 EDM Indexer. Although legacy EDM indexes run on 14.0 detection servers,
such indexes do not support new features. In addition, you must calculate the memory required
to index the data source and load and process each EDM index at run-time.
See “About Data Owner Exception” on page 429.
See “Updating EDM indexes to the latest version” on page 470.
See “Memory requirements for EDM” on page 475.
See “EDM index out-of-date error codes” on page 474.

Configuring Exact Data profiles

To implement EDM, you create the Exact Data Profile, index the data source, and define one
or more EDM detection conditions to match profiled data exactly.
See “About the Exact Data Profile and index” on page 426.
 Detecting content using Exact Data Matching (EDM) 432
Configuring Exact Data profiles

Table 21-3 Implementing Exact Data Matching

Step Action Description

1 Create the data source file. Export the source data from the database (or other data repository) to
a tabular text file.

If you want to except data owners from matching, you need to include
specific data items in the data source file.

See “About the exact data source file” on page 426.

If you want to match identities for profiled Directory Group Matching

(DGM), you need to include specific data items in the data source files.

See “Creating the exact data source file for EDM” on page 433.

2 Prepare the data source file for Remove irregularities from the data source file.
indexing.
See “Preparing the exact data source file for indexing” on page 435.

3 Upload the data source file to the You can copy or upload the data source file to the Enforce Server, or
Enforce Server. access it remotely.

See “Uploading exact data source files to the Enforce Server”

on page 436.

4 Create an Exact Data Profile. An Exact Data Profile is required to implement Exact Data Matching
(EDM) policies. The Exact Data Profile specifies the data source, data
field types, and the indexing schedule.

See “Creating and modifying Exact Data Profiles” on page 438.

5 Map and validate the data fields. You map the source data fields to system or custom data types that
the system validates. For example, a social security number data field
needs to be nine digits.

See “About using System Fields for data source validation” on page 428.

See “Mapping Exact Data Profile fields” on page 442.

6 Index the data source, or See “About index scheduling” on page 429.
schedule indexing.
See “Scheduling Exact Data Profile indexing” on page 445.

7 Configure and tune one or more See “Configuring the Content Matches Exact Data policy condition”
EDM detection conditions. on page 448.

See “Configuring the Content Matches Exact Data policy condition”

on page 448.
 Detecting content using Exact Data Matching (EDM) 433
Configuring Exact Data profiles

Creating the exact data source file for EDM

The first step in the EDM indexing process is to create the data source. A data source is a flat
file containing data in a standard delimited format.
If you plan to use a policy template, review it before creating the data source file to see which
data fields the policy uses. For relatively small data sources, include as many suggested fields
in your data source as possible. However, note that the more fields you include, the more
memory the resulting index requires. This consideration is important if you have a large data
source. When you create the data profile, you can confirm how well the fields in your data
source match against the suggested fields for the template.
See Table 21-4 on page 433.

Table 21-4 Create the exact data source file

Step Description

1 Export the data you want to protect from a database or other tabular data format, such as an Excel
spreadsheet, to a flat file. The data source file you create must be a tabular text file that contains rows
of data from the original source. Each row from the original source is included as a row in the data source
file. Delimit columns using a tab, a comma, or a pipe. Pipe is preferred. Comma should not be used if
your data source fields contain numbers.

See “About the exact data source file” on page 426.

You must maintain all the structured data that you exported from the source database table or table-like
format in one data source file. You cannot split the data source across multiple files.

The data source file cannot exceed 32 columns, 4 billion - 2 (2^32 -2) rows, or 6 billion cells. If you plan
to upload the data source file to the Enforce Server, browser capacity limits the data source size to 2
GB. For file sizes larger than this size you can copy the file to the Enforce Server using FTP/S.

2 Include required data fields for specific EDM implementations:

■ Unique data
For all EDM implementations, make sure the data source contains at least one column of unique
data
See “Ensure data source has at least one column of unique data” on page 503.
■ Data Owner Exception
Make sure the data source contains the email address field or domain field, if you plan to use data
owner exceptions.
See “Creating the exact data source file for Data Owner Exception” on page 434.
■ Directory Group Matching
Make sure the data source includes one or more sender/recipient identifying fields.
See “Creating the exact data source file for profiled DGM” on page 434.

3 Prepare the data source file for indexing.

See “Preparing the exact data source file for indexing” on page 435.
 Detecting content using Exact Data Matching (EDM) 434
Configuring Exact Data profiles

Creating the exact data source file for Data Owner Exception
To implement Data Owner Exception and ignore data owners from detection, you must explicitly
include each user's email address or domain address in the Exact Data Profile. Each expected
domain (for example, symantec.com) must be explicitly added to the Exact Data Profile. The
system does not automatically match on subdomains (for example,
fileconnect.symantec.com). Each subdomain must be explicitly added to the Exact Data
Profile.
To implement the data owner exception feature, you must include either or both of the following
fields in your data source file:
■ Email address
■ Domain address
See “About Data Owner Exception” on page 429.
See “Configuring Data Owner Exception for EDM policy conditions” on page 451.

Creating the exact data source file for profiled DGM

Profiled DGM leverages Exact Data Matching (EDM) technology to precisely detect identities.
Identity-related attributes may include an IP address, email address, user name, business
unit, department, manager, title, or employment status. Other attributes may be whether that
employee has provided consent to be monitored, or whether the employee has access to
sensitive information. To implement profiled DGM, you must include at least one required data
field in your data source.
See “About the Exact Data Profile and index” on page 426.
Table 21-5 lists the required fields for profiled DGM. The data source file must contain at least
one of these fields.

Table 21-5 Profiled DGM data source fields

Field Description

Email address If you use an email address column filed in the data source file, the email address appears in
the Directory EDM drop-down list at the incident snapshot screen.

IP address For example: 172.24.56.33

Windows user name If you use a Windows user name field in your data source, the data must be in the following
format: domain\user; for example: ACME\john_smith.
 Detecting content using Exact Data Matching (EDM) 435
Configuring Exact Data profiles

Table 21-5 Profiled DGM data source fields (continued)

Field Description

AOL IM name IM screen name / handle

Yahoo! IM name For example: myhandle123

MSN IM name

Preparing the exact data source file for indexing

Once you create the exact data source file, you must prepare it so that you can efficiently index
the data you want to protect.
When you index an exact data profile, the Enforce Server keeps track of empty cells and any
misplaced data which count as errors. For example, an error may be a name that appears in
a column for phone numbers. Errors can constitute a certain percentage of the data in the
profile (five percent, by default). If this default error threshold is met, Symantec Data Loss
Prevention stops indexing. It then displays an error to warn you that your data may be
unorganized or corrupt.
To prepare the exact data source for EDM indexing
1 Make sure that the data source file is formatted as follows:
■ If the data source has more than 200,000 rows, verify that it has at least two columns
of data. One of the columns should contain unique values. For example, credit card
numbers, driver’s license numbers, or account numbers (as opposed to first and last
names, which are generic).
See “Ensure data source has at least one column of unique data” on page 503.
■ Verify that you have delimited the data source using pipes ( | ) or tabs. If the data
source file uses commas as delimiters, remove any commas that do not serve as
delimiters.
See “Do not use the comma delimiter if the data source has number fields” on page 505.
■ Verify that data values are not enclosed in quotes.
■ Remove single-character and abbreviated data values from the data source. For
example, remove the column name and all values for a column in which the possible
values are Y and N. Optionally, remove any columns that contain numeric values with
less that five digits, as these can cause false positives in production.
See “Remove ambiguous character types from the data source file” on page 504.
■ Verify that numbers, such as credit card or social security, are delimited internally by
dashes, or spaces, or none at all. Make sure that you do not use a data-field delimiter
such as a comma as an internal delimiter in any such numbers. For example:
123-45-6789, or 123 45 6789, or 123456789 are valid, but not 123,45,6789.
 Detecting content using Exact Data Matching (EDM) 436
Configuring Exact Data profiles

See “Do not use the comma delimiter if the data source has number fields” on page 505.
■ Eliminate duplicate records, which can cause duplicate incidents in production.
See “Cleanse the data source file of blank columns and duplicate rows” on page 504.
■ Do not index common values. EDM works best with values that are unique. Think
about the data you want to index (and thus protect). Is this data truly valuable? If the
value is something common, it is not useful as an EDM value. For example, suppose
you want to look for "US states." Since there are only 50 states, if your exact data
profile has 300,000 rows, the result is a lot of duplicates of common values. Symantec
Data Loss Prevention indexes all values in the exact data profile, regardless of if the
data is used in a policy or not. It is good practice to use values that are less common
and preferably unique to get the best results with EDM.
See “Ensure data source has at least one column of unique data” on page 503.

2 Once you have prepared the exact data source file, proceed with the next step in the EDM
process: upload the exact data source file to the Enforce Server for profiling the data you
want to protect.
See “Uploading exact data source files to the Enforce Server” on page 436.

Uploading exact data source files to the Enforce Server

After you have prepared the data source file for indexing, load it to the Enforce Server so the
data source can be indexed.
See “Creating and modifying Exact Data Profiles” on page 438.
Listed here are the options you have for making the data source file available to the Enforce
Server. Consult with your database administrator to determine the best method for your needs.

Table 21-6 Uploading the data source file to the Enforce Server for indexing

Upload option(s) Use case Description

Upload Data Source Data source file is If you have a smaller data source file (less than 50 MB), upload the data
to Server Now less than 50 MB source file to the Enforce Server using the Enforce Server administration
console (web interface). When creating the Exact Data Profile, you can
specify the file path or browse to the directory and upload the data source
file.
Note: Due to browser capacity limits, the maximum file size that you can
upload is 2 GB. However, uploading any file over 50 MB is not
recommended since files over this size can take a long time to upload. If
your data source file is over 50 MB, consider copying the data source file
to the datafiles directory using the next option.
 Detecting content using Exact Data Matching (EDM) 437
Configuring Exact Data profiles

Table 21-6 Uploading the data source file to the Enforce Server for indexing (continued)

Upload option(s) Use case Description

Reference Data Data source file is If you have a large data source file (over 50 MB), copy it to the datafiles
Source on Manager over 50 MB directory on the host where Enforce is installed.
Host
■ On Windows this directory is located at
\SymantecDLP\Protect\datafiles.
■ On Linux this directory is located at
/var/SymantecDLP/datafiles.

This option is convenient because it makes the data file available by

reference by a drop-down list during configuration of the Exact Data
Profile. If it is a large file, use a third-party solution (such as Secure FTP)
to transfer the data source file to the Enforce Server.
Note: Ensure that the Enforce user (usually called "protect") has modify
permissions (on Windows) or rw permissions (on Linux) for all files in the
datafiles directory.

Use This File Name Data source file is In some cases you may want to create an EDM profile before you have
not yet created created the data source file. In this case you can create a profile template
and specify the name of the data source file you plan to create. This
option lets you define EDM policies using the EDM profile template before
you index the data source. The policies do not operate until the data
source is indexed. When you have created the data source file you place
it in the \SymantecDLP\Protect\datafiles directory and index the
data source immediately on save or schedule indexing.

See “Creating and modifying Exact Data Profiles” on page 438.

 Detecting content using Exact Data Matching (EDM) 438
Configuring Exact Data profiles

Table 21-6 Uploading the data source file to the Enforce Server for indexing (continued)

Upload option(s) Use case Description

Use This File Name Data source is to In some environments it may not be secure or feasible to copy or upload
be indexed the data source file to the Enforce Server. In this situation you can index
and
remotely and the data source remotely using Remote EDM Indexer.
Load Externally copied to the
See “Remote EDM indexing” on page 483.
Generated Index Enforce Server
This utility lets you index an exact data source on a computer other than
the Enforce Server host. This feature is useful when you do not want to
copy the data source file to the same computer as the Enforce Server.
As an example, consider a situation where the originating department
wants to avoid the security risk of copying the data to an
extra-departmental host. In this case you can use the Remote EDM
Indexer.

First you create an EDM profile template where you choose the Use this
File Name and the Number of Columns options. You must specify the
name of the data source file and the number of columns it contains.

See “Creating an EDM profile template for remote indexing” on page 487.

You then use the Remote EDM Indexer to remotely index the data source
and copy the index files to the Enforce Server host and load the externally
generated index. The Load Externally Generated Index option is only
available after you have defined and saved the profile. Remote indexes
are loaded from the /SymantecDLP/Protect/Index directory on the
Enforce Server host.

See “Copying and loading remote index files to the Enforce Server”
on page 493.

Creating and modifying Exact Data Profiles

The Manage > Data Profiles > Exact Data > Add Exact Data Profile screen is the home
page for managing and adding Exact Data Profiles. An Exact Data Profile is required to
implement an instance of the Content Matches Exact Data detection rule. An Exact Data Profile
specifies the data source, the indexing parameters, and the indexing schedule. Once you have
created the EDM profile, you index the data source and configure one or more detection rules
to use the profile and detect exact content matches
See “Configuring Exact Data profiles” on page 431.

Note: If you are using the Remote EDM Indexer to generate the Exact Data Profile, refer to
the following topic.
 Detecting content using Exact Data Matching (EDM) 439
Configuring Exact Data profiles

To create or modify an Exact Data Profile

1 Make sure that you have created the data source file.
See “Creating the exact data source file for EDM” on page 433.
2 Make sure that you have prepared the data source file for indexing.
See “Preparing the exact data source file for indexing” on page 435.
3 Make sure the data source contains the email address field or domain field, if you plan to
use data owner exceptions.
See “About Data Owner Exception” on page 429.
4 In the Enforce Server administration console, navigate to Manage > Data Profiles >
Exact Data.
5 Click Add Exact Data Profile.
6 Enter a unique, descriptive Name for the profile (limited to 256 characters).
For easy reference, choose a name that describes the data content and the index type
(for example, Employee Data EDM).
If you modify an existing Exact Data Profile you can change the profile name.
7 Select one of the following Data Source options to make the data source file available to
the Enforce Server:
■ Upload Data Source to Server Now
If you are creating a new profile, click Browse and select the data source file, or enter
the full path to the data source file.
If you are modifying an existing profile, select Upload Now.
See “Uploading exact data source files to the Enforce Server” on page 436.
■ Reference Data Source on Manager Host
If you copied the data source file to the "datafiles" directory on the Enforce Server, it
appears in the drop-down list for selection.
See “Uploading exact data source files to the Enforce Server” on page 436.
■ Use This File Name
Select this option if you have not yet created the data source file but want to configure
EDM policies using a placeholder EDM profile. Enter the file name of the data source
you plan to create, including the Number of Columns it is to have. When you do
create the data source, you must copy it to the "datafiles" directory.
See “Uploading exact data source files to the Enforce Server” on page 436.
 Detecting content using Exact Data Matching (EDM) 440
Configuring Exact Data profiles

Note: Use this option with caution. Be sure to remember to create the data source file
and copy it to the "datafiles" directory. Name the data source file exactly the same as
the name you enter here and include the exact number of columns you specify here.

■ Load Externally Generated Index

Select this option if you have created an index on a remote computer using the Remote
EDM Indexer. This option is only available after you have defined and saved the profile.
Profiles are loaded from the /SymantecDLP/Protect/Index directory on the Enforce
Server host.
See “Uploading exact data source files to the Enforce Server” on page 436.

8 If the first row of your data source contains Column Names, select the "Read first row
as column names" check box.
9 Specify the Error Threshold, which is the maximum percentage of rows that contain
errors before indexing stops.
A data source error is either an empty cell, a cell with the wrong type of data, or extra
cells in the data source. For example, a name in a column for phone numbers is an error.
If errors exceed a certain percentage of the overall data source (by default, 5%), the
system quits indexing and displays an indexing error message. The index is not created
if the data source has more invalid records than the error threshold value allows. Although
you can change the threshold value, more than a small percentage of errors in the data
source can indicate that the data source is corrupt, is in an incorrect format, or cannot be
read. If you have a significant percentage of errors (10% or more), stop indexing and
cleanse the data source.
See “Preparing the exact data source file for indexing” on page 435.
10 Select the Column Separator Char (delimiter) that you have used to separate the values
in the data source file. The delimiters you can use are tabs, commas, or pipes.
11 Select one of the following encoding values for the content to analyze, which must match
the encoding of your data source:
■ ISO-8859-1 (Latin-1) (default value)
Standard 8-bit encoding for Western European languages using the Latin alphabet.
■ UTF-8
Use this encoding for all languages that use the Unicode 4.0 standard (all single- and
double-byte characters), including those in East Asian languages.
■ UTF-16
Use this encoding for all languages that use the Unicode 4.0 standard (all single- and
double-byte characters), including those in East Asian languages.
 Detecting content using Exact Data Matching (EDM) 441
Configuring Exact Data profiles

Note: Make sure that you select the correct encoding. The system does not prevent you
from creating an EDM profile using the wrong encoding. The system only reports an error
at run-time when the EDM policy attempts to match inbound data. To make sure that you
select the correct encoding, after you clickNext, verify that the column names appear
correctly. If the column names do not look correct, you chose the wrong encoding.

12 Click Next to go to the second Add Exact Data Profile screen.

13 The Field Mappings section displays the columns in the data source and the field to
which each column is mapped in the Exact Data Profile. Field mappings in existing Exact
Data Profiles are fixed and, therefore, are not editable.
See “About using System Fields for data source validation” on page 428.
See “Mapping Exact Data Profile fields” on page 442.
Confirm that the column names in your data source are accurately represented in the
Data Source Field column. If you selected the Column Names option, the Data Source
Field column lists the names in the first row of your data source. If you did not select the
Column Names option, the column lists Col 1, Col 2, and so on.
14 In the System Field column, select a field from the drop-down list for each data source
field. (This step is required if you use a policy template, or if you want to check for errors
in the data source.)
For example, for a data source field that is called SOCIAL_SECURITY_NUMBER, select
Social Security Number from the corresponding drop-down list. The values in the System
Field drop-down lists include all suggested fields for all policy templates.
15 Optionally, specify and name any custom fields (that is, the fields that are not pre-populated
in the System Field drop-down lists). To do so, perform these steps in the following order:
■ Click Advanced View to the right of the Field Mappings heading. This screen displays
two additional columns (Custom Name and Type).
■ To add a custom system field name, go to the appropriate System Field drop-down
list. Select Custom, and type the name in the corresponding Custom Name text field.
■ To specify a pattern type (for purposes of error checking), go to the appropriate Type
drop-down list and select the wanted pattern. (To see descriptions of all available
pattern types, click Description at the top of the column.)
 Detecting content using Exact Data Matching (EDM) 442
Configuring Exact Data profiles

16 Check your field mappings against the suggested fields for the policy template you plan
to use. To do so, go to the Check Mappings Against drop-down list, select a template,
and click Check now on the right.
The system displays a list of all template fields that you have not mapped. You can go
back and map these fields now. Alternatively, you may want to expand your data source
to include as many expected fields as possible, and then re-create the exact data profile.
Symantec recommends that you include as many expected data fields as possible.
17 In the Indexing section of the screen, select one of the following options:
■ Submit Indexing Job on Save
Select this option to begin indexing the data source when you save the exact data
profile.
■ Submit Indexing Job on Schedule
Select this option to index the data source according to a specific schedule. Make a
selection from the Schedule drop-down list and specify days, dates, and times as
required.
See “About index scheduling” on page 429.
See “Scheduling Exact Data Profile indexing” on page 445.

18 Click Finish.
After Symantec Data Loss Prevention finishes indexing, it deletes the original data source
from the Enforce Server. After you index a data source, you cannot change its schema.
If you change column mappings for a data source after you index it, you must create a
new exact data profile.
After the indexing process is complete you can create new EDM rules for your policies
that reference the Exact Data Profile you have created.
See “Configuring the Content Matches Exact Data policy condition” on page 448.

Mapping Exact Data Profile fields

After you have added and configured the data source file and settings, the Manage > Data
Profiles > Exact Data > Add Exact Data Profile screen lets you map the fields from the data
source file to the Exact Data Profile you configure.
To enable error checking on a field in a data source or to use the index with a policy template
that uses a system field, you must map the field in the data source to the system field. The
Field Mappings section lets you map the columns in the original data source to system fields
in the Exact Data Profile.
 Detecting content using Exact Data Matching (EDM) 443
Configuring Exact Data profiles

Table 21-7 Field mapping options

Field Description

Data Source Field If you selected the Column Names option at the Add Exact Data Profile screen, this column
lists the values that are found in the first row from the data source. If you did not select this
option, this column lists the columns by generic names (such as Col 1, Col 2, and so on).
Note: If you are implementing data owner exception, you must map either or both the email
address and domain fields.

See “Configuring the Content Matches Exact Data policy condition” on page 448.

System Field Select the system field for each column.

A system field value (except None Selected) cannot be mapped to more than one column.

Some system fields have system patterns associated with them (such as social security
number) and some do not (such as last name).

See “Using system-provided pattern validators for EDM profiles” on page 444.

Check mappings Select a policy template from the drop-down list to compare the field mappings against and
against policy then click Check now.
template
All policy templates that implement EDM appear in the drop-down menu, including any you
have imported.

See “Choosing an Exact Data Profile” on page 371.

If you plan to use more than one policy template, select one and check it, and then select
another and check it, and so on.

If there are any fields in the policy template for which no data exists in the data source, a
message appears listing the missing fields. You can save the profile anyway or use a different
Exact Data Profile.

Advanced View If you want to customize the schema for the exact data profile, click Advanced View to display
the advanced field mapping options.

Table 21-8 lists and describes the additional columns you can specify in the Advanced View
screen.

Indexing Select one of the indexing options.

See “Scheduling Exact Data Profile indexing” on page 445.

Finish Click Finish when you are done configuring the Exact Data Profile.

From the Advanced View you map the system and data source fields to system patterns.
System patterns map the specified structure to the data in the Exact Data Profile and enable
efficient error checking and hints for the indexer.
 Detecting content using Exact Data Matching (EDM) 444
Configuring Exact Data profiles

Table 21-8 Advanced View options

Field Description

Custom Name If you select Custom Name for a System Field, enter a unique name for it and then select a
value for Type. The name is limited to 60 characters.

Type If you select a value other than Custom for a System Field, some data types automatically
select a value for Type. For example, if you select Birth Date for the System Field, Date is
automatically selected as the Type. You can accept it or change it.

Some data types do not automatically select a value for Type. For example, if you select
Account Number for the System Field, the Type remains unselected. You can specify the
data type of your particular account numbers.

See “Using system-provided pattern validators for EDM profiles” on page 444.

Description Click the link (description) beside the Type column header to display a pop-up window
containing the available system data types. See also the topic link below.

See “Using system-provided pattern validators for EDM profiles” on page 444.

Simple View Click Simple View to return to the Simple View (with the Custom Name and Type columns
hidden).

See “Creating and modifying Exact Data Profiles” on page 438.

Using system-provided pattern validators for EDM profiles

Table 21-9 lists and describes the system-provided data validators for EDM profiles.

Table 21-9 System-provided data validators for EDM profiles

Type Description

Credit Card Number The Credit Card pattern is built around knowledge about various internationally recognized
credit cards, their registered prefixes, and number of digits in account numbers. The following
types of Credit Cards patterns are validated: MasterCard, Visa, America Express, Diners Club,
Discover, Enroute, and JCB.

Optional spaces in designated areas within credit cards numbers are recognized. Note that
only spaces in generally accepted locations (for example, after every 4th digit in MC/Visa) are
recognized. Note that the possible location of spaces differs for different card types. Credit
card numbers are validated using checksum algorithm. If a number looks like a credit card
number (that is, it has correct number of digits and correct prefix), but does not pass checksum
algorithm, it is not considered to be a credit card, but just a number.

Email Email is a sequence of characters that looks like the following: string@string.tld, where
string may contain letters, digits, underscore, dash, and dot, and 'tld' is one of the approved
DNS top level generic domains, or any two letters (for country domains).
 Detecting content using Exact Data Matching (EDM) 445
Configuring Exact Data profiles

Table 21-9 System-provided data validators for EDM profiles (continued)

Type Description

IP Address IP Address is a collection of 4 sequences of between 1 and 3 digits, separated by dots.

Number Number is either float or integer, either by itself or in round brackets (parenthesis).

Percent Percent is a number immediately followed by the percent sign ("%"). No space is allowed
between a number and a percent sign.

Phone Only US and Canadian telephone numbers are recognized. The phone number must start
with any digit but 1, with the exception of numbers that include a country code
Phone number can be one of the following formats:

■ 7 digits (no spaces or dashes)

■ Same as above, preceded by 3 digits, or by 3 digits in round brackets, followed by spaces
or dashes
■ 3 digits, followed by optional spaces/dashes, followed by 4 digits
■ Same as above, preceded by the number 1, followed by spaces or dashes

All cases above can be optionally followed by an extension number, preceded by spaces or
dashes. The extension number is 2 to 5 digits preceded by any of the following (case
insensitive): 'x' 'ex' 'ext' 'exten' 'extens' 'extensions' optionally followed by a dot and spaces.
Note: The system does not recognize the pattern XXX-XXX-XXXX as a valid phone number
format because this format is frequently used in other forms of identification. If your data source
contains a column of phone numbers in that format, select None Selected to avoid confusion
between phone numbers and other data.

Postal Code Only US ZIP codes and Canadian Postal Codes are recognized. The US ZIP code is a sequence
of 5 digits, optionally followed by dash, followed by another 4 digits. The Canadian Postal
Code is a sequence like K2B 8C8, that is, "letter-digit-letter-space-digit-letter-digit" where
space(s) in the middle is optional.

Social Security Only US TAX IDs are recognized. The TAX ID is a 3 digits, optionally followed by spaces or
Number dashes, followed by 2 digits, optionally followed by spaces or dashes, followed by 4 digits.

Scheduling Exact Data Profile indexing

When you configure an Exact Data Profile, you can set a schedule for indexing the data source
(Submit Indexing on Job Schedule).
See “About index scheduling” on page 429.
Before you set up a schedule, consider the following recommendations:
■ If you update your data sources occasionally (for example, less than once a month), there
is no need to create a schedule. Index the data each time you update the data source.
 Detecting content using Exact Data Matching (EDM) 446
Configuring Exact Data profiles

■ Schedule indexing for times of minimal system use. Indexing affects performance throughout
the Symantec Data Loss Prevention system, and large data sources can take time to index.
■ Index a data source as soon as you add or modify the corresponding exact data profile,
and re-index the data source whenever you update it. For example, consider a scenario
whereby every Wednesday at 2:00 A.M. you update the data source. In this case you
should schedule indexing every Wednesday at 3:00 A.M. Do not index data sources daily
as this can degrade performance.
■ Monitor results and modify your indexing schedule accordingly. If performance is good and
you want more timely updates, for example, schedule more frequent data updates and
indexing.
The Indexing section lets you index the Exact Data Profile as soon as you save it
(recommended) or on a regular schedule as follows:

Table 21-10 Scheduling indexing for Exact Data Profiles

Parameter Description

Submit Indexing Select this option to index the Exact Data Profile when you click Save.
Job on Save

Submit Indexing Select this option to schedule an indexing job. The default option is No Regular Schedule. If you
Job on Schedule want to index according to a schedule, select a desired schedule period, as described.

Index Once On – Enter the date to index the document profile in the format MM/DD/YY. You can also click the
date widget and select a date.

At – Select the hour to start indexing.

Index Daily At – Select the hour to start indexing.

Until – Select this check box to specify a date in the format MM/DD/YY when the indexing should
stop. You can also click the date widget and select a date.

Index Weekly Day of the week – Select the day(s) to index the document profile.

At – Select the hour to start indexing.

Until – Select this check box to specify a date in the format MM/DD/YY when the indexing should
stop. You can also click the date widget and select a date.

Index Monthly Day – Enter the number of the day of each month you want the indexing to occur. The number
must be 1 through 28.

At – Select the hour to start indexing.

Until – Select this check box to specify a date in the format MM/DD/YY when the indexing should
stop. You can also click the date widget and select a date.

See “Mapping Exact Data Profile fields” on page 442.

 Detecting content using Exact Data Matching (EDM) 447
Configuring Exact Data profiles

See “Creating and modifying Exact Data Profiles” on page 438.

Managing and adding Exact Data Profiles

You manage and create Exact Data Profiles for EDM at the Manage > Data Profiles > Exact
Data screen. Once a profile has been created, the Exact Data screen lists all Exact Data
Profiles configured in the system.
See “About the Exact Data Profile and index” on page 426.

Table 21-11 Exact Data screen actions

Action Description

Add EDM profile Click Add Exact Data Profile to define a new Exact Data Profile.

See “Configuring Exact Data profiles” on page 431.

Edit EDM profile To modify an existing Exact Data Profile, click the name of the profile, or click the pencil icon
at the far right of the profile row.

See “Creating and modifying Exact Data Profiles” on page 438.

Remove EDM profile Click the red X icon at the far right of the profile row to delete the Exact Data Profile from the
system. A dialog box confirms the deletion.
Note: You cannot edit or remove a profile if another user currently modifies that profile, or if a
policy exists that depends on that profile.

Download EDM Click the download profile link to download and save the Exact Data Profile.
profile
This is useful for archiving and sharing profiles across environments. The file is in the binary
*.edm format.

Refresh EDM profile Click the refresh arrow icon at the upper right of the Exact Data screen to fetch the latest status
status of the indexing process.

If you are in the process of indexing, the system displays the message "Indexing is starting."
The system does not automatically refresh the screen when the indexing process completes.

Table 21-12 Exact Data screen details

Column Description

Exact Data Profile The name of the exact data profile.

Last Active Version The version of the exact data profile and the name of the detection server that runs the profile.
 Detecting content using Exact Data Matching (EDM) 448
Configuring EDM policies

Table 21-12 Exact Data screen details (continued)

Column Description

Status The current status of the exact data profile, which can be any of the following:
■ Next scheduled indexing (if it is not currently indexing)
■ Sending an index to a detection server
■ Indexing
■ Deploying to servers

In addition, the current status of the indexing process for each detection server, which can be
any of the following:

■ Completed, including a completion date

■ Pending index completion (waiting for the Enforce Server to finish indexing the exact data
source file)
■ Replicating indexing
■ Creating index (internally)
■ Building caches

Error messages The Exact Data screen displays any error messages in red.

For example, if the Exact Data Profile is corrupt or does not exist, the system displays an error
message.

Configuring EDM policies

This section describes how to configure EDM policy conditions.
See “Configuring the Content Matches Exact Data policy condition” on page 448.
See “Configuring Data Owner Exception for EDM policy conditions” on page 451.
See “Configuring the Sender/User based on a Profiled Directory policy condition” on page 451.
See “Configuring the Recipient based on a Profiled Directory policy condition” on page 452.
See “Configuring Advanced Server Settings for EDM policies” on page 454.

Configuring the Content Matches Exact Data policy condition

Once you have defined the Exact Data Profile and indexed the data source, you configure one
or more Content Matches Exact Data conditions in policy rules
See “About the Content Matches Exact Data From condition” on page 429.
 Detecting content using Exact Data Matching (EDM) 449
Configuring EDM policies

Table 21-13 Configure the Content Matches Exact Data policy condition

Steps Action Description

1 Configure an EDM Create a new EDM detection rule in a policy, or modify an existing EDM rule.
policy detection rule.
See “Configuring policies” on page 376.

See “Configuring policy rules” on page 380.

Match Data Rows when All of these match

2 Select the fields to The first thing you do when configuring the EDM condition is select each data
match. field that you want the condition to match. You can select all or deselect all fields
at once. The system displays all the fields or columns that were included in the
index. You do not have to select all the fields, but you should select at least 2 or
3, one of which must be unique, such as social security number, credit card
number, and so forth.

See “Best practices for using EDM” on page 501.

3 Choose the number of Choose the number of the selected fields to match from the drop down menu.
selected fields to match. This number represents the number of fields of those selected that must be present
in a message to trigger a match. You must select at least as many fields to match
as the number of data fields you check. For example, if you choose 2 of the
selected fields from the menu, you must have checked at least two fields present
in a message for detection.

See “Ensure data source has at least one column of unique data” on page 503.

4 Select the WHERE The WHERE clause option matches on the specified field value. You specify a
clause to enter specific WHERE clause value by selecting an exact data field from the menu and by
field values to match entering a value for that field in the adjacent text box. If you enter more than one
(optional). value, separate the values with commas.

See “Use a WHERE clause to detect records that meet specific criteria”
on page 510.

For example, consider an Exact Data Profile for "Employees" with a "State" field
containing state abbreviations. In this example, to implement the WHERE clause,
you select (check) WHERE, choose "State" from the drop-down list, and enter
CA,NV in the text box. This WHERE clause then limits the detection server to
matching messages that contain either CA or NV as the value for the State field.
Note: You cannot specify a field for WHERE that is the same as one of the
selected matched fields.

Ignore Data Rows when Any of these match

5 Ignore data owners Selecting this option implements Data Owner Exception.
(optional).
See “Configuring Data Owner Exception for EDM policy conditions” on page 451.
 Detecting content using Exact Data Matching (EDM) 450
Configuring EDM policies

Table 21-13 Configure the Content Matches Exact Data policy condition (continued)

Steps Action Description

6 Exclude data field You can use the exclude data field combinations to specify combinations of data
combinations (optional). values that are exempted from detection. If the data appears in exempted pairs
or groups, it does not cause a match. Excluded combinations are only available
when matching 2 or 3 fields. To enable this option, you must select 2 or 3 fields
to match from the _ of the selected fields menu at the top of the condition
configuration.

See “Leverage exception tuples to avoid false positives” on page 510.

To implement excluded combinations, select an option from each Field N column

that appears. Then click the right-arrow icon to add the field combination to the
Excluded Combinations list. To remove a field from the list, select it and click
the left-arrow icon.
Note: Hold down the Ctrl key to select more than one field in the right-most
column.

Additional match condition parameters

7 Select an incident Enter or modify the minimum number of matches required for the condition to
minimum. report an incident.

For example, consider a scenario where you specify 1 of the selected fields for
a social security number field and an incident minimum of 5. In this situation the
engine must detect at least five matching social security numbers in a single
message to trigger an incident.
See “Match count variant examples” on page 466.

8 Select components to Select one or more message components to match on:

match on.
■ Envelope – The header of the message.
■ Subject – (Not available for EDM.)
■ Body – The content of the message.
■ Attachments – The content of any files attached to or transported by the
message.

See “Selecting components to match on” on page 386.

9 Select one or more Select this option to create a compound condition. All conditions must match for
conditions to also the rule to trigger an incident.
match.
You can Add any available condition from the list.

See “Configuring compound match conditions” on page 392.

10 Test and troubleshoot See “Test and tune policies to improve match accuracy” on page 416.
the policy.
See “Troubleshooting policies” on page 408.
 Detecting content using Exact Data Matching (EDM) 451
Configuring EDM policies

Configuring Data Owner Exception for EDM policy conditions

To except data owners from detection, you must include in your Exact Data Profile either an
email address or a domain address field (for example, symantec.com). Once Data Owner
Exception (DOE) is enabled, if the sender or recipient of confidential information is the data
owner (by email address or domain), the detection server allows the data to be sent or received
without generating an incident
To configure DOE for an EDM policy condition
1 When you are configuring the Content Matches Exact Data condition, select the Ignore
data owners option.
2 Select one of the following options:
■ Sender matches — Select this option to EXCLUDE the data sender from detection.
■ Any or All Recipient matches — Select one of these options to EXCLUDE any or
all data recipient(s) from detection.

Note: When you configure DOE for the EDM condition, you cannot select a value for Ignore
Sender/Recipient that is the same as one of the matched fields.

See “About Data Owner Exception” on page 429.

See “About Data Owner Exception” on page 429.

Configuring the Sender/User based on a Profiled Directory policy

condition
The Sender/User based on a Directory from detection rule lets you create detection rules
based on sender identity or (for endpoint incidents) user identity. This condition requires an
Exact Data Profile.
See “Creating the exact data source file for profiled DGM” on page 434.
After you select the Exact Data Profile, when you configure the rule, the directory you selected
and the sender identifier(s) appear at the top of the page.
Table 21-14 describes the parameters for configuring the Sender/User based on a Directory
from an EDM Profile condition.
 Detecting content using Exact Data Matching (EDM) 452
Configuring EDM policies

Table 21-14 Configuring the Sender/User based on a Directory from an EDM Profile condition

Parameter Description

Where Select this option to have the system match on the specified field values. Specify the values by
selecting a field from the drop-down list and typing the values for that field in the adjacent text box.
If you enter more than one value, separate the values with commas.

For example, for an Employees directory group profile that includes a Department field, you would
select Where, select Department from the drop-down list, and enter Marketing,Sales in the text
box. If the condition is implemented as a rule, in this example a match occurs only if the sender or
user works in Marketing or Sales (as long as the other input content meets all other detection criteria).
If the condition is implemented as an exception, in this example the system ignores from matching
messages from a sender or user who works in Marketing or Sales.

Is Any Of Enter or modify the information you want to match. For example, if you want to match any sender
in the Sales department, select Department from the drop-down list, and then enter Sales in this
field (assuming that your data includes a Department column). Use a comma-separated list if you
want to specify more than one value.

Configuring the Recipient based on a Profiled Directory policy

condition
The Recipient based on a Directory from condition lets you create detection methods based
on the identity of the recipient. This method requires an Exact Data Profile.
See “Creating the exact data source file for profiled DGM” on page 434.
After you select the Exact Data Profile, when you configure the rule, the directory you selected
and the recipient identifier(s) appear at the top of the page.
Table 21-15 describes the parameters for configuring Recipient based on a Directory from
an EDM profile condition.

Table 21-15 Configuring the Recipient based on a Directory from an EDM profile condition

Parameter Description

Where Select this option to have the system match on the specified field values. Specify the values by
selecting a field from the drop-down list and typing the values for that field in the adjacent text box.
If you enter more than one value, separate the values with commas.

For example, for an Employees directory group profile that includes a Department field, you would
select Where, select Department from the drop-down list, and enter Marketing, Sales in the text
box. For a detection rule, this example causes the system to capture an incident only if at least one
recipient works in Marketing or Sales (as long as the input content meets all other detection criteria).
For an exception, this example prevents the system from capturing an incident if at least one recipient
works in Marketing or Sales.
 Detecting content using Exact Data Matching (EDM) 453
Configuring EDM policies

Table 21-15 Configuring the Recipient based on a Directory from an EDM profile condition
(continued)

Parameter Description

Is Any Of Enter or modify the information you want to match. For example, if you want to match any recipient
in the Sales department, select Department from the drop-down list, and then enter Sales in this
field (assuming that your data includes a Department column). Use a comma-separated list if you
want to specify more than one value.

About configuring natural language processing for Chinese,

Japanese, and Korean for EDM policies

Introducing EDM token matching

Symantec Data Loss Prevention detection servers support natural language processing for
Chinese, Japanese, and Korean (CJK) in policies that use Exact Data Matching (EDM)
detection. When natural language processing for CJK languages is enabled, the detection
server validates CJK tokens before reporting a match, which improves matching accuracy.

EDM token matching examples for CJK languages

Table 21-16 provides EDM token matching examples for Chinese, Japanese, and Korean
languages. All examples assume that the keyword condition is configured to match on whole
words only.
If token verification is enabled, the message size must be sufficient for the token verifier to
recognize the language. For example: the message “東京都市部の人口” is too small for a
message for the token verification process to recognize the language of the message. The
following message is a sufficient size for token verification processing:
今朝のニュースによると東京都市部の人口は増加傾向にあるとのことでした。 全国的な人口
減少の傾向の中、東京への一極集中を表しています。

Table 21-16 EDM token matching examples for CJK

Language Keyword Matches on server with token Matches on server with

validation ON token validation OFF

Chinese 通信 数字无线通信 数字无线通信 交通信息 网站

Japanese 京都市 京都府京都市左京区 京都府京都市左京区 東京都市部

の人口

Korean 정부 정부의 방침 정부의 방침 의정부 경전철

 Detecting content using Exact Data Matching (EDM) 454
Configuring EDM policies

Enabling and using CJK token verification for EDM

To use token verification for Chinese, Japanese, and Korean (CJK) languages you must enable
it on each detection server by setting the advanced server setting EDM.TokenVerifierEnabled
to true. In addition, there must be a sufficient amount of message text for the system to
recognize the language.
Table 21-17 lists and describes the detection server parameter that lets you enable token
verification for CJK languages.

Table 21-17 EDM token verification parameter

Setting Default Description

EDM.TokenVerifierEnabled false Default is disabled (false).

If enabled (true), the server validates tokens for Chinese,

Japanese, and Korean language keywords.

See “Enable keyword token verification for CJK” on page 696. describes how to enable and
use token verification for CJK keywords.
Enable EDM token verification for CJK
1 Log on to the Enforce Server as an administrative user.
2 Navigate to the System > Servers and Detectors > Overview > Server/Detector Detail
- Advanced Settings screen for the detection server you want to configure.
See “Advanced server settings” on page 245.
3 Locate the parameter EDM.TokenVerifierEnabled.
4 Change the value to true from false (default).
Setting the server parameter EDM.TokenVerifierEnabled = true enables token validation
for CJK token detection.
5 Save the detection server configuration.
6 Recycle the detection server.

Configuring Advanced Server Settings for EDM policies

EDM has various advanced settings available at the System > Servers and Detectors >
Overview > Server/Detector Detail - Advanced Settings screen for the chosen detection
server. Use caution when modifying these settings on a server. Check with Symantec Data
Loss Prevention Support before changing any of the settings on this screen. Changes to these
settings do not take effect until after the server is restarted.
See “Advanced server settings” on page 245.

Table 21-18 Advanced Settings for EDM indexing and detection
EDM parameter
EDM.MatchCountVariant
EDM.MaximumNumberOfMatches
ToReturn
EDM.RunProximityLogic
EDM.SimpleTextProximityRadius
EDM.TokenVerifierEnabled
Detecting content using Exact Data Matching (EDM) 455
Configuring EDM policies
Default Description
3 This setting specifies how matches are counted.
■ 1 - Counts the number of token sets matched regardless of use
of the same tokens across several matches.
■ 2 - Counts the number of unique token sets.
■ 3 - Counts the number of unique supersets of token sets. (default)
See “Match count variant examples” on page 466.
100 Defines a top limit on the number of matches returned from each
RAM index search. For multi-file indices, this limit is applied to each
sub-index search independently before the search results are
combined. As a result the number of actual matches can exceed
this limit for multiple file indices.
true If true (default), this setting runs the token proximity check. The
free-form text proximity is defined by the setting
EDM.SimpleTextProximityRadius. The tabular text proximity
is defined by belonging to the same table row.
Note: Disabling proximity is not recommended because it can
negatively impact the performance of the system.
35 Provides the baseline range for proximity checking a matched token.
This value is multiplied by the number of required matches to equal
the complete proximity check range.
To keep the same "required match density," the proximity check
range behaves like a moving window in a text page. D is defined as
the proportionality factor for the window and is set in the policy
condition by choosing how many fields to match on for the EDM
condition. N is the SimpleTextProximityRadius value. A number of
tokens are in the proximity range if the first token in is within N x D
words from the last token. The proximity check range is directly
proportional to the number of matches by a factor of D.
See “Proximity matching example” on page 468.
Note: Increasing the radius value higher than the default can
negatively impact system performance and is not recommended.
false Default is disabled (false).
If enabled (true), the server validates tokens for Chinese, Japanese,
and Korean language keywords.
 Detecting content using Exact Data Matching (EDM) 456
Configuring EDM policies

Table 21-18 Advanced Settings for EDM indexing and detection (continued)

EDM parameter Default Description

Lexer.IncludePunctuationInWords true If true, during detection punctuation characters are considered as

part of a token.

If false, during detection punctuation within a token or multi-token

is treated as white space.

See “Multi-token with punctuation” on page 460.

Note: This setting applies to detection content, not to indexed
content.

Lexer.MaximumNumberOfTokens 12000 Maximum number of tokens extracted from each message

component for detection. Applicable to all detection technologies
where tokenization is required (EDM, profiled DGM, and the system
patterns supported by those technologies). Increasing the default
value may cause the detection server to run out of memory and
restart.
Note: In Data Loss Prevention version 12.5 and later, the default
value is changed from 30,000 to 12,000. Previously, all tokens up
to the limit, including stopwords and single letter words, were sent
to detection. In version 12.5 and later, the tokens sent for detection
do not include stopwords or single words. The number of meaningful
tokens sent to detection is approximately the same as previous
versions.

Lexer.MaxTokensPerMultiToken 10 Maximum number of sub-tokens that a multi-token cell can contain.

You can set this amount to as many sub-tokens as you need, but
the total number of characters in a multi-token cell cannot exceed
200.

See “Characteristics of multi-token cells” on page 457.

Lexer.StopwordLanguages en Enables the elimination of stop words for the specified languages.

The default is English.

Lexer.Validate true If true, performs system pattern-specific validation during

indexing.Setting this to false is not recommended.

See “Using system-provided pattern validators for EDM profiles”

on page 444.
 Detecting content using Exact Data Matching (EDM) 457
Using multi-token matching

Table 21-18 Advanced Settings for EDM indexing and detection (continued)

EDM parameter Default Description

MessageChain.NumChains
Varies This number varies depending on detection server type. It is either
4 or 8. The number of messages, in parallel, that the filereader will
process. Setting this number higher than 8 (with the other default
settings) is not recommended. A higher setting does not substantially
increase performance and there is a much greater risk of running
out of memory. Setting this to less than 8 (in some cases 1) helps
when processing big files, but it may slow down the system
considerably.

Using multi-token matching

EDM policy matching is based on tokens in the index. For languages based on the Latin
alphabet, a token is a word or string of alphanumeric characters delimited by spaces. For
Chinese, Japanese, and Korean languages, a token is determined by other means. Tokens
are normalized so that formatting and case are ignored. At run-time the server performs a
full-text search against an inbound message, checking each word against the index for potential
matches. The matching algorithm compares each word in the message with the contents of
each token in the index.
A multi-token cell is a cell in the index that contains multiple words separated by spaces,
leading or trailing punctuation, or alternative Latin and Chinese, Japanese, or Korean language
characters. The sub-token parts of a multi-token cell obey the same rules as single-token cells:
they are normalized according to their pattern where normalization can apply. Inbound message
data must match a multi-token cell exactly, including whitespace, punctuation, and stopwords
(assuming the default settings).
For example, an indexed cell containing the string "Bank of America" is a multi-token comprising
3 sub-token parts. During detection, the inbound message "bank of america" (normalized)
matches the multi-token cell, but "bank america" does not.
Multi-token matching is enabled by default. Multi-token cells are more computationally expensive
than single-token cells. If the index includes multi-token cells, you must verify that you have
enough memory to index, load, and process the EDM profile.
See “Characteristics of multi-token cells” on page 457.
See “Memory requirements for EDM” on page 475.

Characteristics of multi-token cells

Table 21-19 lists and describes characteristics of multi-token matching.
See “Using multi-token matching” on page 457.
 Detecting content using Exact Data Matching (EDM) 458
Using multi-token matching

Table 21-19 Characteristics of multi-tokens

Characteristic Description

A multi-token cell is limited to 200 total characters, Lexer.MaxTokensPerMultiToken = 10

including whitespace, punctuation, letters, numbers, and
See “Configuring Advanced Server Settings for EDM
symbols. You cannot increase this amount, but you can
policies” on page 454.
configure how many sub-tokens a multi-token can contain.

Whitespace in multi-token cells is considered, but multiple See “Multi-token with spaces” on page 458.
whitespaces are normalized to 1.

Punctuation immediately preceding and following a token See “Multi-token with punctuation” on page 460.
or sub-token is always ignored.
See “Additional examples for multi-token cells with
punctuation” on page 461.

You can configure how punctuation within a token or Lexer.IncludePunctuationInWords = true

multi-token is treated during detection. For most cases the
See “Configuring Advanced Server Settings for EDM
default setting ("true") is appropriate. If set to "false,"
policies” on page 454.
punctuation is treated as whitespace.

For proximity range checking the sub-token parts of a See “Proximity matching example” on page 468.
multi-token are counted as single tokens.

The system does not consider stopwords when matching See “Multi-token with stopwords” on page 459.
multi-tokens. In other words, stopwords are not excluded.

Multi-tokens are more computationally expensive than See “Memory requirements for EDM” on page 475.
single tokens and require additional memory for indexing,
loading, and processing.

Multi-token with spaces

Table 21-20 shows examples of multi-tokens with spaces.

Table 21-20 Multi-token cell with spaces examples

Description Indexed content Detected content Explanation

Cell contains space Bank of America Bank of America Cell with spaces is
multi-token.

Multi-token must match

exactly.

Cells contains multiple Bank of America Bank of America Multiple spaces are
spaces normalized to one.
 Detecting content using Exact Data Matching (EDM) 459
Using multi-token matching

Multi-token with stopwords

Stopwords are common words, such as articles and prepositions. When creating single-tokens,
the EDM indexing process ignores words found in the EDM stopword list
(\SymantecDLP\Protect\config\stopwords), as well as single letters. However, when creating
multi-tokens, stopwords and single letters are not ignored. Instead, they are part of the
multi-token.
Table 21-21 shows multi-token matches with stopwords, single letters, and single digits.

Table 21-21 Cell contains stopwords or single letter or single digit

Description Cell content Should match Explanation

Cell contains stopword. throw other ball throw other ball Common word ("other") is
filtered out during detection
but not when it is part of a
multi-token.

Cell contains single letter. throw a ball throw a ball Single letter ("a") is filtered
out, but not when it is part of
a multi-token.

Cell contains single digit. throw 1 ball throw 1 ball Unlike single-letter words
that are stopwords, single
digits are never ignored.

Multi-token with mixed language characters

Table 21-22 shows examples of multi-tokens with mixed Latin and CJK characters.

Table 21-22 Multi-token cell with Latin and CJK characters examples

Description Cell content Should match Explanation

Cell includes Latin and CJK ABC傠傫 ABC傠傫 Mixed Latin-CJK cell is
characters with no spaces. multi-token.
傠傫ABC 傠傫ABC
Must match exactly.

Cell includes Latin and CJK ABC 傠傫 ABC 傠傫 Multiple spaces are reduced
with one or more spaces. to one.
傠傥 ABC 傠傥 ABC

Cell contains Latin or CJK 什仁 仂仃 仄仅 仇仈仉 什仁 仂仃 仄仅 仇仈仉 Single-token cell.

with numbers. 147(什仂仅 51-1) 147(什仂仅 51-1)
 Detecting content using Exact Data Matching (EDM) 460
Using multi-token matching

Multi-token with punctuation

Punctuation is always ignored if it comes at the beginning (leading) or end (trailing) of a token
or multi-token. Whether punctuation included in a token or multi-token is required for matching
depends on the Advanced Server Setting Lexer.IncludePunctuationInWords, which by
default is set to true (enabled).
See “Multi-token punctuation characters” on page 465.

Note: For convenience purposes the Lexer.IncludePunctuationInWords parameter is referred

to by the three-letter acronym "WIP" throughout this section.

The WIP setting operates at detection-time to alter how matches are reported. For most EDM
policies you should not change the WIP setting. For a few limited situations, such as account
numbers or addresses, you may need to set IncludePunctuationInWords = false depending
on your detection requirements.
See “Multi-token punctuation characters” on page 465.
Table 21-23 lists and explains how multi-token matching works with punctuation.

Table 21-23 Multi-token punctuation table

Indexed Detected WIP setting Match Explanation

content content

a.b a.b TRUE Yes The indexed content and the detected content are
exactly the same.

FALSE No The detected content is treated as "a b" and is therefore

not a match.

a.b ab TRUE No The indexed content and the detected content are
different.

FALSE No The indexed content and the detected content are

different.

ab a.b TRUE No The indexed content and the detected content are
different.

FALSE Yes The detected content is treated as "a b" and is therefore
a match.

ab ab TRUE Yes The indexed content and the detected content are
exactly the same

FALSE Yes The indexed content and the detected content are
exactly the same
 Detecting content using Exact Data Matching (EDM) 461
Using multi-token matching

Additional examples for multi-token cells with punctuation

Table 21-24 lists and describes some additional examples for multi-token cells with punctuation.
In these examples, the main thing to keep in mind is that during indexing, if a token includes
punctuation marks between characters the punctuation is always retained. This means that
EDM cannot detect that cell if the WIP setting is false. In other words, if indexed data has cell
which has a token with internal punctuation, the WIP setting should be set to true.

Table 21-24 Additional use cases for multi-token cells with punctuation

Description Indexed content Detected content Explanation

Cell contains a physical 346 Guerrero St., Apt. #2 346 Guerrero St., Apt. #2 The indexed content is a
address with punctuation. multi-token cell.
346 Guerrero St Apt 2
Both match because the
punctuation comes at the
beginning or end of the
sub-token parts and is
therefore ignored.

Cell contains internal O'NEAL ST. O'NEAL ST The indexed content is a

punctuation with no space multi-token cell.
before or after.
Internal punctuation is
included (assuming WIP is
true), and leading or trailing
punctuation is ignored
(assuming there is a space
delimiter after the
punctuation).

Cell contains Asian 傠傫;;傠傫 傠傫;;傠傫 (if WIP true) The indexed content is a
language characters (CJK) single token cell.
with indexed internal
During detection, Asian
punctuation.
language characters (CJK)
with internal punctuation is
affected by the WIP setting.
Thus, in this example 傠傫;;
傠傫 matches only if the WIP
setting is true.

If the WIP setting is false, 傠

傫;;傠傫 is considered a
multi-token because the
internal punctuation is
treated as whitespace. Thus,
no content can match.
 Detecting content using Exact Data Matching (EDM) 462
Using multi-token matching

Table 21-24 Additional use cases for multi-token cells with punctuation (continued)

Description Indexed content Detected content Explanation

Cell contains Asian 傠傫 傠傫 傠傫 傠傫 The indexed content is a

language characters (CJK) multi-token cell.
傠傫;;傠傫 (if WIP false)
without indexed internal
The detected content
punctuation.
matches as indexed. If the
WIP setting is false, the
detected content matches
傠傫;;傠傫 because internal
punctuation is ignored.

Cell contains mix of Latin EDM;;傠傫 EDM 傠傫 The indexed content is a

and CJK characters with multi-token cell.
punctuation separating the
A cell with alternate Latin
Latin and Asian characters.
and CJK characters is
always a multi-token and
punctuation between Latin
and Asian characters is
always treated as a single
white space regardless of
the WIP setting.

Cell contains mix of Latin DLP;;EDM 傠傫;;傠傥 DLP;;EDM;;傠傫;;傠傥 (if The indexed content is a
and CJK characters with WIP true) multi-token cell.
internal punctuation.
DLP;;EDM 傠傫;;傠傥 (if During detection,
WIP true) punctuation between the
Latin and Asian characters
is treated as a single
whitespace and leading and
trailing punctuation is
ignored.

If the WIP setting is true the

punctuation internal to the
Latin characters and internal
to the Asian character is
retained.

If the WIP setting is false, no

content can match because
internal punctuation is
ignored.
 Detecting content using Exact Data Matching (EDM) 463
Using multi-token matching

Table 21-24 Additional use cases for multi-token cells with punctuation (continued)

Description Indexed content Detected content Explanation

Cell contains mix of Latin DLP EDM 傠傫 傠傥 DLP EDM 傠傫 傠傥 The indexed content is a
and CJK characters with multi-token cell.
DLP;EDM 傠傫;傠傥 (if WIP
internal punctuation.
false) During detection,
punctuation between the
DLP;EDM;;傠傫;傠傥 (if WIP
Latin and Asian characters
false)
is treated as a single
whitespace and leading and
trailing punctuation is
ignored. Thus, it matches as
indexed.

If the WIP setting is false, it

matches DLP;EDM;;傠傫;傠
傥 because internal
punctuation is ignored.

Some special use cases for system-recognized data patterns

EDM provides validation for and recognition of the following special data patterns:
■ Credit card number
■ Email address
■ IP address
■ Number
■ Percent
■ Phone number (US, Canada)
■ Postal code (US, Canada)
■ Social security number (US SSN)
See “Using system-provided pattern validators for EDM profiles” on page 444.

Note: It is a best practice to always validate your index against the recognized system patterns
when the data source includes one or more such column fields. See “Map data source column
to system fields to leverage validation” on page 506.

The general rule for system-recognized patterns is that the WIP setting does not apply during
detection. Instead, the rules for that particular pattern apply. In other words, if the pattern is
recognized during detection, the WIP setting is not checked. This is always true if the pattern
 Detecting content using Exact Data Matching (EDM) 464
Using multi-token matching

is a string of characters such as an email address, and if the cell contains a number that
conforms to one of the recognized number patterns (such as CCN or SSN).
In addition, even if the pattern is a generic number such as account number that does not
conform to one of the recognized number patterns, the WIP setting may still not apply. To
ensure accurate matching for generic numbers that do not conform to one of the
system-recognized patterns, you should not include punctuation in these number cells. If the
cell contents conforms to one of the system-recognized patterns, the punctuation rules for that
pattern apply and the WIP setting does not.
See “Do not use the comma delimiter if the data source has number fields” on page 505.
See Table 21-25 on page 464. lists and describes examples for detecting system-recognized
data patterns.

Caution: This list is not exhaustive. It is provided for informational purposes only to ensure that
you are aware that data that matches system-defined patterns takes precedence and the WIP
setting is ignored. Before deploying your EDM policies into production, you must test detection
accuracy and adjust the index accordingly to ensure that the data that you have indexed
matches as expected during detection.

Table 21-25 Some special use cases for system-recognized data patterns

Description Indexed content Detected content Explanation

Cell contains an email person@example.com person@example.com An email address is indexed

address. and detected as a
single-token regardless of
the WIP setting. It must
match exactly as indexed. If
you were to set WIP to false,
"person example com"
would not match as a
multi-token and does not
match the indexed
single-token.
 Detecting content using Exact Data Matching (EDM) 465
Using multi-token matching

Table 21-25 Some special use cases for system-recognized data patterns (continued)

Description Indexed content Detected content Explanation

Cells contains a 10-digit ########## ########## The WIP setting is ignored

account number. because the number
(###) ### ####
conforms to the phone
(###) ###-#### number pattern and its rules
take precedence.

## ###### ## ## ###### ## Must match exactly. The

pattern ##-######-## does
not match even if WIP is set
to false.

### #### ### ### #### ### Must match exactly. The
pattern ###-####-### does
not match even if WIP is set
to false.

Multi-token punctuation characters

In EDM, a multi-token cell is any cell that has been indexed that contains punctuation (as well
as spaces or alternative Latin words and CJK characters).
See Table 21-26 on page 465.
Using multi-token matching lists the symbols that are identified and treated as punctuation
during EDM indexing.

Table 21-26 Characters treated as punctuation for indexing

Punctuation name Character representation

Apostrophe '

Tilde ~

Exclamation point !

Ampersand &

Dash -

Single quotation mark '

Double quotation mark "

Period (dot) .
 Detecting content using Exact Data Matching (EDM) 466
Using multi-token matching

Table 21-26 Characters treated as punctuation for indexing (continued)

Punctuation name Character representation

Question mark ?

At sign @

Dollar sign $

Percent sign %

Asterisk *

Caret symbol ^

Open parenthesis (

Close parenthesis )

Open bracket [

Close bracket ]

Open brace {

Close brace }

Forward slash /

Back slash \

Pound sign #

Equal sign =

Plus sign +

Semicolon ;

Match count variant examples

The default value for the Advanced Server setting EDM.MatchCountVariant eliminates the
matches that consist of the same set of tokens from some other match. Rarely is there a need
to change the default value, but if necessary you can configure how EDM matches are counted
using this parameter.
See “Advanced server settings” on page 245.
 Detecting content using Exact Data Matching (EDM) 467
Using multi-token matching

Table 21-27 provides examples for match counting. All examples assume that the policy is
set to match three out of four column fields and that the profile index contains the following
cell contents:
Kathy | Stevens | 123-45-6789 | 1111-1111-1111-1111
Kathy | Stevens | 123-45-6789 | 2222-2222-2222-2222
Kathy | Stevens | 123-45-6789 | 3333-3333-3333-3333

Table 21-27 Match count variant examples

Inbound message Match Number of matches Explanation

contents count
variant

Kathy Stevens 123-45-6789 1 3 Records matched in the profile: first

name, last name, and SSN.

2 1 Number of unique token sets matched.

3 1 Number of unique supersets of token

sets.

Kathy Stevens 123-45-6789 1 3 If

1111-1111-1111-1111 EDM.HighlightAllMatchesInProximity=false,
2 1: if EDM matches the left-most tokens for
Kathy Stevens 123-45-6789 EDM.HighlightAllMatchesInProximity=false each profile data row. The token set for
(default) each row is as follows:
2: if Row # 1: Kathy Stevens 123-45-6789
EDM.HighlightAllMatchesInProximity=true
Row # 2: Kathy Stevens 123-45-6789
3 1
Row # 3: Kathy Stevens 123-45-6789

If
EDM.HighlightAllMatchesInProximity=true,
EDM matches all tokens within the
proximity window. The token set for each
row is as follows:

Row # 1: Kathy Stevens 123-45-6789

1111-1111-1111-1111 Kathy Stevens
123-45-6789

Row # 2: Kathy Stevens 123-45-6789

Kathy Stevens 123-45-6789

Row # 3: Kathy Stevens 123-45-6789

Kathy Stevens 123-45-6789
 Detecting content using Exact Data Matching (EDM) 468
Using multi-token matching

Table 21-27 Match count variant examples (continued)

Inbound message Match Number of matches Explanation

contents count
variant

1111-1111-1111-1111 1 3 If
Kathy Stevens 123-45-6789 EDM.HighlightAllMatchesInProximity=false,
2 2 EDM matches the left-most tokens for
each profile data row. The token set for
3 2: if
each row is as follows:
EDM.HighlightAllMatchesInProximity=false
(default) Row # 1: 1111-1111-1111-1111 Kathy
Stevens
1: if
EDM.HighlightAllMatchesInProximity=true Row # 2: Kathy Stevens 123-45-6789
Row # 3: Kathy Stevens 123-45-6789

If
EDM.HighlightAllMatchesInProximity=true,
EDM matches all tokens within the
proximity window. The token set for each
row is as follows:

Row # 1: 1111-1111-1111-1111 Kathy

Stevens 123-45-6789

Row # 2: Kathy Stevens 123-45-6789

Row # 3: Kathy Stevens 123-45-6789

Proximity matching example

EDM protects confidential data by correlating uniquely identifiable information, such as SSN,
with data that is not unique, such as last name. When correlating data, it is important to ensure
that terms are related. In natural languages, it is more likely that when two words appear close
together they are being used in the same context and are therefore related.
Based on the premise that word proximity indicates relatedness, EDM employs a
proximity-matching radius or range to limit how much freeform content the system will examine
when searching for matches. EDM proximity matching is designed to reduce false positives
by ensuring that matched terms are proximate.
The proximity range is proportional to the policy definition. The proximity range is determined
by the proximity radius multiplied by the number of matches required by the EDM policy
condition. The radius is set by the Advanced Server Setting parameter
EDM.SimpleTextProximityRadius. The default value is 35. In addition, proximity matching
applies to both free-form text and tabular data. There is no distinction at run-time between the
 Detecting content using Exact Data Matching (EDM) 469
Using multi-token matching

two. Thus, tabular data is treated the same as free text data and the proximity check is
performed beyond the scope of the length of the row contents
For example, assuming the default radius of 35 and a policy set to match 3 out of 4 column
fields, the proximity range is 105 tokens (3 x 35). If the policy matches 2 out of 3 the proximity
range is 70 tokens (35 x 2).

Warning: While you can decrease the value of the proximity radius, Symantec does not
recomment increasing this value beyond the default (35). Doing so may cause performance
issues. See “Configuring Advanced Server Settings for EDM policies” on page 454.

Table 21-28 shows a proximity matching example based on the default proximity radius setting.
In this example, the detected content produces 1 unique token set match, described as follows:
■ The proximity range window is 105 tokens (35 x 3).
■ The proximity range window starts at the leftmost match ("Stevens") and ends at the
rightmost match ("123-45-6789").
■ The total number of tokens from "Stevens" to the SSN (including both) is 105 tokens.
■ The stopwords "other" and "a" are counted for proximity range purposes.
■ "Bank of America" is a multi-token. Each sub-token part of a multi-token is counted as a
single token for proximity purposes.

Table 21-28 Proximity example

Indexed data Policy Proximity Detected content

Last_Name | Employer | Match 3 of 3 Radius = 35 Zendrerit inceptos Kathy Stevens lorem ipsum pharetra
SSN tokens (default) convallis leo suscipit ipsum sodales rhoncus, vitae dui
nisi volutpat augue maecenas in, luctus id risus magna
Stevens | Bank of America
arcu maecenas leo quisque. Rutrum convallis tortor
| 123-45-6789
urna morbi elementum hac curabitur morbi, nunc dictum
primis elit senectus faucibus convallis surfrent.
Aptentnour gravida adipiscing iaculis himenaeos,
himenaeos a porta etiam viverra. Class torquent uni
other tristique cubilia in Bank of America. Dictumst
lorem eget ipsum. Hendrerit inceptos other sagittis
quisque. Leo mollis per nisl per felis, nullam cras mattis
augue turpis integer pharetra convallis suscipit
hendrerit? Lubilia en mictumst horem eget ipsum.
Inceptos urna sagittis quisque dictum odio hendrerit
convallis suscipit ipsum wrdsrf 123-45-6789.
 Detecting content using Exact Data Matching (EDM) 470
Updating EDM indexes to the latest version

Updating EDM indexes to the latest version

When you upgrade to Symantec Data Loss Prevention 15.0 from a version earlier than 14.0,
and you have not reindexed your EDM data source, you must update each Exact Data profile
by reindexing the data source using the 15.0 EDM Indexer. You need to verify the amount of
memory that is required for indexing the data source, and loading and processing the index
at run-time on the detection server.

Note: If you have 14.x indexes, you do not need to reindex for version 15.0.

See “About upgrading EDM deployments” on page 431.

See “Memory requirements for EDM” on page 475.
If you do not reindex the data source file, the system presents error messages indicating that
the Exact Data profile is out-of-date. You must reindex the Exact Data profile, and re-calculate
memory requirements.
See “EDM index out-of-date error codes” on page 474.
Two primary 15.0 upgrade scenarios exist for EDM:
■ You use the Remote EDM Indexer to create 15.0-compliant indexes remotely and copy
them to the Enforce Server.
See “Update process using the Remote EDM Indexer” on page 470.
■ You already have a data source file that is current and cleansed that you can copy to the
upgraded 15.0 Enforce Server for indexing.
See “Update process using the Enforce Server” on page 472.

Update process using the Remote EDM Indexer

You can use the following procedure for upgrading your EDM deployments to Symantec Data
Loss Prevention 15.0. This procedure assumes that you can remotely index the data source
and copy the index file to the Enforce Server.

Note: If you are running Symantec Data Loss Prevention version 14.6 or later, you are not
required to reindex.

See “Remote EDM indexing” on page 483.

If remote indexing is not possible, the other option for upgrade is to copy the data source file
to the 15.0 Enforce Server.
See “Update process using the Enforce Server” on page 472.
 Detecting content using Exact Data Matching (EDM) 471
Updating EDM indexes to the latest version

Table 21-29 Update process using the Remote EDM Indexer

Step Action Description

1 Upgrade the Enforce Server Refer to the Symantec Data Loss Prevention Upgrade Guide at
to 15.0. http://www.symantec.com/docs/DOC9258 for details.

Do not upgrade the EDM detection server(s) now.

The 15.0 Enforce Server can continue to receive incidents from non-15.0
detection servers during the upgrade process. Policies and other data cannot
be pushed out to non-15.0 detection servers (one-way communication only
between Enforce 15.0 and non-15.0 detection servers).

2 Create a 15.0-compatible Using the 15.0 Enforce Server administration console, create a new EDM
remote EDM profile profile template for remote EDM indexing.
template.
See “Creating an EDM profile template for remote indexing” on page 487.

Download the *.edm profile template and copy it to the remote data source
host system.

See “Downloading and copying the EDM profile file to a remote system”
on page 490.

3 Install the 15.0 Remote EDM Install the Symantec Data Loss Prevention 15.0 Remote EDM Indexer on the
Indexer on the remote data remote data source host so that you can index the data source.
source host.
See “Remote EDM indexing” on page 483.

4 Calculate the memory that Calculate the memory that is required for indexing before you attempt to index
is required to index the data the data source. The Remote EDM Indexer is allocated sufficient memory to
source and adjust the index most data sources. If you have a very large index you may have to
indexer memory setting. allocate more memory.

See “Memory requirements for EDM” on page 475.

5 Index the data source using The result of this process is multiple 15.0-compatible *.rdx files that you
the 15.0 Remote EDM can load into a 15.0 Enforce Server system.
Indexer.
If you have a data source file prepared, run the Remote EDM Indexer and
index it.

See “Remote indexing examples using data source file” on page 491.

If the data source is an Oracle database and the data is clean, use the SQL
Preindexer to pipe the data to the Remote EDM Indexer.

See “Remote indexing examples using SQL Preindexer” on page 492.

 Detecting content using Exact Data Matching (EDM) 472
Updating EDM indexes to the latest version

Table 21-29 Update process using the Remote EDM Indexer (continued)

Step Action Description

6 Calculate the memory that You need to calculate how much RAM the detection server requires to load
is required to load and and process the index at run-time. These calculations are required for each
process the index and adjust EDM index you want to deploy.
the detection server memory
See “Memory requirements for EDM” on page 475.
setting for each EDM
detection server host.

7 Update the EDM profile by Copy the *.pdx and *.rdx files from the remote host to the 15.0 Enforce
loading the 15.0 index. Server host file system.

Load the index into the EDM profile you created in Step 2.

See “Copying and loading remote index files to the Enforce Server”
on page 493.

8 Upgrade one or more EDM Once you have created the 15.0-compliant EDM profiles and upgraded the
detection servers to 15.0. Enforce Server, you can then upgrade the detection servers.

Refer to the Symantec Data Loss Prevention Upgrade Guide at

http://www.symantec.com/docs/DOC9258 for details.

Make sure that you have calculated and verified the memory requirements
for loading and processing multi-token indexes on the detection server.

See “Memory requirements for EDM” on page 475.

9 Test and verify the updated To test the upgraded system and updated index, you can create a new policy
index. that references the updated index.

10 Remove out-of-date EDM Once you have verified the new EDM index and policy, you can retire the
indexes. legacy EDM index and policy.
Note: Indexes that are created for versions earlier than 14.0 do not work with
version 14.5 or later.

Update process using the Enforce Server

Use the following index update procedure if remote indexing is not possible and you have a
current data source file that you can copy to the Enforce Server.

Note: If you are running Symantec Data Loss Prevention version 14.6 or later, you are not
required to reindex.
 Detecting content using Exact Data Matching (EDM) 473
Updating EDM indexes to the latest version

Table 21-30 Update process using the Enforce Server

Step Action Description

1 Upgrade the Enforce Server Refer to the Symantec Data Loss Prevention Upgrade Guide at
to 15.0. http://www.symantec.com/docs/DOC9258 for details.

Do not upgrade the EDM detection servers now.

The 15.0 Enforce Server can continue to receive incidents from non-15.0
detection servers during the upgrade process. Policies and other data cannot
be pushed out to non-15.0 detection servers (one-way communication only
between Enforce 15.0 and non-15.0 detection servers).

2 Create, prepare, and copy Copy the data source file to the /SymantecDLP/Protect/datafiles
the data source file to the directory on the upgraded 15.0 Enforce Server host file system.
15.0 Enforce Server host.
See “Creating the exact data source file for EDM” on page 433.

See “Preparing the exact data source file for indexing” on page 435.

See “Uploading exact data source files to the Enforce Server” on page 436.

3 Calculate memory the Calculate the memory that is required for indexing before you attempt to index
memory that is required to the data source.
index the data source and
See “Memory requirements for EDM” on page 475.
update the indexer memory
setting.

4 Create a new Create a new EDM profile using the 15.0 Enforce Server administration
15.0-compliant EDM profile console.
and index the data source
Choose the option Reference Data Source on Manager Host for uploading
file.
the data source file (assuming that you copied it to the /datafiles directory).

Index the data source file on save of the profile.

See “Creating and modifying Exact Data Profiles” on page 438.

5 Calculate the memory that You need to calculate how much RAM the detection server requires to load
is required to load and and process the index and run-time. These calculations are required for each
process the index at EDM index you want to deploy and the memory adjustments are cumulative.
run-time. Adjust the memory
See “Memory requirements for EDM” on page 475.
settings for each EDM
detection server host.
 Detecting content using Exact Data Matching (EDM) 474
Updating EDM indexes to the latest version

Table 21-30 Update process using the Enforce Server (continued)

Step Action Description

6 Upgrade the EDM detection Once you have created the 15.0-compliant EDM profile you can then upgrade
servers to 15.0. the detection servers.

Refer to the Symantec Data Loss Prevention Upgrade Guide at

http://www.symantec.com/docs/DOC9258 for details.

Make sure that you have calculated and verified the memory requirements
for loading and processing multi-token indexes on the detection server.

See “Memory requirements for EDM” on page 475.

7 Test and verify the updated To test the upgraded system and updated index, you can create a new policy
index. that references the updated index.

8 Remove out-of-date EDM Once you have verified the new EDM index and policy, you can retire the
indexes. legacy EDM index and policy.
Note: Indexes that are created for versions earlier than 14.0 do not work
with version 14.5 and later.

See “Remote EDM indexing” on page 483.

EDM index out-of-date error codes

Symantec Data Loss Prevention 14.0 provided several enhancements for EDM. To take
advantage of these enhancements, you must reindex the data source for each Exact Data
profile using the 15.0 EDM Indexer.
If your EDM index is not compliant with the current version, the system returns error codes.
These error codes are listed in Table 21-31.

Table 21-31 Error messages for non-compliant Exact Data Profiles

Error message type Error code Error message

Enforce Server error 2928 One or more profiles are out of date and must be reindexed.
event
See “Updating EDM indexes to the latest version” on page 470.

See “Memory requirements for EDM” on page 475.

Enforce Server error 2928 Check the Manage > Data Profiles > Exact Data page for more details.
event detail The following EDM profiles are out of date: Profile X, Profile XY, and so
on.

System Event error 2928 One or more profiles are out of date and must be reindexed.

Exact Data Profile error N/A This profile is out of date, and must be reindexed.
 Detecting content using Exact Data Matching (EDM) 475
Memory requirements for EDM

Memory requirements for EDM

Using EDM for Symantec Data Loss Prevention deployments affects hardware memory
requirements for Symantec Data Loss Prevention deployments. In particular, EDM affects the
memory required to index the data size as well as the memory required to load the index on
the detection server.
Once you have established what your specific EDM memory requirements are, you can evaluate
how those requirements affect the general system requirements for your Data Loss Prevention
deployment. See the Symantec Data Loss Prevention System Requirements and Compatibility
Guide for details about general requirements and potential EDM deployment impact.

About memory requirements for EDM

The memory requirements for EDM are related to several factors, including:
■ Number of indexes you are building
■ Total size of the indexes
■ Number of cells in each index
■ Number of message chains
These size limitations apply to EDM indexes:
■ The maximum number of rows supported is 4 billion – 2 (2^32–2 ).
■ The maximum number of supported cells is 6 billion.
Table 21-32 gives an overview of the steps that you can follow to determine and set memory
requirements for EDM.

Table 21-32 Workflow for determining memory requirements for EDM indexes

Step Action For more information

1 Determine the memory See “Overview of configuring memory and indexing the data
that is required to index source” on page 476.
the data source.

2 Increase the indexer See “Increasing the memory for the Enforce Server EDM
memory according to your indexer” on page 478.
calculations.
See “Increasing the memory for the Remote EDM indexer”
on page 478.

3 Determine the memory See “Detection server memory requirements” on page 479.
that is required to load the
index on the detection
server.
 Detecting content using Exact Data Matching (EDM) 476
Memory requirements for EDM

Table 21-32 Workflow for determining memory requirements for EDM indexes (continued)

Step Action For more information

4 Increase the detection See “Increasing the memory for the detection server (File
server memory according Reader)” on page 482.
to your calculations.

5 Repeat for each EDM

index you want to deploy.

Overview of configuring memory and indexing the data source

Table 21-33 provides the steps for determining how much memory is needed to index the data
source.

Table 21-33 Memory requirements for indexing the data source

Step Action Details

1 Estimate the memory requirements See “Determining requirements for both local and remote
for the indexer. indexers” on page 476.

2 Increase the indexer memory. The next step is to increase the memory allocated to the
indexer. The procedure for increasing the indexer memory
differs depending on whether you are using the EDM indexer
local to the Enforce Server or the Remote EDM Indexer.

See “Increasing the memory for the Enforce Server EDM

indexer” on page 478.

See “Increasing the memory for the Remote EDM indexer”

on page 478.

3 Restart the Vontu Manager service. You must restart this service after you have changed the
memory allocation.

4 Index the data source. The last step is to index the data source. You need to do this
before you calculate remaining memory requirements.

See “Configuring Exact Data profiles” on page 431.

Determining requirements for both local and remote indexers

This topic provides an overview of memory requirements for both the EDM indexer that is local
to the Symantec Data Loss Prevention Enforce Server and for the Remote EDM Indexer.
 Detecting content using Exact Data Matching (EDM) 477
Memory requirements for EDM

With the default settings, both EDM indexers can index any data source with 500 million cells
or less. For any data source with more than 500 million cells, an additional 3 bytes per cell is
needed to index the data source.
You can schedule indexing for multiple indexes serially (at different times) or in parallel (at the
same time). When indexing serially, you need to allocate memory to accommodate the indexing
of the biggest index. When indexing in parallel, you need to allocate memory to accommodate
the indexing of all indexes that you are creating at that time.

Serial indexing
If you create the indexes serially (no two are created in parallel), the memory requirement for
the biggest index is:
2 billion cells – 0 .5 billion default x 3 bytes = 4.5 GB rounded to 5 GB additional memory.
As explained in detail later, set wrapper.java.maxmemory to 7 GB (7168M). This 7 GB includes
the 2 GB (2048 MB) default memory for Enforce and the 5 GB additional memory.
Table 21-34 provides examples for how the data source size affects indexer memory
requirements for serial indexes.

Table 21-34 Examples for indexer memory requirements-serial indexing

Data source size Indexer memory Description

requirement

100 million cells 2048 MB (default) No additional RAM is needed for the indexer.

500 million cells 2048 MB (default) No additional RAM is needed for the indexer.

1 billion cells 4 GB If you have a single data source with 1 billion cells (for
example, 10 columns by 100 million rows), you need extra
memory for 0.5 billion cells (1 billion cells – 0.5 million default)
0.5 million x 3 bytes, or 1.5 GB of RAM (rounded to 2 GB) to
index the data source. This amount is added to the default
indexer RAM allotment.

2 billion cells 7 GB If you have a single data source with 2 billion cells (for
example, 10 columns by 200 million rows), you need extra
memory for 1.5 billion cells (2 billion cells – 0.5 million default)
1.5 million x 3 bytes, or 4.5 GB of RAM (rounded to 5 GB) to
index the data source.

Parallel indexing
If you index these four files in Table 21-34 simultaneously (in parallel), you are indexing more
than 500 million cells. So, the additional memory (3.6 billion cells – 0.5 billion cells provided
by default) required is as follows:
 Detecting content using Exact Data Matching (EDM) 478
Memory requirements for EDM

3.1 billion cells x 3 bytes = 9.3 GB rounded to 10 GB additional memory.

As explained in detail later, you set wrapper.java.maxmemory to 12 GB. This 12 GB includes
2048 MB default memory for Enforce and an additional 9 GB from the additional memory
calculation above.

Note: For CJK language indexes, or indexes that are predominantly multi-token, these formulas
should use a multiplier of 4 bytes instead of 3 bytes. In both of these cases, a 350-million cell
data source is supported by default.

See “Increasing the memory for the Enforce Server EDM indexer” on page 478.

Increasing the memory for the Enforce Server EDM indexer

Complete the following steps to increase the memory for the Enforce Server indexer.
These steps assume that you have performed the indexer calculations.
To increase the memory for the Enforce Server indexer
1 Open the \SymantecDLP\protect\config\VontuManager.conf file.
2 Locate the following Initial Java Heap Size (in MB) parameter.
wrapper.java.maxmemory = 2048 (the default value is 2048 MB (2 GB); your value may
be different if you have already changed it)
3 Add the value of your calculation to the maxmemory setting.
For example, if by your calculation you determine that you need an additional 2.6 GB of
RAM, you increase the value by an additional 2662 MB.

Note: This result is added to the existing memory setting; it is not used to replace the
existing memory setting.

wrapper.java.maxmemory = 4710 (the default value 2048 plus the additional calculation
of 2662)
4 Save the VontuManager.conf file.
5 Restart the Vontu Manager service.

Increasing the memory for the Remote EDM indexer

The Remote EDM Indexer runs with the default JVM settings. This means that the Remote
EDM Indexer is allocated approximately 25% of the total RAM that the computer has installed.
For most data sources, the default memory settings are sufficient for remote indexing.
 Detecting content using Exact Data Matching (EDM) 479
Memory requirements for EDM

You set the JVM heap size for the Remote EDM Indexer process by creating a *.vmoptions
file and deploying it to the Remote EDM Indexer host.
The *.vmoptions file accepts one JVM option per line. For example, you can specify the
following option in a file you save as RemoteEDMIndexer.vmoptions:
-Xmx11G

See “Overview of configuring memory and indexing the data source” on page 476.
To deploy the *.vmoptions file, copy it to the following locations:
For Linux: /opt/SymantecDLP/Protect/bin/RemoteEDMIndexer.vmoptions
For Windows: \SymantecDLP\Protect\bin\RemoteEDMIndexer.exe.vmoptions
See “Generating remote index files” on page 490.

Detection server memory requirements

The detection server should not use more than 60% of the memory of the computer. For
example, if your detection server needs 6 GB memory to run, make sure you have 10 GB on
that server.

Default configuration for a detection server

The default configuration for a detection server has 4 GB and 8 message chains. Here are a
few examples of index combinations that are supported with this default configuration:
■ 1 index with 100 million cells, or
■ 4 indexes of 25 million cells each, or
■ 6 indexes with 15 million cells each, or
■ 8 indexes with 10 million cells each
See the following formulas and Table 21-35 to determine how to calculate your actual memory
requirements. In addition, you can use the spreadsheet provided at the Symantec Data Loss
Prevention Knowledgebase to determine your actual memory requirements. See “Using the
EDM Memory Requirements Spreadsheet” on page 483.
To load the index, the detection server needs 14 bytes per cell plus memory for each message
chain in the detection server. The following examples show scenarios for a customer who has
three indexes that are all under the same schedule.
For memory requirements, the general formula is:
memory requirement = index size + message chains memory.
For index size, the formula is:
number of cells * 14 bytes.
 Detecting content using Exact Data Matching (EDM) 480
Memory requirements for EDM

For message chains with less than or equal to 1 billion cells the formula is:
number of message chains * 700 MB.
For message chains with more than 1 billion cells the formula is:
maximum (number of chains * 700 MB, 20% * index size).

Detection Server memory settings

The Advanced Server Settings property for the number of message chains is
MessageChain.NumChains.

The memory settings for a detection server are set in the Enforce Server console at the Server
Detail - Advanced Server Settings page, using the BoxMonitor.FileReaderMemory. property.
The format is -Xrs -Xms1200M –Xmx4G

Note: When you update this setting, only change the -Xmx value in this property. For example,
only change "4G." to a new value, and leave all other values the same.

The examples in Table 21-35 show the settings for five different situations.

Table 21-35 EDM detection server memory settings examples

Example Calculation Boxmonitor.FileReaderMemory

settings

Example 1: Single small index Memory required is: 2 million * 14 default settings
with 2 million cells to load bytes = 28 MB
 Detecting content using Exact Data Matching (EDM) 481
Memory requirements for EDM

Table 21-35 EDM detection server memory settings examples (continued)

Example Calculation Boxmonitor.FileReaderMemory

settings

Example 2: 3 indexes when Memory required on the detection -Xmx57G

running 24 chains: server when running 24 chains is:

■ Index 1: 100 million cells For small 100 million cells index
■ Index 2: 1 billion cells the size of the index itself is100
■ Index 3: 2 billion cells million cells * 14 bytes = 1.3 GB.

For 1 billion cells index: 1 billion

cells * 14 bytes = 13 GB.

For 2 billion cells index: 2 billion

cells * 14 bytes = 26.1 GB.

The total size of the three indexes

is 40.4 GB (1.3 GB + 13 GB +
26.1 GB).

Since 20% of 40.4 GB (8.08 GB)

is less than 24 * 700M (16.4), the
final number is:

40.4 GB + 16.4 GB = 56.8 GB

rounded to 57 GB.

Example 3: One single index with Memory required on the detection –Xmx82G
5 billion cells and 24 message server with one index with 5 billion
chains cells running 24 message chains:

5 billion cells * 14 bytes = 65.2

GB.

20% of 65.2 GB = 13.04 GB which

is less than 24 * 700M = 16.4 GB
so the final number is:

65.2 GB + 16.4 GB = 81.6 GB

rounded to 82 GB.
 Detecting content using Exact Data Matching (EDM) 482
Memory requirements for EDM

Table 21-35 EDM detection server memory settings examples (continued)

Example Calculation Boxmonitor.FileReaderMemory

settings

Example 4: One single index with Memory required on the detection –Xmx37G
1.6 billion cells and 24 message server with one index with 1.6
chains billion cells and 24 message
chains:

1.6 billion cells * 14 bytes = 20.9

GB.

Since 24 chains memory is more

than 20% of the index, the
memory requirement for this index
is:

20.9 GB + 16.4 GB = 37.3 GB

rounded to 37 GB.

Example 5: One single index with Memory required on the detection –Xmx12G
500 million cells and 8 message server with one index with 500
chains million cells and 8 message
chains:

500 million cells * 14 bytes + 8 *

700 MB = 6.5 GB + 5.5 GB = 12
GB.

Increasing the memory for the detection server (File Reader)

This topic provides instructions for increasing the File Reader memory allocation for a detection
server.
These instructions assume that you have performed the necessary calculations.
To increase the memory for detection server processing
1 In the Enforce Server administration console, navigate to the Server Detail - Advanced
Server Settings screen for the detection server where the EDM index is deployed or to
be deployed.
2 Locate the following setting: BoxMonitor.FileReaderMemory.
3 Change the -Xmx4G value in the following string to match the calculations you have made.
-Xrs -Xms1200M -Xmx4G -XX:PermSize=128M -XX:MaxPermSize=256M
For example: -Xrs -Xms1200M -Xmx11G -XX:PermSize=128M -XX:MaxPermSize=256M
4 Save the configuration and restart the detection server.
 Detecting content using Exact Data Matching (EDM) 483
Remote EDM indexing

Using the EDM Memory Requirements Spreadsheet

The EDM Memory Requirements Spreadsheet is a tool you can use to determine the amount
of memory needed on the detection server to run your indexes. It is available as an Excel
spreadsheet on the Symantec Data Loss Prevention Knowledgebase at:
https://support.symantec.com/en_US/article.DOC8255.html
Figure 21-1 shows an example of the spreadsheet with four message chains and three indexes.

Figure 21-1 EDM Memory Requirements Spreadsheet

To compute the RAM required to run your indexes, enter the following information:
1. Obtain the number of message chains from the MessageChain.NumChains advanced
server setting and enter that number into # of Message Chains.
2. Obtain the number of cells in each index (you can specify up to 10 indexes) and enter
that number into # of cells in Index.
When you change any value, the spreadsheet updates the Required RAM field.
The value in the Required RAM field is the amount of memory that is required to run the
indexes specified. See “Increasing the memory for the detection server (File Reader)”
on page 482. for information on updating the -Xmx parameter in the
BoxMonitor.FileReaderMemory setting.

Remote EDM indexing

An EDM index maps the data you want to protect to the Exact Data profile. The typical EDM
workflow for creating the EDM index is to upload the data source file to the Enforce Server,
create the Exact Data profile, and index the data source. Instead of uploading the data source
file to the Enforce Server for indexing, you can index the data source locally and securely using
the Remote EDM Indexer.
See “About the Exact Data Profile and index” on page 426.
For example, if copying the confidential data source file to the Enforce Server presents a
potential security or logistical issue, you can use the Remote EDM Indexer to create the
 Detecting content using Exact Data Matching (EDM) 484
Remote EDM indexing

cryptographic index directly on the data source host before moving the index to the Enforce
Server. If you are upgrading to the latest Symantec Data Loss Prevention version you may
want to use the Remote EDM Indexer to update your existing EDM indexes.
See “About the Remote EDM Indexer” on page 484.
See “About the SQL Preindexer” on page 484.
The Remote EDM Indexer is a standalone tool that lets you index the data source file directly
on the data source host.
See “System requirements for remote EDM indexing” on page 485.

About the Remote EDM Indexer

The Remote EDM Indexer utility converts a data source file to an EDM index. The utility is
similar to the local EDM Indexer used by the Enforce Server. However, the Remote EDM
Indexer is designed for use on a computer that is not part of the Symantec Data Loss Prevention
server configuration.
Using the Remote EDM Indexer to index a data source on a remote machine has the following
advantages over using the EDM Indexer on the Enforce Server:
■ It enables the owner of the data, rather than the Symantec Data Loss Prevention
administrator, to index the data.
■ It shifts the system load that is required for indexing onto another computer. The CPU and
RAM on the Enforce Server is reserved for other tasks.
See “About the SQL Preindexer” on page 484.
See “Workflow for remote EDM indexing” on page 485.

About the SQL Preindexer

You use the SQL Preindexer utility with the Remote EDM Indexer to run SQL queries against
Oracle databases and pipe the resulting data to the Remote EDM Indexer for indexing.
See “System requirements for remote EDM indexing” on page 485.
The SQL Preindexer utility is installed in the \SymantecDLP\Protect\bin directory during
installation of the Remote EDM Indexer. The SQL Preindexer utility generates an index directly
from an Oracle SQL database. The SQL Preindexer processes the database query and passes
it to the standard input of the Remote EDM Indexer utility.
To use the SQL Preindexer the data source must be relatively clean since the query result
data is piped directly to the Remote EDM Indexer.
See “About the Remote EDM Indexer” on page 484.
 Detecting content using Exact Data Matching (EDM) 485
Remote EDM indexing

System requirements for remote EDM indexing

The Remote EDM Indexer runs on the Windows and Linux operating system versions that are
supported for Symantec Data Loss Prevention servers. See the Symantec Data Loss Prevention
System Requirements and Compatibility Guide for more information about operating system
support.
The SQL Preindexer supports Oracle databases and requires a relatively clean data source.
See “About the SQL Preindexer” on page 484.
The RAM requirements for using the Remote EDM Indexer vary according to the size of the
data source being indexed and the number of multi-token columns in the data source.
See “Memory requirements for EDM” on page 475.

Workflow for remote EDM indexing

This section summarizes the steps to index a data file on a remote machine and then use the
index in Symantec Data Loss Prevention.
See “About the Exact Data Profile and index” on page 426.

Table 21-36 Steps to use the Remote EDM Indexer

Step Action Description

Step 1 Install the Remote EDM See “About installing and running the Remote EDM Indexer and SQL
Indexer on a computer that Preindexer utilities” on page 486.
is not part of the Symantec
Data Loss Prevention
system.

Step 2 Create an Exact Data Profile On the Enforce Server, generate an EDM Profile template using the *.edm
on the Enforce Server to use file name extension and specifying the exact number of columns to be indexed.
with the Remote EDM
See “Creating an EDM profile template for remote indexing” on page 487.
Indexer.

Step 3 Copy the Exact Data Profile Download the profile template from the Enforce Server and copy it to the
file to the computer where remote data source host computer.
the Remote EDM Indexer
See “Downloading and copying the EDM profile file to a remote system”
resides.
on page 490.
 Detecting content using Exact Data Matching (EDM) 486
Remote EDM indexing

Table 21-36 Steps to use the Remote EDM Indexer (continued)

Step Action Description

Step 4 Run the Remote EDM If you have a cleansed data source file, use the RemoteEDMIndexer with the
Indexer and create the index -data, -profile and -result options.
files.
If the data source is an Oracle database, use the SqlPreindexer and the
RemoteEDMIndexer to index the data source directly with the -alias (oracle
DB host), -username and -password credentials, and the -query string or
-query_path

See “Generating remote index files” on page 490.

Step 5 Copy the index files from the Copy the resulting *.pdx and *.rdx files from the remote machine to the
remote machine to the Enforce Server host at C:\SymantecDLP\Protect\index.
Enforce Server.
See “Copying and loading remote index files to the Enforce Server” on page 493.

Step 6 Load the index files into the Update the EDM profile by loading the externally generated index.
Enforce Server.
Submit the profile for indexing.

See “Copying and loading remote index files to the Enforce Server” on page 493.

Step 7 Troubleshoot any problems Verify that indexing is started and completes.
that occur during the
Check the system events for Code 2926 ("Created Exact Data Profile" and
indexing process.
"Data source saved").

The ExternalDataSource.<name>.rdx and *.pdx files are removed

from the index directory and replaced by the file DataSource.<profile
id>.<version>.rdxver.

See “Troubleshooting remote indexing errors” on page 498.

Step 8 Create policy with EDM You should see the column data for defining the EDM condition.
condition.
See “Configuring the Content Matches Exact Data policy condition” on page 448.

About installing and running the Remote EDM Indexer and SQL
Preindexer utilities
The Remote EDM Indexer is installed from the same installation program as the other Symantec
Data Loss Prevention components. The SQL Preindexer is installed automatically when you
install the Remote EDM Indexer. Both utilities are run from the command line and are stored
at /SymantecDLP/Protect/bin.
See “Generating remote index files” on page 490.
To install the Remote EDM Indexer, copy the ProtectInstaller.exe (Windows) or the
ProtectInstaller.sh (Linux) file to the remote computer where the data to be indexed
 Detecting content using Exact Data Matching (EDM) 487
Remote EDM indexing

resides. When running the installer, choose to install the "Indexer" only and no other
components. The Linux installer for the Remote EDM Indexer is a program that you run from
the command console.
See “Installing the Remote EDM Indexer (Windows)” on page 499.
See “Installing the Remote EDM Indexer (Linux)” on page 500.
Both the Remote EDM Indexer and the SQL Preindexer run from the command line. If you are
on a Linux system, change users to the “protect” user before running the SQL Preindexer.
(The installation program creates the “protect” user.)
See “Generating remote index files” on page 490.

Note: For two- and three-tier Data Loss Prevention installations, you should not install the
Remote EDM Indexer on the same system that hosts a detection server. Refer to the Symantec
Data Loss Prevention Installatio Guide for more information.

Creating an EDM profile template for remote indexing

The EDM Indexer uses an Exact Data Profile when it runs to ensure that the data is correctly
formatted. You must create the Exact Data Profile before you use the Remote EDM Indexer.
The profile is a template that describes the columns that are used to organize the data. The
profile does not need to contain any data. After creating the profile, copy it to the computer
that runs the Remote EDM Indexer.
See “About the Exact Data Profile and index” on page 426.
To create an EDM profile for remote indexing
1 From the Enforce Server administration console, navigate to the Manage > Data Profiles
> Exact Data screen.
2 Click Add Exact Data Profile.
3 In the Name field, enter a name for the profile.
 Detecting content using Exact Data Matching (EDM) 488
Remote EDM indexing

4 In the Data Source field, select Use This File Name, and enter the name of the index
file to create with the *.edm extension.
You must select this option since you are only creating the profile template at this point.
Later you will then index the profile with data source using the Remote EDM Indexer.
Enter the file name of the data source you plan to create for remote EDM indexing. Be
sure to name the data source file exactly the same as the name you enter here.
See “Uploading exact data source files to the Enforce Server” on page 436.
Once you have copied the generated remote index back to the Enforce Server, you use
the Load Externally Generated Index option to load the remote index into the profile
template
See “Copying and loading remote index files to the Enforce Server” on page 493.
5 In the Number of Columns text box, specify the number of columns in the data source
to be indexed.
For remote EDM indexing purposes you must specify the exact Number of Columns the
index is to have. Be sure to include the exact number of columns you specify here in the
data source file.
See “Uploading exact data source files to the Enforce Server” on page 436.
6 If the first row of the data source contains the column names, select the option Read first
row as column names.
7 In the Error Threshold text box, enter the maximum percentage of rows that can contain
errors.
If, during indexing of the data source, the number of rows with errors exceeds the
percentage that you specify here, the indexing operation fails.
8 In the Column Separator Char field, select the type of character that is used in your data
source to separate the columns of data.
9 In the File Encoding field, select the character encoding that is used in your data source.
If Latin characters are used, select the ISO-8859-1 option. For East Asian languages, use
either the UTF-8 or UTF-16 options.
10 Click Next to map the column headings from the data source to the profile.
 Detecting content using Exact Data Matching (EDM) 489
Remote EDM indexing

11 In the Field Mappings section, map the Data Source Field to the System Field for each
column by selecting the column name from the System Field drop-down list.
The Data Source Field lists the number of columns you specified at the previous screen.
The System Field contains a list of standard column headings. If any of the column
headings in your data source match the choices available in the System Field list, map
each accordingly. Be sure that you match the selection in the System Field column to its
corresponding numbered column in the Data Source Field.
For example, for a data source that you have specified in the profile as having three
columns, the mapping configuration may be:

Data Source Field System Field

Col 1 First Name

Col 2 Last Name

Col 3 Social Security Number

12 If a Data Source Field does not map to a heading value in the options available from the
System Field column, click the Advanced View link.
In the Advanced View the system displays a Custom Name column beside the System
Field column.
Enter the correct column name in the text box that corresponds to the appropriate column
in the data source.
Optionally, you can specify the data type for the Custom Name you entered by selecting
the data type from the Type drop-down list. These data types are system-defined. Click
the description link beside the Type name for details on each system-defined data type.
13 If you intend to use the Exact Data Profile to implement a policy template that contains
one or more EDM rules, you can validate your profile mappings for the template. To do
this, select the template from the Check mappings against policy template drop-down
list and click Check now. The system indicates any unmapped fields that the template
requires.
14 Do not select any Indexing option available at this screen, since you intend to index
remotely.
15 Click Finish to complete the profile creation process.
 Detecting content using Exact Data Matching (EDM) 490
Remote EDM indexing

Downloading and copying the EDM profile file to a remote system

Download and copy the EDM profile to the remote system
1 Configure an Exact Data Profile.
See “Creating an EDM profile template for remote indexing” on page 487.
2 Download the EDM profile by selecting the download profile link at the Manage > Data
Profiles > Exact Data screen.
The system prompts you to save the EDM profile as a file. The file extension is *.edm.
3 Save the file.
If the data source host computer where you intend to run the Remote EDM Indexer is
available on the same subnet as the Enforce Server you can browse to that computer
and select it as the destination. Otherwise, manually copy the profile to the remote system.
4 Use the profile to index the data source using the Remote EDM Indexer.
See “Generating remote index files” on page 490.

Generating remote index files

You use the command-line Remote EDM Indexer utility to generate an EDM index for importing
to the Enforce Server. You can use the Remote EDM Indexer to index data source file that
you have generated and cleansed. Or you can pipe the output from the SQL Preindexer to
the standard input of the Remote EDM Indexer. The SQL Preindexer requires an Oracle DB
data source and clean data.
When the indexing process completes, the Remote EDM Indexer generates several files in
the specified result directory. These files are named after the data file that was indexed, with
one file having the .pdx extension and another file with the .rdx extension. The system
generates 12 .rdx files named ExternalDataSource.<DataSourceName>.rdx.0 -
ExternalDataSource.<DataSourceName>.rdx.11.

Table 21-37 Options for generating remote EDM indexes

Use case Description Remarks

Remote EDM Indexer with data source Specify data source file, EDM profile, Use when you have a cleansed data
file. output directory. source file; use for upgrading to DLP
14.0.

See “Remote indexing examples using

data source file” on page 491.
 Detecting content using Exact Data Matching (EDM) 491
Remote EDM indexing

Table 21-37 Options for generating remote EDM indexes (continued)

Use case Description Remarks

Remote EDM Indexer with SQL Query DB and pipe output to stdin of Requires Oracle DB and clean data.
Preindexer Remote EDM Indexer.
See “Remote indexing examples using
SQL Preindexer” on page 492.

Remote indexing examples using data source file

To use the Remote EDM Indexer to index a flat data source file you have generated and
cleansed, you specify the local data source file name and path (-data), the local EDM profile
file name and path (-profile), and the output directory for the generated index files (-result).
The syntax for using the Remote EDM Indexer to generate an index from a cleansed data
source flat file is as follows:

RemoteEDMIndexer -data=<local data source filename and path>

-profile=<local *.edm profile file name and path>
-result=<local output directory for *.rdx and *pdx index files>

For example:

RemoteEDMIndexer -data=C:\EDMIndexDirectory\CustomerData.dat
-profile=C:\EDMIndexDirectory\RemoteEDMProfile.edm
-result=C:\EDMIndexDirectory\

This command generates an EDM index using the local data source flat file CustomerData.dat
and the local RemoteEDMProfile.edm file that you generated and copied from the Enforce
Server to the remote host, where \EDMIndexDirectory is the directory for placing the generated
index files.
When the generation of the indexes is successful, the utility displays the message "Successfully
created index" as the last line of output.
In addition, the following index files are created and placed in the -result directory:
■ ExternalDataSource.CustomerData.pdx

■ ExternalDataSource.CustomerData.rdx

Twelve files, named ExternalDataSource.<DataSourceName>.rdx.0 -

ExternalDataSource.<DataSourceName>.rdx.11 are always generated. Copy these files to
the Enforce Server and update the EDM profile using the remote index.
See “Remote EDM Indexer command options” on page 496.
 Detecting content using Exact Data Matching (EDM) 492
Remote EDM indexing

Remote indexing examples using SQL Preindexer

If your data source is an Oracle DB and has clean data you can index the data source directly
using the SQL Preindexer with the Remote EDM Indexer.
The syntax is as follows:

SqlPreindexer -alias=<oracle connect string: //host:port/SID>

-username=<DB user> -password=<DB password> -query=<sql to run> |
RemoteEDMIndexer -profile=<*.edm profile file name and path>
-result=<output directory for index files>

For example:

SqlPreindexer -alias=@//myhost:1521/orcl -username=scott -password=tiger

-query="SELECT name, salary FROM employee" |
RemoteEDMIndexer -profile=C:\ExportEDMProfile.edm -result=C:\EDMIndexDirectory\

With this command the SQL Preindexer utility connects to the Oracle database and runs the
SQL query to retrieve name and salary data from the employee table. The SQL Preindexer
returns the result of the query to stdout (the command console). The SQL query must be in
quotes. The Remote EDM Indexer command runs the utility and reads the query result from
the stdin console. The Remote EDM Indexer indexes the data using the ExportEDMProfile.edm
profile as specified by the profile file name and local file path.
When the generation of the indexes is successful, the utility displays the message "Successfully
created index" as the last line of output.
In addition, the utility places the following generated index files in the EDMIndexDirectory
-result directory:
■ ExternalDataSource.CustomerData.pdx
■ ExternalDataSource.CustomerData.rdx
Here is another example using SQL Preindexer and Remote EDM Indexer commands:

SqlPreindexer -alias=@//localhost:1521/CUST -username=cust_user -password=cust_pword

-query="SELECT account_id, amount_owed, available_credit FROM customer_account" -verbose |
RemoteEDMIndexer -profile=C:\EDMIndexDirectory\CustomerData.edm
-result=C:\EDMIndexDirectory\ -verbose

Here the SQL Preindexer command queries the CUST.customer_account table in the database
for the account_id, amount_owed, and avialble_credit records. The result is piped to the
Remote EDM Indexer which generates the index files based on the CustomerData.edm profile.
The -verbose option is used for troubleshooting.
 Detecting content using Exact Data Matching (EDM) 493
Remote EDM indexing

As an alternative to the -query SQL string you can use the -query_path option and specify
the file path and name for the SQL query (*.sql). If you do not specify a query or query path
the entire DB is queried.

SqlPreindexer -alias=@//localhost:1521/cust -username=cust_user -password=cust_pwrd

-query_path=C:\EDMIndexDirectory\QueryCust.sql -verbose |
RemoteEDMIndexer -profile=C:\EDMIndexDirectory\CustomerData.edm
-result=C:\EDMIndexDirectory\ -verbose

See “SQL Preindexer command options” on page 494.

Copying and loading remote index files to the Enforce Server

The following files are created in the -result directory when you remotely index a data source:
■ ExternalDataSource.<DataSourceName>.pdx

■ ExternalDataSource.<DataSourceName>.rdx.0 -
ExternalDataSource.<DataSourceName>.rdx.11

After you create the index files on a remote machine, the files must be copied to the Enforce
Server, loaded into the previously created remote EDM profile, and indexed.
See “Creating an EDM profile template for remote indexing” on page 487.
To copy and load the files on the Enforce Server
1 Go to the directory where the index files were generated. (This directory is the one specified
in the -result option.)
2 Copy all of the index files with .pdx and .rdx extensions to the index directory on the
Enforce Server. This directory is located at \SymantecDLP\Protect\Index (Windows) or
/var/SyantecDLP/index (Linux).

3 From the Enforce Server administration console, navigate to the Manage > Policies >
Exact Data screen.
This screen lists all the Exact Data Profiles in the system.
4 Click the name of the Exact Data Profile you used with the Remote EDM Indexer.
5 To load the new index files, go to the Data Source section of the Exact Data Profile and
select Load Externally Generated Index.
 Detecting content using Exact Data Matching (EDM) 494
Remote EDM indexing

6 In the Indexing section, select Submit Indexing Job on Save.

As an alternative to indexing immediately on save, consider scheduling a job on the remote
machine to run the Remote EDM Indexer on a regular basis. The job should also copy
the generated files to the index directory on the Enforce Server. You can then schedule
loading the updated index files on the Enforce Server from the profile by selecting Load
Externally Generated Index and Submit Indexing Job on Schedule and configuring
an indexing schedule.
See “Use scheduled indexing to automate profile updates” on page 508.
7 Click Save.

SQL Preindexer command options

On install the SQL Preindexer utility is available at \SymantecDLP\Protect\bin (Windows)
and /SymantecDLP/Protect/bin (Linux).
The SQL Preindexer provides a command-line interface. The syntax for running the utility is
as follows:

SqlPreindexer -alias=<@//oracle_host:port/SID> -username=<DB_user> [options]

Note the following about the arguments:

■ The SQL Preindexer requires the -alias and -username arguments.
■ If you omit the -password option, the user is prompted to enter it.
■ If you use the -query option, the SQL query string must be in quotes.
■ If you omit the -query option, the utility indexes the entire database.
■ To query using wildcards, use the -qeury_path option. The SQL Preindexer does not
support the use of wildcards from the command line using the -query option. For example:
"select * from CUST_DATA" does not work with -query; you must query each individual
column field: "select cust_ID, cust_Name, cust_SSN from CUST_DATE." The query "select
* from CUST_DATA" works using the -qeury_path command.
See “Remote indexing examples using SQL Preindexer” on page 492.
Table 21-38 lists the command options for the SQL Preindexer.
 Detecting content using Exact Data Matching (EDM) 495
Remote EDM indexing

Table 21-38 SQL Preindexer command options

Option Summary Description

-alias Oracle DB connect string Specifies the database alias that is used to connect to the
database in the following format:
Required
@//oracle_DB_host:port/SID

For example:

-alias=@//myhost:1521/ORCL

-alias=@//localhost:1521/CUST

-driver Oracle JDBC driver class Specifies the JDBC driver class, for example:
oracle.jdbc.driver.OracleDriver.

-encoding Character encoding Specifies the character encoding of the data to index. The
(iso-8859-1) default is iso-8859-1.

Data with non-English characters should use UTF-8 or UTF-16.

-password Oracle DB password Specifies the password to the database.

If this option is not specified, the password is read from stdin.

-query SQL query This option specifies the SQL query to perform. The statement
must be enclosed in quotes.

If you omit the -query option the utility indexes the entire
database.

-query_path SQL script Specifies the file name and local path that contains a SQL
query to run. Must be full path.

This option can be used as an alternative to the -query option

when the query is a long SQL statement.

-separator Output column separator Specifies whether the output column separator is a comma,
(tab) pipe, or tab. The default separator is a tab.

To specify a comma separator or pipe separator, enclose the

separator character in quotation marks: "," or "|".

-subprotocol Oracle thin driver Specifies the JDBC connect string subprotocol (for example,
oracle:thin).

-username Oracle DB user Specifies the name of the database user.

Required

-verbose Print verbose output for Displays a statistical summation of the operation when it is
debugging. complete.

See “Troubleshooting preindexing errors” on page 497.

 Detecting content using Exact Data Matching (EDM) 496
Remote EDM indexing

Remote EDM Indexer command options

On install, the Remote EDM Indexer utility is available at \SymantecDLP\Protect\bin
(Windows) and /SymantecDLP/Protect/bin (Linux).
If you are on Linux, change users to the “protect” user before running the Remote EDM Indexer.
(The installation program creates the “protect” user.)
The Remote EDM Indexer provides a command line interface. The syntax for running the utility
is as follows:

RemoteEDMIndexer -profile=<file *.edm> -result=<out_dir> [options]

Note the following about the syntax:

■ The Remote EDM Indexer requires the -profile and -result arguments.
■ If you use a flat data source file as input, you must specify the file name and local path
using the -data option.
■ The -data option is omitted when you use the SQL Preindexer to pipe the data to the
Remote EDM Indexer.
See “Remote indexing examples using data source file” on page 491.
Table 21-39 describes the command options for the Remote EDM Indexer.

Table 21-39 Remote EDM Indexer command options

Option Summary Description

-data Data source to be indexed Specifies the data source to be indexed. If this option is not
(stdin) specified, the utility reads data from stdin.

Required if you use a flat file Required if using data source file and not the SQL Preindexer.

-encoding Character encoding of data Specifies the character encoding of the data to index. The
to be indexed (ISO-8859-1) default is ISO-8859-1.

Use UTF-8 or UTF-16 if the data contains non-English

characters.

-ignore_date Ignore expiration date of the Overrides the expiration date of the Exact Data Profile if the
EDM profile profile has expired. (By default, an Exact Data Profile expires
after 30 days.)

-profile File containing the EDM Specifies the Exact Data Profile to be used. This profile is the
profile one that is selected by clicking the “download link” on the
Exact Data screen in the Enforce Server management console
Required
 Detecting content using Exact Data Matching (EDM) 497
Remote EDM indexing

Table 21-39 Remote EDM Indexer command options (continued)

Option Summary Description

-result Directory to place the Specifies the directory where the index files are generated.
resulting indexes

Required

-verbose Display verbose output Displays a statistical summation of the indexing operation
when the index is complete.

See “Troubleshooting preindexing errors” on page 497.

Troubleshooting preindexing errors

If you receive an error that the SQL Preindexer was unable to perform query or failed to prepare
for indexing, verify that the -query string is in quotes. You can test your -query string by running
only the SQL Preindexer command. If the command is correct the data queried from the
database is displayed to the console as stdout.
You may encounter errors when you index large amounts of data. Often the set of data contains
a data record that is incomplete, inconsistent, or inaccurate. Data rows that contain more
columns than expected or incorrect column data types often cannot be properly indexed and
are unrecognized.
The SQL Preindexer can be configured to provide a summary of information about the indexing
operation when it completes. To do so, specify the verbose option when running the SQL
Preindexer.
To see the rows of data that the Remote EDM Indexer did not index, adjust the configuration
in the Indexer.properties file using the following procedure.
To record those data rows that were not indexed
1 Locate the Indexer.properties file at
\SymantecDLP\Protect\config\Indexer.properties (Windows) or
/SymantecDLP/Protect/config/Indexer.properties (Linux).

2 Open the file in a text editor.

3 Locate the create_error_file property and change the “false” setting to “true.”
4 Save and close the Indexer.properties file.
The Remote EDM Indexer logs errors in a file with the same name as the data file being
indexed and the .err suffix.
The rows of data that are listed in the error file are not encrypted. Safeguard the error file
to minimize any security risk from data exposure.
 Detecting content using Exact Data Matching (EDM) 498
Remote EDM indexing

See “About the SQL Preindexer” on page 484.

Troubleshooting remote indexing errors

The Remote EDM Indexer displays a message that indicates whether the indexing operation
was successful or not. If the Remote EDM Indexer successfully creates the index, the console
displays the message "Successfully created index" as the last line of output. In addition, *.pdx
and *.rdx files are created in the -result directory.
The result depends on the error threshold that you specify in the EDM profile. Any error
percentage under the threshold completes successfully. Detailed information about the indexing
operation is available with the -verbose option.
See “Remote EDM Indexer command options” on page 496.
If the index generation is not successful, try these troubleshooting tips:

Table 21-40 Remote Indexer troubleshooting tips

Error Symptom Description

Index files not Use the -verbose option in the Specifying the verbose option when running the Remote EDM
generated command to reveal error Indexer provides a statistical summary of information about the
message. indexing operation after it completes. This information includes
the number of errors and where the errors occurred.

"Failed to create Verify file and path names. Verify that you included the full path and proper file name for
index" the -data file and the -profile file (*.edm). The paths must be
local to the host.
"Cannot compute
index"

"Unable to generate
index"

"Destination is not a Directory path not correct. Verify that you properly entered the full path to the destination
directory" directory for the required -result argument.

*.idx file instead Did not use -data argument The -data option is required if you are using a data source file
of *.rdx file and not the SQL Preindexer. In other words, the only time you
don't use the -data argument is when you are using the SQL
Preindexer.

If you run the Remote EDM Indexer without the -data option
and no SQL Preindexer query, you get an *.idx and *.rdx
file that cannot be used as for the EDM index. Rerun the index
using the -data option or a SQL Preindexer -query or
-query-path.
 Detecting content using Exact Data Matching (EDM) 499
Remote EDM indexing

In addition, you may encounter errors when you index large amounts of data. Often the set of
data contains a data record that is incomplete, inconsistent, or incorrectly formatted. Data rows
that contain more columns than expected or incorrect data types often cannot be properly
indexed and are unrecognized during indexing. The rows of data with errors cannot be indexed
until those errors are corrected and the Remote EDM Indexer rerun. Symantec provides a
couple of ways to get information about any errors and the ultimate success of the indexing
operation.
To see the actual rows of data that the Remote EDM Indexer failed to index, modify the
Indexer.properties file.

To modify the Indexer.properties file and view remote indexing errors

1 Locate the Indexer.properties file at
\SymantecDLP\Protect\config\Indexer.properties (Windows) or
/opt/SymantecDLP/Protect/config/Indexer.properties (Linux).

2 To edit the file, open it in a text editor.

3 Locate the create_error_file property parameter and change the “false” value to “true.”
4 Save and close the Indexer.properties file.
The Remote EDM Indexer logs errors in a file with the same name as the indexed data
file and with an .err extension. This error file is created in the logs directory.
The rows of data that are listed in the error file are not encrypted. Encrypt the error file to
minimize any security risk from data exposure.

Installing the Remote EDM Indexer (Windows)

The Remote EDM Indexer (Windows) is installed from the same installation program as the
other Symantec Data Loss Prevention components.
See “About the Remote EDM Indexer” on page 484.
See “Installing the Remote EDM Indexer (Linux)” on page 500.
To install the Remote EDM Indexer on Windows
1 Copy the ProtectInstaller_14.0.exe file to the remote machine where the data to be
indexed resides.
2 Go to the directory where you copied the ProtectInstaller_14.0.exe installer.
You may need to change the file permissions to access the file.
3 Run the installation program by double-clicking the file ProtectInstaller_14.0.exe.
The installer files unpack and the Welcome screen displays.
4 Click Next and then accept the Symantec Software License Agreement to continue.
 Detecting content using Exact Data Matching (EDM) 500
Remote EDM indexing

5 Select Indexer from the list of components that appears and click Next.
6 On the Select Destination Directory screen, click Next to accept the default installation
location (recommended).
Alternately, click Browse to navigate to a different installation location, then click Next.
7 Choose a Start Menu folder and then click Next.
The Installing screen appears and displays an installation progress bar.
8 Click Finish to complete the installation.
The files to uninstall the Remote EDM Indexer are located in the root level of the Symantec
Data Loss Prevention installation directory. Follow this procedure to uninstall the utility on
Windows.
To uninstall Remote EDM Indexer from a Windows system
1 On the computer where the Remote EDM Indexer is installed, locate and run (double-click)
the \SymantecDLP\uninstall.exe program.
The uninstallation program begins and the Uninstall screen is displayed.
2 Click Next. When the uninstallation process is complete, the Uninstall Complete screen
is displayed.
3 Click Finish to close the program.

Installing the Remote EDM Indexer (Linux)

The Linux version of the Remote EDM Indexer provides a text-based command console option
to install the product. The following procedure describes how to install the Remote EDM Indexer
for Linux from the command line.
See “About the Remote EDM Indexer” on page 484.
See “Installing the Remote EDM Indexer (Windows)” on page 499.
To install the Remote EDM Indexer on Linux
1 Log on to the Linux system as the root user.
2 Copy the ProtectInstaller_14.0.sh file to the /tmp directory on the computer.
3 Using a terminal session, change the directory to /tmp by typing:

cd /tmp

4 You may need to change permissions on the file before you can run the file. If so, type:

chmod 775 ProtectInstaller_14.0.sh

 Detecting content using Exact Data Matching (EDM) 501
Best practices for using EDM

5 Once the file permissions have been changed you can run the ProtectInstaller_14.0.sh
file, by typing:

./ProtectInstaller_14.0.sh -i console

Once the console mode installation launches, the Introduction step is displayed. For most
circumstances, it is recommended to use the defaults during installation whenever possible.
Press Enter to proceed to the next step.
6 At the Choose Install Set step, specify the component to install. To install the Remote
EDM Indexer, type the number beside the option and press Enter.
7 At the Install Folder step, type the absolute path to the directory where you want to install
the files. The default location can be selected by pressing Enter.
8 At the Pre-Installation Summary step, review the installation configuration that you have
selected. If you are satisfied with the selections, press Enter to begin the installation. Or,
type back and press Enter until you reach the step you want to change.
9 When the installation completes, press Enter to close the installer.
The files to uninstall the Remote EDM Indexer are located in the root level of the Symantec
Data Loss Prevention installation directory. Follow this procedure to uninstall the utility on
Linux.
To remove a Remote EDM Indexer from the command line
1 Log on as root and change to the Uninstall directory by typing:

cd /opt/SymantecDLP/Uninstall

2 Run the Uninstall program by typing:

./Uninstall -i console

3 Follow any on-screen instructions.

Best practices for using EDM

EDM is the most accurate form of detection. It is also the most complex to set up and maintain.
To ensure that your EDM policies are as accurate as possible, consider the recommendations
in this section when you are implementing your EDM profiles and policies.
The following table provides a summary of the EDM policy considerations discussed in this
chapter, with links to individual topics for more details.
 Detecting content using Exact Data Matching (EDM) 502
Best practices for using EDM

Table 21-41 Summary of EDM best practices

Best practice Description

Ensure that the data source file contains at least one See “Ensure data source has at least one column of unique
column of unique data. data” on page 503.

Eliminate duplicate rows and blank columns before See “Cleanse the data source file of blank columns and
indexing. duplicate rows” on page 504.

To reduce false positives, avoid single characters, quotes, See “Remove ambiguous character types from the data
abbreviations, numeric fields with less than 5 digits, and source file” on page 504.
dates.

Understand multi-token indexing and clean up as See “Understand how multi-token cell matching functions”
necessary. on page 505.

Use the pipe (|) character to delimit columns in your data See “Do not use the comma delimiter if the data source
source. has number fields” on page 505.

Review an example cleansed data source file. See “Ensure that the data source is clean for indexing”
on page 506.

Map data source column to system fields to leverage See “Map data source column to system fields to leverage
validation during indexing. validation” on page 506.

Leverage EDM policy templates whenever possible. See “Leverage EDM policy templates when possible”
on page 507.

Include the column headers as the first row of the data See “Include column headers as the first row of the data
source file. source file” on page 507.

Check the system alerts to tune Exact Data Profiles. See “Check the system alerts to tune profile accuracy”
on page 507.

Use stopwords to exclude common words from matching. See “Use stopwords to exclude common words from
detection” on page 507.

Automate profile updates with scheduled indexing. See “Use scheduled indexing to automate profile updates”
on page 508.

Match on two or three columns in an EDM rule. See “Match on 3 columns in an EDM condition to increase
detection accuracy” on page 509.

Leverage exception tuples to avoid false positives. See “Leverage exception tuples to avoid false positives”
on page 510.

Use a where clause to detect records that meet a specific See “Use a WHERE clause to detect records that meet
criteria. specific criteria” on page 510.
 Detecting content using Exact Data Matching (EDM) 503
Best practices for using EDM

Table 21-41 Summary of EDM best practices (continued)

Best practice Description

Use the minimum matches field to fine tune EDM rules. See “Use the minimum matches field to fine tune EDM
rules” on page 510.

Consider using Data Identifiers in combination with EDM See “Combine Data Identifiers with EDM rules to limit the
rules. impact of two-tier detection” on page 510.

Include an email address field in the Exact Data Profile for See “Include an email address field in the Exact Data
profiled DGM. Profile for profiled DGM” on page 511.

Use profiled DGM for Network Prevent for Web identity See “Use profiled DGM for Network Prevent for Web
detection identity detection” on page 511.

Ensure data source has at least one column of unique data

EDM is designed to detect combinations of data fields that are globally unique. At a minimum,
your EDM index must include at least one column of data that contains a unique value for each
record in the row. Column data such as account number, social security number, and credit
card number are inherently unique, whereas state or zip code are not unique, nor are names.
If you do not include at least one column of unique data in your index, your EDM profile will
not accurately detect the data you want to protect
Table 21-42 describes the various types of unique data to include in your EDM indexes, as
well as fields that are not unique. You can include the non-unique fields in your EDM indexes
as long as you have at least one column field that is unique.

Table 21-42 Examples of unique data for EDM policies

Unique data for EDM Non-unique data

The following data fields are usually unique: The following data fields are not unique:

■ Account number ■ First name

■ Bank Card number ■ Last name
■ Phone number ■ City
■ Email address ■ State
■ Social security number ■ Zip code
■ Tax ID number ■ Password
■ Drivers license number ■ PIN number
■ Employee number
■ Insurance number
 Detecting content using Exact Data Matching (EDM) 504
Best practices for using EDM

Cleanse the data source file of blank columns and duplicate rows
The data source file should be as clean as possible before you create the EDM index, otherwise
the resulting profile may create false positives.
When you create the data source file, avoid including empty cells or blank columns. Blank
columns or fields count as “errors” when you generate the EDM profile. A data source error is
either an empty cell or a cell with the wrong type of data (a name appearing in a phone number
column). If the errors exceed the error threshold percentage for the profile (by default, 5%),
the system stops indexing and displays an indexing error message.
The best practice is to remove blank columns and empty cells from the data source file, rather
than increasing the error threshold. Keep in mind that if you have many empty cells, it may
require a 100% error threshold for the system to create the profile. If you specify 100% as the
error threshold, the system indexes the data source without checking for errors.
In addition, do not fill empty cells or blank fields with bogus data so that the error threshold is
met. Adding fictitious or "null" data to the data source file will reduce the accuracy of the EDM
profile and is strongly discouraged. Content you want to monitor should be legitimate and not
null.
See “About cleansing the exact data source file” on page 427.
See “Preparing the exact data source file for indexing” on page 435.
See “Ensure that the data source is clean for indexing” on page 506.

Remove ambiguous character types from the data source file

You cannot have extraneous spaces, punctuation, and inconsistently populated fields in the
data source file. You can use tools such as Stream Editor (sed) and AWK to remove these
items from you data source file or files before indexing them.

Table 21-43 Characters to avoid in the data source file

Characters to avoid Explanation

Single characters Single character fields should be eliminated from the data source file. These are
more likely to cause false positives, since a single character is going to appear
frequently in normal communications.

Abbreviations Abbreviated fields should be eliminated from the data source file for the same reason
as single characters.

Quotes Text fields should not be enclosed in quotes.

Small numbers Indexing numeric fields that contain less than 5 digits is not recommended because
it will likely yield many false positives.
 Detecting content using Exact Data Matching (EDM) 505
Best practices for using EDM

Table 21-43 Characters to avoid in the data source file (continued)

Characters to avoid Explanation

Dates Date fields are also not recommended. Dates are treated like a string, so if you are
indexing a date, such as 12/6/2007, the string will have to match exactly. The indexer
will only match 12/6/2007, and not any other date formats, such as Dec 6, 2007,
12-6-2007, or 6 Dec 2007. It must be an exact match.

Understand how multi-token cell matching functions

An EDM rule performs a full-text search against the message, checking each word (except
those that are excluded by way of the columns you choose to match in the policy) for potential
matches. The matching algorithm compares each individual word in the message with the
contents of each token in the data profile.
If a cell in the data profile contains multiple words separated by spaces, punctuation, or
alternative Latin and Chinese, Japanese, and Korean (CJK) language characters, the cell is
a multi-token cell. The sub-token parts of a multi-token cell obey the same rules as single-token
cells: they are normalized according to their pattern where normalization can apply.
If a cell contains a multi-token, the multi-token must match exactly. For example, a column
field with the value “Joe Brown” is a multi-token cell (assuming multi-token matching is enabled).
At run-time the processor looks to match the exact string "Joe Brown,” including the space
(multiple spaces are normalized to one). The system does not match on "Joe" and "Brown" if
they are detected as single tokens.
In addition, multi-token cells are more computationally expensive than single-token cells. If
the index includes multi-token cells, you must verify that you have enough memory to index,
load, and process the EDM profile.
If multi-token matching is enabled, any punctuation that is next to a space is ignored. Therefore,
punctuation before and after a space is ignored.
Lastly, do not change the WIP setting from "true" to "false" unless you are sure that is the
result you want to achieve. You should only set WIP = false when you need to loosen the
matching criteria, such as account numbers where formatting may change across messages.
Make sure you test detection results to ensure you are getting the matches you expect.
See “Memory requirements for EDM” on page 475.

Do not use the comma delimiter if the data source has number fields
Of the three types of column delimiters that you can choose from for separating the fields in
the data source file (pipe, tab, or comma), the pipe or tab (default) is recommended. The
comma delimiter is ambiguous and should not be used, especially if one or more fields in your
 Detecting content using Exact Data Matching (EDM) 506
Best practices for using EDM

data source contain numbers. If you use a comma-delimited data source file, make sure there
are no commas in the data set other than those used as column delimiters.

Note: Although the system also treats the pound sign, equals sign, plus sign, semicolon, and
colon characters as separators, you should not use these because like the comma their
meaning is ambiguous.

Map data source column to system fields to leverage validation

When you create the Exact Data Profile, you can validate how well the fields in your data
source match against system-defined patterns for that field. For example, if you map a field
to the credit card system pattern, the system will validate that the data matches the credit card
system pattern. If it does not, the system will create an error for every record that contains an
invalid credit card number. Mapping data source fields in your index to system-defined field
patterns helps you ensure that the fields in your index meet the data type criteria.
If there is no corresponding system field to map to a data source column, consider creating a
custom field to map data source column data. You can use the description field to annotate
both system and custom fields.
See “Mapping Exact Data Profile fields” on page 442.
See “Creating and modifying Exact Data Profiles” on page 438.

Ensure that the data source is clean for indexing

The following list summarizes a cleansed data source that is ready for indexing:
■ It contains at least one unique column field.
■ It is not a single-column data source; it has two or more columns.
■ Empty cells and rows and blank columns are removed.
■ Incomplete and duplicate records are removed.
■ The number of faulty cells is below the default error rate (5%) for indexing.
■ Bogus data is not used to fill in blank cells or rows.
■ Improper and ambiguous characters are removed.
■ Multi-tokens comply with space and memory requirements.
■ Column fields are validated against the system-defined patterns that are available.
■ Mappings are validate against policy templates where applicable.
See “Ensure data source has at least one column of unique data” on page 503.
See “Cleanse the data source file of blank columns and duplicate rows” on page 504.
 Detecting content using Exact Data Matching (EDM) 507
Best practices for using EDM

See “Remove ambiguous character types from the data source file” on page 504.
See “Understand how multi-token cell matching functions” on page 505.
See “Map data source column to system fields to leverage validation” on page 506.

Leverage EDM policy templates when possible

Symantec Data Loss Prevention provides several policy templates that implement EDM rules.
The general recommendation is to use policy templates whenever possible when implementing
EDM. If you do use a policy template for EDM, you should validate the index against the
template when you configure the Exact Data Profile.
See “EDM policy templates” on page 425.
See “Creating and modifying Exact Data Profiles” on page 438.

Include column headers as the first row of the data source file
When you extract the source data to the data source file, you should include the column
headers as the first row in the data source file. Including the column headers will make it easier
for you to identify the data you want to use in your policies.
The column names reflect the column mappings that were created when the exact data profile
was added. If there is an unmapped column, it is called Col X, where X is the column number
(starting with 1) in the original data profile.
If the Exact Data Profile is to be used for DGM, the file must have a column with a heading of
email, or the DGM will not appear in the Directory EDM drop-down list (at the remediation
page).

Check the system alerts to tune profile accuracy

You should always review the system alerts after creating the Exact Data Profile. The system
alerts provide very specific information about problems encountered when creating the profile,
such as a SSN in an address field, which will affect accuracy.

Use stopwords to exclude common words from detection

During detection the EDM process ignores words found in the stopwords file. Stopwords are
common words that are excluding from matching. For example, the stopwords file contains
common words such as articles, prepositions, and so forth. You can adjust the stopwords file
by adding to or removing words from the file. It is recommended that you back up the original
before changing it.
Stopword files are located at the following directory where the detection server running the
index is installed: \SymantecDLP\Protect\config\stopwords. By default the system uses
 Detecting content using Exact Data Matching (EDM) 508
Best practices for using EDM

the stopwords_en.txt file, which is the English language version. Other language stopword
files are also located in this same directory. You can change the default stopword language
file by updating the Lexer.StopwordLanguages property in the Advanced Server Settings
screen of the Enforce Server.
See “Configuring Advanced Server Settings for EDM policies” on page 454.

Use scheduled indexing to automate profile updates

When you configure an Exact Data Profile, you can set a schedule for indexing the data
source file. Index scheduling lets you decide when you want to index the data source file. For
example, instead of indexing the data source at the same time that you define the profile, you
can schedule it for a later date. Alternatively, if you need to reindex the data source on a regular
basis, you can schedule indexing to occur on a regular basis.
Before you set up an index schedule, consider the following:
■ If you update your data sources occasionally (for example, less than once a month),
generally there is no need to create a schedule. Index the data each time you update the
data source.
■ Schedule indexing for times of minimal system use. Indexing affects performance throughout
the Symantec Data Loss Prevention system, and large data sources can take time to index.
■ Index a data source as soon as you add or modify the corresponding exact data profile,
and re-index the data source whenever you update it. For example, consider a scenario
whereby every Wednesday at 2:00 P.M. you generate an updated data source file. In this
case you could schedule indexing every Wednesday at 3:00 P.M., giving you enough time
to cleanse the data source file and copy it to the Enforce Server.
■ Do not index data sources daily as this can degrade performance.
■ Monitor results and modify your indexing schedule accordingly. If performance is good and
you want more timely updates, for example, schedule more frequent data updates and
indexing.
Consider using scheduled indexing with remote EDM indexing to keep an EDM profile up to
date. For example, you can schedule a cron job on the remote machine to run the Remote
EDM Indexer on a regular basis. The job can also copy the generated index files to the index
directory on the Enforce Server. You can then configure the Enforce Server to load the externally
generated index and submit it for indexing on a scheduled basis.
See “About index scheduling” on page 429.
See “Scheduling Exact Data Profile indexing” on page 445.
See “Copying and loading remote index files to the Enforce Server” on page 493.
 Detecting content using Exact Data Matching (EDM) 509
Best practices for using EDM

Match on 3 columns in an EDM condition to increase detection

accuracy
In a structured data format such as a database, each row represents one record, with each
record containing related values for each column data field. Thus, for an EDM policy rule
condition to match, all the data must come from the same row or record of data. When you
define an EDM rule, you must select the fields that must be present to be a match. Although
there is no limit to the number of columns you can select to match in a row (up to the total
number of columns in the index, which is a maximum of 32), it is recommended that you match
on at least 2 or 3 columns, one of which must be unique. Generally matching on 3 fields is
preferred, but if one of the columns contains a unique value such as SSN or Credit Card
number, 2 columns may be used
Consider the following example. You want to create an EDM policy condition based on an
Exact Data Profile that contains the following 5 columns of indexed data:
■ First Name
■ Last Name
■ Social security number (SSN)
■ Phone Number
■ Email Address
If you select all 5 columns to be included in the policy, consider the possible results based on
the number of fields you require for each match.
If you choose "1 of the selected fields" to match, the policy will undoubtedly generate a large
number of false positives because the record will not be unique enough. (Even if the condition
only matches the SSN field, there may still be false positives because there are other types
of nine-digit numbers that may trigger a match.).
If you choose "2 of the selected fields" to match, the policy will still produce false positives
because there are potential worthless combinations of data: First Name + Last Name, Phone
Number + Email Address, or First Name + Phone Number.
If you choose to match on 4 or all 5 of the column fields, you will not be able to exclude certain
data field combinations because that option is only available for matches on 2 or 3 fields.
See “Leverage exception tuples to avoid false positives” on page 510.
In this example, to ensure that you generate the most accurate match, the recommendation
is that you choose "3 of the selected fields to match." In this way you can reduce the number
of false positives while using one or more exceptions to exclude the combinations that do not
present a concern, such as First Name + Last Name + Phone Number
Whatever number of fields you choose to match, ensure that you are including the column
with the most unique data, and that you are matching at least 2-column fields.
 Detecting content using Exact Data Matching (EDM) 510
Best practices for using EDM

Leverage exception tuples to avoid false positives

The EDM policy condition lets you define exception tuples to exclude combinations on data.
You must select 2 or 3 columns to match to leverage exception tuples.
EDM allows detection based on any combination of columns in a given row of data (that is, N
of M fields from a given record). It can trigger on "tuples," or specified sets of data types. For
example, a combination of the first name and SSN fields could be acceptable, but a combination
of the last name and SSN fields would not. EDM also allows more complex rules such as
looking for N of M fields, but excluding specified tuples. For example, this type of rule definition
is required to identify incidents in violation of state data privacy laws, such as California SB
1386, which requires a first name and last name in combination with any of the following: SSN,
bank account number, credit card number, or driver's license number.
While exception tuples can help you reduce false positives, if you are using several exception
tuples, it may be a sign your index is flawed. In this case, consider redoing your index so you
do not have to use so many excluded combinations to achieve the desired matches.

Use a WHERE clause to detect records that meet specific criteria

Another configuration parameter of the EDM policy condition is the "Where" clause option.
This option matches on the exact value you specify for the field you select. You can enter
multiple values by separating each with commas. Using a WHERE clause to detect records
that meet specific criteria helps you improve the accuracy of your EDM policies.
For example, if you wanted to match only on an Exact Data Profile for "Employees" with a
"State" field containing certain states, you could configure the match where "State" equals
"CA,NV". This rule then causes the detection engine to match a message that contains either
CA or NV as content.

Use the minimum matches field to fine tune EDM rules

The minimum matches field is useful for fine-tuning the sensitivity of an EDM rule. For example,
one employee's first and last name in an outgoing email may be acceptable. However, 100
employees' first and last names is a serious breach. Another example might be a last name
and social security number policy. The policy might allow an employee to send information to
a doctor, but the sending of two last names and social security numbers is suspicious.

Combine Data Identifiers with EDM rules to limit the impact of two-tier
detection
When implementing EDM policies, it is recommended that you combine Data Identifiers (DIs)
rules with the EDM condition to form compound policies. As reference, note that all
system-provided policy templates that implement EDM rules also implement Data Identifier
rules in the same policy.
 Detecting content using Exact Data Matching (EDM) 511
Best practices for using EDM

Data Identifiers and EDM are both designed to protect personally identifiable information (PII).
Including Data Identifiers with your EDM rules make your policies more robust and reusable
across detection servers because unlike EDM rules Data Identifiers are executed on the
endpoint and do not require two-tier detection. Thus, if an endpoint is off the network, the Data
Identifier rules can protect PII such as SSNs.
Data Identifier rules are also useful to use in your EDM policies while you are gathering and
preparing your confidential data for EDM indexing. For example, a policy might contain the
US SSN Data Identifier and an EDM rule for as yet unindexed or unknown SSNs.

Include an email address field in the Exact Data Profile for profiled
DGM
You must include the appropriate fields in the Exact Data Profile to implement profiled DGM.
See “Creating the exact data source file for profiled DGM” on page 434.
If you include the email address field in the Exact Data Profile for profiled DGM and map it to
the email data validator, email address will appear in the Directory EDM drop-down list (at
the remediation page).

Use profiled DGM for Network Prevent for Web identity detection
If you want to implement DGM for Network Prevent for Web, use one of the profiled DGM
conditions to implement identity matching. For example, you may want to use identity matching
to block all web traffic for a specific users. For Network Prevent for Web, you cannot use
synchronized DGM conditions for this use case.
See “Creating the exact data source file for profiled DGM” on page 434.
See “Configuring the Sender/User based on a Profiled Directory condition” on page 756.
 Chapter 22
Detecting content using
Indexed Document
Matching (IDM)
This chapter includes the following topics:

■ Introducing Indexed Document Matching (IDM)

■ Configuring IDM profiles and policy conditions

■ Best practices for using IDM

■ Remote IDM indexing

Introducing Indexed Document Matching (IDM)

You use Indexed Document Matching (IDM) to protect confidential information that is stored
as unstructured data in documents and files. For example, you can use IDM to detect financial
report data stored in Microsoft Office documents, merger and acquisition information stored
in PDF files, and source code stored in text files. You can also use IDM to detect binary files,
such as JPEG images, CAD designs, and multimedia files. In addition, you can use IDM to
detect derived content such as text that has been copied from a source document to another
file.
See “Supported forms of matching for IDM” on page 513.
See “About the Indexed Document Profile” on page 515.
 Detecting content using Indexed Document Matching (IDM) 513
Introducing Indexed Document Matching (IDM)

About using IDM

To use IDM you collect the documents and files that you want to protect and index the files
and documents using the Enforce Server. During the indexing process the system uses an
algorithm to fingerprint each file or file contents. You then create a policy that contains one or
more IDM conditions that reference the index. The system then checks files against the index
for matches.
For example, consider a document source you have collected that includes several confidential
Microsoft Office documents (Word, Excel, PowerPoint) and image files (JPEG, BMP). You
create an Indexed Document Profile and index the documents and files. You then configure
the Content Matches Document Signature policy condition with a Minimum Document
Exposure setting of 50%. The IDM policy and index are deployed to a detection server.
In production the detection server checks inbound files against the index for matches. If an
inbound text-based file that the system can extract the contents from contains 50% or more
of content indexed from one of the source documents, the system records a match. And, if an
inbound image file has the same binary signature as one of the files that has been indexed,
the system records a match. The server and agent perform exact file matching automatically
on binary (non-extractable) files even though the policy condition is configured for partial
matching.

Note: The Mac Agent is substantially the same as the Windows Agent, except that the Mac
Agent does not support two-tier detection, and different channels are supported on the Mac
Agent and Windows Agent. See “Overview of Mac agent detection technologies and policy
authoring features” on page 1721.

See “Types of IDM detection” on page 514.

See “About the Indexed Document Profile” on page 515.

Supported forms of matching for IDM

IDM supports three forms of matching: exact file, exact file contents, and partial file contents.
Detection servers support all three forms of matching. The DLP Agent supports exact file and
partial file contents matching locally on the endpoint.
Table 22-1 summarizes the forms of matching by the platforms that IDM supports.
 Detecting content using Indexed Document Matching (IDM) 514
Introducing Indexed Document Matching (IDM)

Table 22-1 Forms of matching for IDM

Type of matching Description Platform

Partial file contents Match of discrete passages of extracted and normalized Detection server
file contents.
DLP Agent
See “Using IDM to detect exact and partial file contents”
on page 521.

Exact file Match is based on the binary signature of the file. Detection server

See “Using IDM to detect exact files” on page 520. DLP Agent

Exact file contents Match is an exact match of the extracted and normalized Detection server
file contents.
Note: Symantec recommends
See “Using IDM to detect exact and partial file contents” that you use partial file contents
on page 521. matching rather than exact file
contents matching.

Types of IDM detection

There are three types of IDM detection implementations: agent, server, and two-tier. The type
you choose is based on your data loss prevention requirements.
Table 22-2 summarizes the three types of IDM detection.

Table 22-2 Types of IDM detection

Type Description Details

Agent IDM The DLP Agent supports partial contents matching in See “Agent IDM detection”
addition to exact file matching locally on the endpoint. on page 514.

Server IDM The detection server performs exact file matching, exact See “Server IDM detection”
file contents matching, and partial file contents matching. on page 515.

Two-tier IDM The DLP Agent sends the data to the detection server for See “Two-tier IDM detection”
policy evaluation. on page 515.

Agent IDM detection

With Agent IDM detection the DLP Agent evaluates documents locally in real time for partial
file contents and exact file matches. Agent IDM lets you use the block, notify, and user cancel
response rules on the endpoint with IDM policies. Symantec Data Loss Prevention also supports
detection on stream-based channels such as Printing or Copying/Pasting from the Clipboard.
See “Supported forms of matching for IDM” on page 513.
 Detecting content using Indexed Document Matching (IDM) 515
Introducing Indexed Document Matching (IDM)

Agent IDM is enabled by default for a newly installed Endpoint Server. Agent IDM for Windows
is disabled when you upgrade from 12.5 or earlier to 14.0, or from 12.5 to 14.6. Agent IDM for
macOS is enabled by default for newly installed Endpoint Servers, but disabled if you upgrade.
In the case of all upgrades except Agent IDM for Windows from 14.x to 14.6, if you want to
use agent IDM you must enable it and reindex your IDM profiles so that the endpoint index is
generated and made available for download by DLP Agents.

Server IDM detection

With server IDM detection, the IDM index is deployed to one or more detection servers and
all detection processing occurs on the server or servers. You can use server IDM to perform
exact file matching and file contents matching. For file contents matching, you can choose to
match file contents exactly or partially (10% to 90%) according to the Minimum Document
Exposure set for the IDM condition.
See “Supported forms of matching for IDM” on page 513.

Two-tier IDM detection

Two-tier is a method of detection that requires communication and data transfer between the
DLP Agent and the Endpoint Server to detect incidents. It is recommended only if you have
very large indexes and the agents do not have enough space to support the profiles. Two-tier
detection has more latency than local detection and requires substantially more network
bandwidth. As a result, it does not support inline response rules for blocking or pop-up
notifications.
With two-tier IDM the DLP Agent sends the data to the Endpoint Server for matching against
the server index. If two-tier detection is enabled for IDM, the server supports all forms of
matching, including exact file, exact file contents, and partial file contents.

Note: Two-tier detection is not supported on agents running on macOS endpoints.

If you use two-tier detection for IDM on the Windows endpoint, make sure that you understand
the performance implications of two-tier detection.
See “Two-tier detection for DLP Agents” on page 358.

About the Indexed Document Profile

The Indexed Document Profile is the user-defined configuration for creating and generating
IDM indexes. You define an Indexed Document Profile using the Enforce Server administration
console. You reference the profile in one or more IDM policy rules or exceptions. The profile
is reusable across policies: you can create one document profile and reference it in multiple
policies. When you create the Indexed Document Profile, you have the option of indexing
 Detecting content using Indexed Document Matching (IDM) 516
Introducing Indexed Document Matching (IDM)

the document source immediately on save of the profile or at a scheduled time. However, you
must index the document source before you can detect policy violations.
See “Creating and modifying Indexed Document Profiles” on page 529.
For example, consider a scenario where you want to create an IDM index to detect when exact
versions of certain documents are found, or when passages or sections of the documents are
exposed. When you define the Indexed Document Profile, you can upload the documents
to the Enforce Server, or you can index the documents using the Remote IDM Indexer. You
can also use file name and file size filters in the document profile to include or ignore certain
files during indexing.

About the document data source

The document data source is the collection of documents you want to index and detect using
IDM. The indexing algorithm uses a fixed amount of memory per document, so it is bound by
the number of documents, rather than their total size. With a profile using 2 GB when loaded
in memory, approximately 1,000,000 documents can be indexed. The exact number of
documents the system permits depends on how many documents have text that can be
extracted.
See “Preparing the document data source for indexing” on page 525.
For smaller document sets (50 MB or less), you can upload the source files to the Enforce
Server using a ZIP file. For larger document sets (up to 2 GB), you can copy the source files
to the host file system where the Enforce Server is installed, either encapsulated within a single
ZIP file or as individual files. You can use FTP/S to transfer the files to the Enforce Server.
Alternatively, you can use the Remote IDM Indexer to remotely index documents.
See “About indexing remote documents” on page 517.
The document data source can contain any file type and any combination of files. If the system
can extract the contents of the file, IDM detects file contents, either exactly or partially depending
on the platform and the policy configuration. If the system cannot extract the contents of the
file, IDM detects the exact file.
See “Supported forms of matching for IDM” on page 513.

About the indexing process

The IDM indexer is a separate process that installs with and runs on the Enforce Server. Partial
matching is disabled by default on the Agent, and enabled by default on the Detection Server.
See “Configure endpoint partial content matching” on page 531.
The number of documents you can index has increased to up to 1,000,000 on the Server and
up to 30,000 on the Agent. These values are based on initial default limits of 2 GB/60 MB. You
can change the 60 MB limit on the Configure Partial Matching page. While it is possible to
reconfigure the 2 GB limit by changing the size of
 Detecting content using Indexed Document Matching (IDM) 517
Introducing Indexed Document Matching (IDM)

com.vontu.profiles.documents.maxIndexSize in
\SymantecDLP\Protect\config\indexer.properties, Symantec recommends that you
contact Symantec Support before reconfiguring properties files.
During indexing, the system stores the document source by changing
\SymantecDLP\Protect\documentprofiles (on Windows) or
/var/SymantecDLP/documentprofiles (on Linux). After indexing, for security purposes the
system deletes the document source files that you have uploaded to the Enforce Server.
The result of the indexing process is four separate indexes: one for detection servers (the
server index) and three for DLP Agents (the endpoint indexes). All indexes are generated
regardless of whether or not you are licensed for Endpoint Prevent or Endpoint Discover. On
the Enforce Server, the system stores the indexes in \SymantecDLP\Protect\index (on
Windows) or /var/SymantecDLP/index (on Linux).
See “About the server index files and the agent index files” on page 518.
For most IDM deployments there is no need to configure the indexer. If necessary you can
configure key settings for the indexer using the file
\SymantecDLP\Protect\config\Indexer.properties.

Note: Symantec recommends that you contact Symantec Support for guidance if you decide
to modify a properties file. Modifying properties incorrectly can cause serious issues with the
operation of Symantec Data Loss Prevention.

About indexing remote documents

IDM indexing can be done on the Enforce Server or remotely, using the Remote IDM Indexer.
See “Creating and modifying Indexed Document Profiles” on page 529.
Using the CIFS protocol you can remotely index documents that are stored on one or more
file shares in a Microsoft Windows-networked environment. You provide the Universal Naming
Convention (UNC) path to a shared network folder resource and index the documents that
stored in that folder or subfolders depending on the level of permission granted.
See “Using the remote SMB share option to index file shares” on page 536.
WebDAV provides extensions to the HTTP 1.1 protocol that enable collaborative editing and
management of files that are stored on remote web servers. You can index such documents
remotely by exposing them to the Enforce Server using WebDAV. For example, you can use
the remote SMB option with a UNC address and a WebDAV client to index Microsoft SharePoint
or OpenText Livelink documents.
See “Using the remote SMB share option to index SharePoint documents” on page 536.
 Detecting content using Indexed Document Matching (IDM) 518
Introducing Indexed Document Matching (IDM)

Note: To index documents on a SharePoint server using the Remote SMB Share option, you
must deploy the Enforce Server to a supported Windows Server operating system host. Data
Loss Prevention depends on Windows NTLM services to mount a WebDAV server.

About the server index files and the agent index files
When you create an Indexed Document Profile and index a document data source, the
system generates four index files, one for the server and three for the endpoint. The indexes
are generated regardless of whether or not you are licensed for a particular detection server
or the DLP Agent.
See “About index deployment and logging” on page 519.
The server index is a binary file named DocSource.rdx. The server index supports exact file,
exact file contents, and partial file contents matching. If the document data source is large,
the server index may span multiple *.rdx files.
The endpoint index is comprised of one secure binary file, either EndpointDocSource.rdx or
LegacyEndpointDocSource.rdx for backward compatibility with 14.0 and 12.5 Agents. The
endpoint index supports exact file and partial file contents matching. EncryptedDocSource.rdx
is for endpoint partial matching.
See “Supported forms of matching for IDM” on page 513.
To create the index entries for exact file and exact file contents matching, the system uses the
MD5 message-digest algorithm. This algorithm is a one-way hash function that takes as input
a message of arbitrary length and produces as output a 128-bit message-digest or "fingerprint"
of the input. If the message input is a text-based document that the system can extract contents
from, such as a Microsoft Word file, the system extracts all of the file content, normalizes it by
removing whitespace, punctuation, and formatting, and creates a cryptographic hash. Otherwise,
if the message input is a file that the system cannot extract the contents from, such as an
image file, small file, or unsupported file type, the system creates a cryptographic hash based
on the binary signature of the file.

Note: To improve accuracy across different versions of the Enforce Server and DLP Agent,
only binary matching MDF is supported on the agent, whether or not the file contains text.

See “Using IDM to detect exact files” on page 520.

See “Using IDM to detect exact and partial file contents” on page 521.
In addition, for file formats the system can extract the contents from, the indexer creates hashes
for discrete sections of content or text passages. These hashes are used for partial matching
for both server and agent indexes. The system uses a selection method to store hashed
sections of partial content so that not all extractable text is indexed. The hash function ensures
 Detecting content using Indexed Document Matching (IDM) 519
Introducing Indexed Document Matching (IDM)

that the server index does not contain actual document content. Table 22-3 summarizes the
types of matching supported by the endpoint and server indexes.

Table 22-3 Types of matching supported by the endpoint and server indexes

Message input Output Matches Included in index file

A single cryptographic hash Exact file contents DocSource.rdx

derived from all of the extracted
LegacyEndpointDocSource.rdx
and normalized file contents
Text-based file that the
system can extract the
One or more rolling hashes based Partial file DocSource.rdx
contents from
on discrete passages of extracted contents (10% to
EndpointDocSource.rdx
and normalized content using a 90%)
selection method EncryptedDocSource.rds

Binary file, custom file, A single cryptographic hash based Exact file binary DocSource.rdx
small file, encapsulated on the binary signature of the file
EndpointDocSource.rdx
file
LegacyEndpointDocSource.rdx
Agent only: Text-based
file that the system can
extract the contents
from.

About index deployment and logging

The Enforce Server is responsible for deploying the IDM server and endpoint indexes to the
detection and Endpoint Servers. You cannot manually deploy the indexes.
The system deploys the server index to each designated detection server in the folder
\SymantecDLP\Protect\index (on Windows) or /var/SymantecDLP/index (on Linux). At
run-time, the detection server loads the server index into random access memory (RAM) when
an active IDM policy that references that index is deployed to that detection server.
The system deploys the endpoint index (either EndpointDocSource.rdx or
LegacyEndpointDocSource.rdx) to each designated Endpoint Server. When a DLP Agent
connects to the Endpoint Server, the DLP Agent downloads the endpoint index. Assuming
agent IDM is enabled, the DLP Agent loads the endpoint index into memory when the index
is required by an active local policy.
See “Estimating endpoint memory use for agent IDM” on page 545.
You cannot manually deploy either the server or endpoint index files by copying the *.rdx file
or files from the Enforce Server to a detection server. The detection server does not monitor
the index destination folder for new index files; the detection server must be notified by the
Enforce Server that an index has been deployed. If a detection server is offline during the
index deployment process, the Enforce Server stops trying to deploy the index. When the
 Detecting content using Indexed Document Matching (IDM) 520
Introducing Indexed Document Matching (IDM)

detection server comes back online the Enforce Server deploys the index to the detection
server. The same is true for DLP Agents. There is no way to manually copy the endpoint index
to the endpoint host and have the DLP Agent recognize the index.
Table 22-4 summarizes how IDM indexes are deployed and the logs files to check to
troubleshoot index deployment.

Table 22-4 IDM index deployment and logging

Platform Index file Deployment Logged

Server DocSource.rdx Sent automatically by the Enforce detection_operational.log

Server to each designated detection
Use to identify if the index profile was
server after the index is generated.
deployed to the detection server.
Loaded by the detection server into
FileReader.log
RAM at run-time.
Use to determine if the index profile is
loaded into memory.

Agent EndpointDocSource.rdx Both of these files are sent by the endpoint_server_operational.log

Enforce Server to each designated
or Use to identify if the index profile was
Endpoint Server. The agent selects
deployed to the Endpoint Server.
LegacyEndpointDocSource.rdx the appropriate file, based on the
version of the agent. Pull the agent logs to see if the index
profile is loaded into memory.
LegacyEndpointDocSource.rdx
is for backward compatibility with 14.0
and 12.5 Agents

Downloaded by the DLP Agent based

on the agent connection interval.

Loaded into RAM at run-time when a

local, active policy requires the index.

Using IDM to detect exact files

The system performs exact file matching automatically on all binary files. In addition, if the file
format is text-based but the system is unable to c extract the contents from the file, the system
performs exact file matching. This behavior is true even if you select a Minimum Document
Exposure percentage for the IDM condition that is less than Exact. The DLP Agent performs
exact file matching on all files, both binary files and files with extractable text.
See “About the server index files and the agent index files” on page 518.
For example, an IDM rule with a minimum document exposure set to 50% automatically
attempts to match a binary file exactly because the Minimum Document Exposure setting
only applies to files that the system cannot extract the contents from. In addition, the system
 Detecting content using Indexed Document Matching (IDM) 521
Introducing Indexed Document Matching (IDM)

performs exact file matching for files containing a very small amount of text, as well as files
that were encapsulated when indexed, even if text-based.
As an optimization for exact file type matching in Endpoint IDM detection, the system checks
the byte size of the file before computing the run-time hash for comparison against the index.
If the byte size does not match size of the indexed file there is no need to compute the exact
file hash. The system does not consider the file format when creating the exact file fingerprint.
Table 22-5 summarizes exact file type matching behavior.

Table 22-5 Requirements for using IDM to detect files

File format Example Description

File format from which the Proprietary or non-supported If the system cannot extract the contents from the file
system cannot extract the document format format, you can use IDM to detect that specific file
contents using exact binary matching.

See “Do not compress files in the document source”

on page 548.

Binary file GIF, MPG, AVI, CAD design, You can use IDM to detect binary file types from
JPEG files, audio/video files which you cannot extract the contents, such as
images, graphics, JPEGs, etc. Binary file detection
is not supported on stream-based channels.

File containing a small CAD files and Visio diagrams A file containing a small amount of text is treated as
amount of text a binary file even if the contents are text-based and
can have their contents extracted.

See “Using IDM to detect exact and partial file

contents” on page 521.

Encapsulated file Any file that is encapsulated when
indexed (even if text-based and
can have their contents
extracted); for example, Microsoft
Word file archived in a ZIP file
If a document data source file is encapsulated in an
archive file, the file contents of the subfile cannot be
extracted and only the binary signature of the file can
be fingerprinted. This does not apply to document
archive that are indexes.

See “About the document data source” on page 516.

Using IDM to detect exact and partial file contents

The primary use case for IDM is to detect file contents (as distinguished from binary files, such
as audio or video files, for example). On both the server and the endpoint, you can use IDM
to match files exactly or partially (10% to 90%). Additionally, on the server, file contents can
be matched exactly. Symantec recommends that you use partial content match because it is
much more reliable than exact content match. File contents include text-based content of any
 Detecting content using Indexed Document Matching (IDM) 522
Introducing Indexed Document Matching (IDM)

document type the system can extract the file contents from, such as Microsoft Office documents
(Word, Excel, PowerPoint), PDF, and many more.
See “Supported formats for content extraction” on page 777.
An exact file contents match means that the normalized extracted content from the file matches
exactly the content of a file that has been indexed. With partial matching on the endpoint, using
a 90% threshold generates 90% to 100% content matches. These are less strict than the
previous exact content matches and may, in some cases, match even if there are some minor
differences between the scanned file and the indexed file.
The system does not consider the file format or file size when creating the cryptographic hash
for the index or when checking for an exact file contents match against the index. A document
might contain much more content, but the system detects only the file contents that are indexed
as part of the Indexed Document Profile. For example, consider a situation where you index
a one-page document, and that one-page document is included as part of a 100-page document.
The 100-page document is considered an exact match because its content matches the
one-page document exactly.
See “About the server index files and the agent index files” on page 518.
For text-based files from which you can extract the contents, in addition to creating the MD5
fingerprint for exact file contents matching, the system uses a rolling hash algorithm to register
discrete sections or passages of content. In this case the system uses a selection method to
store hashed sections of content; not all text is hashed in the index. The index does not contain
actual document content.
Table 22-6 lists the requirements to match file contents using IDM.

Table 22-6 Requirements for using IDM to detect content

Requirement Description

File formats from The system must be able to extract the the file format and extract file content. Data Loss
which you can extract Prevention supports context extraction for over 100 file types.
the contents
See “Supported formats for content extraction” on page 777.

Unencapsulated file To match file contents, the source file cannot be encapsulated in an archive file when the
source file is indexed. If a file in the document source is encapsulated in an archive file, the
system does not index the file contents of the encapsulated file. Any encapsulated file is
considered for exact matches only, like image files and other unsupported file formats.

See “Do not compress files in the document source” on page 548.
Note: The exception to this is the main ZIP file that contains the document data source, for
those upload methods that use an archive file. See “Creating and modifying Indexed Document
Profiles” on page 529.
 Detecting content using Indexed Document Matching (IDM) 523
Introducing Indexed Document Matching (IDM)

Table 22-6 Requirements for using IDM to detect content (continued)

Requirement Description

Minimum amount of For exact file contents matching, the source file must contain at a minimum 50 characters of
text normalized text before the extracted content is indexed. Normalization involves the removal
of punctuation and whitespace. A normalized character therefore is either a number or a letter.
This size is set by the min_normalized_size=50 parameter in the file
\SymantecDLP\Protect\config\Indexer.properties. If file contains less than 50
normalized characters, the system performs an exact file match against the file binary.
Note: Symantec advises that you consult with Symantec Support for guidance if you need to
change an advanced setting or edit a properties file. Incorrectly updating a properties file can
have unintended consequences.

For partial file contents matching, there must be at least 300 normalized characters. However,
the exact length is variable depending on the file contents and encoding.

See “Do not index empty documents” on page 548.

Maximum amount of The default maximum size of the document that can be processed for content extraction at
text run-time is 30,000,000 bytes. If your document is over 30,000,000 bytes you need to increase
the default maximum size in Advanced server settings. Contact Symantec Support for
assistance when changing Advanced server settings, to avoid any unintended consequences.

About using the Content Matches Document Signature policy

condition
You use the IDM condition Content Matches Document Signature From to implement IDM
detection rules and exceptions in your policies.
See “Configuring the Content Matches Document Signature policy condition” on page 545.
When you configure this condition, you specify the IDM index to use and how the condition
should match against the index using the Minimum Document Exposure setting. You can
select either Exact or partial between 10% to 90%. For example, if you select 70% for the
Minimum Document Exposure, a match occurs only if 70% or more of the hashed file contents
is detected.
See “Use parallel IDM rules to tune match thresholds” on page 553.
If a file is not text-based, its content is not extractable, is very small, or is encapsulated in an
archive file, the file is matched exactly based on its binary signature. This form of matching is
performed automatically by the system, regardless of what configuration option you choose
for the Minimum Document Exposure setting. This setting only applies to partial file contents
matching.
See “Using IDM to detect exact files” on page 520.
 Detecting content using Indexed Document Matching (IDM) 524
Introducing Indexed Document Matching (IDM)

Table 22-7 describes the matching supported by the Content Matches Document Signature
From policy condition.

Table 22-7 Minimum document exposure settings for the IDM condition

Configuration setting File contents Match Example

Exact file matching File contents
See “Using IDM to detect
exact and partial file
contents” on page 521.
All of the extracted and Microsoft Word
normalized file contents, if
the file is text-based and
from which the content is not
extractable

Exact content matching The endpoint performs Microsoft Word, JPG, MP3
binary matching on all files.

Partial content matching File contents Discrete passages of text Microsoft Word

See “Using IDM to detect

exact and partial file
contents” on page 521.

About white listing partial file contents

Often sensitive documents contain standard boilerplate text that does not require protection,
including front matter, headers, and footers. Information contained in document headers and
footers is likely to cause false positives. Likewise, boilerplate text, such as standard language
and non-proprietary corporate content that is repeated across confidential documents, can
cause false positives.
See “White listing file contents to exclude from partial matching” on page 527.
Removing non-sensitive boilerplate or header/footer content before indexing is usually not
feasible, especially if you have a large document data set. In this case you can configure the
system to exclude ("whitelist") non-sensitive text. You do this by adding the text to ignore to
the whitelist file. During indexing, any whitelisted content found in the source files is ignored.
At run-time the content does not cause false positives because it has been excluded.
See “Use white listing to exclude non-sensitive content from partial matching” on page 550.

Note: White listing only applies to partial file contents matching; it does not apply to exact file
contents matching. The white listing file is not checked at run-time when the system computes
the cryptographic hashes for exact file contents matching.
 Detecting content using Indexed Document Matching (IDM) 525
Configuring IDM profiles and policy conditions

Configuring IDM profiles and policy conditions

Table 22-8 provides the workflow for creating IDM profiles and configuring IDM policies.
Complete the steps to ensure that your IDM rules are properly implemented and are as accurate
and efficient as possible.

Table 22-8 Implementing IDM

Step Action Description

1 Identify the content you want to protect and See “Using IDM to detect exact and partial file contents”
collect the documents that contain this on page 521.
content.
See “Using IDM to detect exact files” on page 520.

2 Prepare the documents for indexing. See “Preparing the document data source for indexing”
on page 525.

3 Whitelist headers, footers, and boilerplate See “White listing file contents to exclude from partial
text. matching” on page 527.

4 Create an Indexed Document Profile and See “Creating and modifying Indexed Document Profiles”
specify the document source. on page 529.

5 Configure any document source filters. See “Filtering documents by file name” on page 539.

6 Schedule indexing as necessary. See “Scheduling document profile indexing” on page 542.

7 Configure one ore more IDM policy conditions See “Configuring the Content Matches Document Signature
or exceptions. policy condition” on page 545.

8 Test and troubleshoot your IDM See “Troubleshooting policies” on page 408.
implementation.

Preparing the document data source for indexing

You must collect and prepare the documents you want to index. These documents are known
as the document data source.
See “About the document data source” on page 516.
A document data source is a ZIP archive file that contains the documents to index. It can also
be the files stored in a file share on a local or remote computer. A document data source ZIP
file can contain any file type and any combination of files. If you have a file share that already
contains the documents you want to protect, you can reference this share in the document
profile.
 Detecting content using Indexed Document Matching (IDM) 526
Configuring IDM profiles and policy conditions

Table 22-9 Preparing the document source for indexing

Step Action Description

1 Collect all of the documents Collect all of the documents you want to index and put them in a folder.
you want to protect.
See “About the document data source” on page 516.

2 Uncompress all the files you The files you index should be in their unencapsulated, uncompressed state.
want to index. Check the document collection to make sure none of the files are
encapsulated in an archive file, such as ZIP, TAR, or RAR. If a file is
embedded in an archive file, extract the source file from the archive file and
remove the archive file.

See “Using IDM to detect exact and partial file contents” on page 521.

3 Separate the documents if
you have more than
1,000,000 files to index.
To protect a large amount of content and files, create separate collections
for each set of documents over 1,000,000 files in size, with all files in their
unencapsulated, uncompressed state. For example, if you have 15,000,000
documents you want to index, separate the files by folders, one folder
containing 750,000 files, and another folder containing the remaining 750,000
files. or, you can change the value of
com.vontu.profiles.documents.maxIndexSize in the
Indexer.properties to accommodate larger data sets. The rule of thumb is
2 GB/1 million documents.

See “Create separate profiles to index large document sources” on page 552.

4 Decide how you are going to The indexing process is a separate process that runs on the Enforce Server.
make the document source To index the document source you must make the files accessible to the
files available to the Enforce Enforce Server. You have several options. Decide which one works best
Server. for your needs and proceeding accordingly.

See “Uploading a document archive to the Enforce Server” on page 532.

See “Referencing a document archive on the Enforce Server” on page 533.

See “Using local path on Enforce Server” on page 535.

See “Using the remote SMB share option to index file shares” on page 536.

5 Configure the document The next step is to configure the document profile, or, alternatively, if you
profile. want to exclude specific document content from detection, whitelist it.

See “Creating and modifying Indexed Document Profiles” on page 529.

See “White listing file contents to exclude from partial matching” on page 527.
 Detecting content using Indexed Document Matching (IDM) 527
Configuring IDM profiles and policy conditions

White listing file contents to exclude from partial matching

You use white listing to exclude unimportant or noncritical content, such as standard boilerplate
text, document headers and footers, from the IDM index. White listing such content helps to
reduce false positives.
See “About white listing partial file contents” on page 524.
See “Use white listing to exclude non-sensitive content from partial matching” on page 550.
To exclude content from matching, you copy the content you want to exclude to a text file and
save the file as Whitelisted.txt. By default, the file must contain at least 300 non-whitespace
characters to have its content fingerprinted for white listing purposes. When you index the
document source, the Enforce Server or the Remote IDM Indexer looks for the
Whitelisted.txt file.

See “Use white listing to exclude non-sensitive content from partial matching” on page 550.
Table 22-10 describes the process for excluding document content using white listing.

Table 22-10 White listing non-sensitive content

Step Action Description

1 Copy the content you want to Copy only noncritical content you want to exclude, such as standard
exclude from matching into a text boilerplate text and document headers and footers, to the text file. By
file. default, for file contents matching the file to be indexed must contain
at least 300 characters. This default setting applies to the
Whitelisted.txt file as well. For whitelisted text you can change
this default setting.

See “Changing the default indexer properties” on page 543.

2 Save the text file as The Whitelisted.txt file is the source file for storing content you
Whitelisted.txt. want to exclude from matching.

3 Save the file to the Save the file to

whitelisted directory on the \SymantecDLP\Protect\documentprofiles\whitelisted (on
Enforce Server host file system. Windows) or
/var/SymantecDLP/documentprofiles/whitelisted (on Linux).

4 Configure the Indexed When you index the document data source, the Enforce Server looks
Document Profile and generate for the Whitelisted.txt file. If the file exists, the Enforce Server
the index. copies it to Whitelisted.x.txt, where x is a unique identification
number corresponding to the Indexed Document Profile. Future
indexing of the profile uses the profile-specific Whitelisted.x.txt
file, not the generic Whitelisted.txt file.

See “Creating and modifying Indexed Document Profiles” on page 529.

 Detecting content using Indexed Document Matching (IDM) 528
Configuring IDM profiles and policy conditions

Manage and add Indexed Document Profiles

The Manage > Data Profiles > Indexed Documents screen lists all configured Indexed
Document Profiles in the system. From this screen you can manage existing profiles and
add new ones.

Table 22-11 Indexed Documents screen actions

Action Description

Add IDM profile Click Add Document Profile to create a new Indexed Document Profile.

See “Configuring IDM profiles and policy conditions” on page 525.

Edit IDM profile Click the name of the Document Profile, or click the pencil icon to the far right of the profile, to
modify an existing Document Profile.

See “Creating and modifying Indexed Document Profiles” on page 529.

Remove IDM profile Click the red X icon next to the far right of the document profile row to delete that profile from
the system. A dialog box confirms the deletion.
Note: You cannot edit or remove a profile if another user currently modifies that profile, or if a
policy exists that depends on that profile.

Refresh IDM profile Click the refresh arrow icon at the upper right of the Indexed Documents screen to fetch the
status latest status of the indexing process. If you are in the process of indexing, the system displays
the message "Indexing is starting." The system does not automatically update the screen when
the indexing process is complete.

Table 22-12 Indexed Documents screen details

Column Description

Document Profile The name of the Indexed Document Profile.

Detection server The name of the detection server that indexes the Document Profile and the Document Profile
version.

Click the triangle icon beside the Document Profile name to display this information. It appears
beneath the name of the Document Profile.

Location The location of the file(s) on the Enforce Server that the system has profiled and indexed.

Documents The number of documents that the system has indexed for the document profile.
 Detecting content using Indexed Document Matching (IDM) 529
Configuring IDM profiles and policy conditions

Table 22-12 Indexed Documents screen details (continued)

Column Description

Status The current status of the document indexing process, which can be any of the following:
■ Next scheduled indexing (if it is not currently indexing)
■ Sending an index to a detection server
■ Indexing
■ Deploying to a detection server

In addition, beneath the status of the indexing process, the system displays the status of each
detection server, which can be any of the following:

■ Completed, including a completion date

■ Pending index completion (that is, waiting for the Enforce Server to finish indexing a file)
■ Replicating indexing
■ Creating index (internally)

Error messages The Indexed Document screen also displays any error messages in red (for example, if the
document profile is corrupted or does not exist).

See “Data Profiles” on page 334.

See “Scheduling document profile indexing” on page 542.
See “Configuring the Content Matches Document Signature policy condition” on page 545.

Creating and modifying Indexed Document Profiles

You define and configure an Indexed Document Profile at the screen Manage > Data Profiles
> Indexed Documents > Configure Document Profile. The document profile specifies the
document data source, the indexing parameters, and the indexing schedule. You must define
a document profile to implement IDM detection.
See “About the Indexed Document Profile” on page 515.
Table 22-13 describes the steps for creating and modifying IDM profiles.

Table 22-13 Configuring a document profile

Step Action Description

1 Navigate to the screen Manage You must be logged on to the Enforce Server administration console
> Data Profiles > Indexed as an administrator or policy author.
Documents.
See “Policy authoring privileges” on page 334.
 Detecting content using Indexed Document Matching (IDM) 530
Configuring IDM profiles and policy conditions

Table 22-13 Configuring a document profile (continued)

Step Action Description

2 Click Add Document Profile. Select an existing Indexed Document Profile to edit it.
See “Manage and add Indexed Document Profiles” on page 528.

3 Enter a Name for the Document Choose a name that describes the data content and the index type
Profile. (for example, "Research Docs IDM"). The name is limited to 255
characters.

See “Input character limits for policy configuration” on page 393.

4 Select the Document Source Select one of the five options for indexing the document data source,
method for indexing. depending on how large your data source is and how you have
packaged it.

See “About the document data source” on page 516.

Options for making the data source available to the Enforce Server.

■ Upload Document Archive to Server Now

To use this method, you Browse and select a ZIP file containing
the documents to be indexed. The maximum size of the ZIP file
is 50 MB.
See “Uploading a document archive to the Enforce Server”
on page 532.
■ Reference Archive on Enforce Server
Use this method if you have copied the ZIP file to the file system
host where the Enforce Server is installed. The maximum size of
the ZIP file is 2 GB. This ZIP file is available for selection in the
drop-down field.
See “Referencing a document archive on the Enforce Server”
on page 533.
■ Use Local Path on Enforce Server
This method lets you index individual files that are local to the
Enforce Server. With this method the files to be indexed cannot
be archived in a ZIP file.
See “Using local path on Enforce Server” on page 535.
■ Use Remote SMB Share
See “About indexing remote documents” on page 517.
■ Import from a remotely created IDM profile

The Remote IDM Indexer is a standalone tool that lets you index
your confidential documents and files locally on the systems where
these files are stored. See Remote IDM Indexing See “About the
Remote IDM Indexer” on page 554. for more information.
■ See “Using the remote SMB share option to index SharePoint
documents” on page 536.
 Detecting content using Indexed Document Matching (IDM) 531
Configuring IDM profiles and policy conditions

Table 22-13 Configuring a document profile (continued)

Step Action Description

5 Optionally, configure any Filters. You can specify file name and file size filters in the document profile.
The filters tell the system which files to include or ignore during
indexing.

See “Filter documents from indexing to reduce false positives”

on page 551.

Enter files to include in the File Name Include Filters field, or enter
files to exclude in the File Name Exclude Filters field.

See “Filtering documents by file name” on page 539.

Select file sizes to ignore, either Ignore Files Smaller Than or Ignore
Files Larger Than.

See “Filtering documents by file size” on page 541.

6 Select one of the Indexing As part of creating a document profile, you can set up a schedule for
options. indexing the document source.
You do not have to select an indexing option to create a profile that
you can reference in a policy, but you must select an indexing option
to generate the index and actually detect matches using an IDM policy.

■ Select Submit Indexing Job on Save to index the document

source immediately on save of the Document Profile.
■ Select Submit Indexing Job on Schedule to display schedule
options so that you can schedule indexing at a later time.
See “Scheduling document profile indexing” on page 542.

7 Click Save. You must save the document profile.

Configure endpoint partial content matching

You can enable or disable Endpoint partial content matching for IDM profiles on the Enforce
Server administration console at Manage > Data Profiles > Indexed Documents > Configure
Endpoint Partial Matching. This page displays a snapshot in time of all deployed profiles
with their estimated current size. When you click Save, the profiles that you have selected
have partial matching enabled.
Table 22-14 describes the steps for configuring partial content matching on the endpoint.
 Detecting content using Indexed Document Matching (IDM) 532
Configuring IDM profiles and policy conditions

Table 22-14 Configuring endpoint partial content matching

Step Action Description

1 Navigate to the Manage >

Data Profiles > Indexed
Documents> screen.

2 Click Configure Partial The Configure Partial Content Matching page displays a
Matching. snapshot of all profiles that are deployed at the time you
access the page, along with their estimated current size.
Note: The Configure Partial Content Matching page is not
accessible while any IDM profile is being indexed.

3 Click the checkbox under

Note: If a profiles starts re-indexing when you are on this
Endpoint Partial Matching
page, and the profile size changes significantly, and if the
for all profiles that you want
profile is also selected for partial matching, the list of selected
to enable for partial matching.
profiles might be affected.

4 Click Save.
Note: The sum of all deployed profiles on the endpoint cannot
exceed the value of Endpoint Total Profile Size (MB), which
is set to a default 60 MB. To change this value, enter a
different value in the Endpoint Total Profile Size (MB) box.

After you click Save, the profiles that you have selected have
partial matching enabled. Click Refresh to ensure that you
have the latest status of the indexing operation.

Uploading a document archive to the Enforce Server

The Upload Document Archive to Server Now option lets you upload a ZIP file with a
maximum size of 50 MB to the Enforce Server and index its contents. To use this method of
indexing, the document source must meet the requirements described in the table Table 22-15
To upload the document archive to Enforce Server describes the process for using the Upload
Document Archive to Server Now method of indexing.
 Detecting content using Indexed Document Matching (IDM) 533
Configuring IDM profiles and policy conditions

To upload the document archive to Enforce Server

1 Navigate to the screen Manage > Data Profiles > Indexed Documents > Configure
Document Profile.
2 Select the option Upload Document Archive to Server Now.
Click Browse and select the ZIP file. The ZIP file can be anywhere on the same network
as the Enforce Server.
Optionally, you can type the full path and the file name if the ZIP file is local to the Enforce
Server, for example: c:\Documents\Research.zip.
3 Specify one or more file name or file size filters (optional).
See “Filtering documents by file name” on page 539.
4 Select one of the indexing options (optional).
See “Scheduling document profile indexing” on page 542.
5 Click Save.

Table 22-15 Requirements for using the Upload Document Archive to Server Now option

Requirement Description

ZIP file only The document archive must be a ZIP file; no other encapsulation formats are supported
for this option.

50 MB or less You cannot use this option if the document archive ZIP file is more than 50 MB because
files exceeding that size limit can take too long to upload and slow the performance of the
Enforce Server. If the document archive ZIP file is over 50 MB, use the Reference Archive
on Enforce Server method instead.

UTF-8 file names only The IDM indexing process fails (and presents you with an "unexpected error") if the
document archive (ZIP file) contains non-ASCII file names in encodings other that UTF-8.
If the ZIP file contains files with non-ASCII file names, use one of the following options
instead to make the files available to the Enforce Server for indexing:

■ Use the Remote IDM Indexer.

■ Use Local Path on Enforce Server
■ Use Remote SMB Share

Referencing a document archive on the Enforce Server

You use the Reference Archive on Enforce Server option to create an IDM index based on
a ZIP file that is local to the Enforce Server. You use this option to index source documents
that are archived in a ZIP file that is larger than 50 MB.
See “About the document data source” on page 516.
 Detecting content using Indexed Document Matching (IDM) 534
Configuring IDM profiles and policy conditions

Note: If the ZIP file is less than 50 MB, you can use the Upload Document Archive to Server
Now option instead. See “Uploading a document archive to the Enforce Server” on page 532.

To use the Reference Archive on Enforce Server option, you copy the ZIP file to the
\SymantecDLP\Protect\documentprofiles folder on the Enforce Server file system host.
Once you have copied the ZIP file to the Enforce Server, you can select the document source
from the pull-down menu at the Add Document Profile screen. See “Creating and modifying
Indexed Document Profiles” on page 529.
To reference the document archive on the Enforce Server describes the procedure for using
the Reference Archive on Enforce Server option.
To reference the document archive on the Enforce Server
1 Copy the ZIP file to the Enforce Server.
■ On Windows, copy the ZIP file to directory \SymantecDLP\Protect\documentprofiles
■ On Linux, copy the ZIP file to directory /var/SymantecDLP/documentprofiles
See Table 22-16 on page 535.

Note: The system deletes the document data source file after the indexing process
completes.

2 Log on to the Enforce Server administration console.

3 Navigate to the screen Manage > Data Profiles > Indexed Documents > Configure
Document Profile.
4 Select the file from the Reference Archive on Enforce Server pull-down menu.

Note: A document source currently referenced by another Indexed Document Profile

does not appear in the list.

5 Specify one or more file name or file size filters (optional).

See “Filtering documents by file name” on page 539.
6 Select one of the indexing options (optional).
See “Scheduling document profile indexing” on page 542.
7 Click Save to save the document profile.
 Detecting content using Indexed Document Matching (IDM) 535
Configuring IDM profiles and policy conditions

Table 22-16 Requirements to use the option Reference Archive on Enforce Server

Requirement Description

ZIP file only The document archive must be a ZIP file; no other encapsulation formats are supported
for this option.

The ZIP file can be at the most 2 GB. Consider using a third-party solution (such as Secure
FTP), to copy the ZIP file securely to the Enforce Server.

See “About the document data source” on page 516.

subfile not archived Make sure the subfiles are proper and not encapsulated in an archive (other than the
top-level profile archive).

See “Do not compress files in the document source” on page 548.

See “Do not index empty documents” on page 548.

UTF-8 file names only Do not use this method if any of the names of the files you are indexing contain non-ASCII
file names.
Use either of the following options instead:

■ Use the Remote IDM Indexer. See xref to Remote IDM Indexer chapter.
■ Use Local Path on Enforce Server
See “Using local path on Enforce Server” on page 535.
■ Use Remote SMB Share
See “Using the remote SMB share option to index file shares” on page 536.

Using local path on Enforce Server

The Use Local Path on Enforce Server method lets you index individual files that are local
to the Enforce Server. With this method the files to be indexed cannot be archived in a ZIP
file. The system deletes the documents after the indexing process completes.
See “Creating and modifying Indexed Document Profiles” on page 529.
To use the Use Local Path on Enforce Server method of making the document source
available to the Enforce Server for indexing, you enter the local path to the directory that
contains the documents to index. For example, if you copied the files to the file system at
directory C:\Documents, you would enter C:\Documents in the field for the Use Local Path
on Enforce Server option. You must specify the exact path, not a relative path. Do not include
the actual file names in the path.

Note: If the files you index include a file that is more than 2 GB in size, the system indexes all
the files except the 2 GB file. This only applies to the Use Local Path on Enforce Server
option. It does not apply to the Reference Archive on Enforce Server option.
 Detecting content using Indexed Document Matching (IDM) 536
Configuring IDM profiles and policy conditions

Using the remote SMB share option to index file shares

The Use Remote SMB Share method lets you index documents remotely using the Common
Internet File System (CIFS) protocol. To use this method of making the document source
available to the Enforce Server, you enter the Universal Naming Convention (UNC) path for
the Server Message Block (SMB) share that contains the documents to index
See “About indexing remote documents” on page 517.
See “To index remote documents on file shares using CIFS” on page 536. provides the steps
for using CIFS to index remote documents.

Note: Symantec Data Loss Prevention does not delete documents after indexing when you
use the Use Remote SMB Share option.

To index remote documents on file shares using CIFS

1 Log on to the Enforce Server administration console.
2 Navigate to the screen Manage > Data Profiles > Indexed Documents > Configure
Document Profile.
3 Select the option Use Remote SMB Share.
4 Enter the UNC Path for the SMB share that contains the documents to index.
A UNC path consists of a server name, a share name, and an optional file path, for
example: \\server\share\file_path.
5 Enter a valid user name and password for the share, and then re-enter the password.
The user you specify must have general access to the shared drive and read permissions
for the constituent files.
Optionally, you can Use Saved Credentials, in which case the credentials are available
from the pull-down menu.
See “About the credential store” on page 145.
6 Complete the configuration of the Indexed Document Profile.
See “Creating and modifying Indexed Document Profiles” on page 529.

Using the remote SMB share option to index SharePoint documents

To remotely index files on SharePoint, you expose the remote file share using WebDAV. Once
you have enabled WebDAV for SharePoint, you use the Use Remote SMB Share option and
enter the UNC path to index the remote documents. Symantec Data Loss Prevention supports
remote IDM indexing using WebDAV for SharePoint 2007 and SharePoint 2010 instances.
See “About indexing remote documents” on page 517.
 Detecting content using Indexed Document Matching (IDM) 537
Configuring IDM profiles and policy conditions

Note: To index documents on a SharePoint server using the Remote SMB Share option, you
must deploy the Enforce Server to a supported Windows Server operating system host. Data
Loss Prevention depends on Windows NTLM services to mount a WebDAV server.

Table 22-17 provides the procedure for remotely indexing SharePoint documents using WebDAV

Table 22-17 Indexing of SharePoint documents

Step Task Description

1 Enable WebDAV for See “Enabling WebDAV for Microsoft IIS” on page 538.
SharePoint.

2 Start the WebClient service. From the computer where the Enforce Server is installed, start the WebClient
service using the "Services" console. If this service is "disabled," right-click it
and select Properties. Enable the service, set it to Manual, then Start it.
Note: You must have administrative privileges to enable this service.

3 Access the SharePoint From the computer where your Enforce Server is installed, access SharePoint
instance. using your browser and the following address format:

http://<server_name>:port

For example: http://protect-x64:80

4 Log on to SharePoint as an You do not need to have SharePoint administrative privileges.

authorized user.

5 Locate the documents to In SharePoint, navigate to the documents you want to scan. Often SharePoint
scan. documents are stored at the Home > Shared Documents screen. Your
documents may be stored in a different location.

6 Find the UNC path for the
documents.
In SharePoint for the documents you want to scan, select the option Library
> Open with Explorer. Windows Explorer should open a window and display
the documents. Look in the Address field for the path to the documents. This
address is the UNC path you need to scan the documents remotely. For
example: \\protect-x64\Shared Documents. Copy this path to the
Clipboard or a text file.

7 Create the IDM Index. See “Creating and modifying Indexed Document Profiles” on page 529.
 Detecting content using Indexed Document Matching (IDM) 538
Configuring IDM profiles and policy conditions

Table 22-17 Indexing of SharePoint documents (continued)

Step Task Description

8 Configure the SharePoint To configure the remote indexing source:

remote indexing source.
■ For the Document Source field, select the Use Remote SMB Share option.
■ For the UNC Path, paste (or enter) the address you copied from the previous
step. For example: \\protect-x64\Shared Documents.
■ For the User Credentials, enter your SharePoint user name and password,
or select the same from the Saved Credentials drop-down list.
■ Select the option Submit Indexing on Save and click Save.

9 Verify success. At the Manage > Data Profiles > Indexed Documents screen you should see
that the index was successfully created. Check the "Status" and the number
of documents indexed. If the index was successfully created you can now use
it to create IDM policies.

See “Troubleshooting SharePoint document indexing” on page 539.

Enabling WebDAV for Microsoft IIS

There are various methods for enabling WebDAV for IIS. The following steps provide one
approach, in this case for a Windows Server 2008 R2. This approach is provided as an example
only. Your approach and environment may differ.
Microsoft IIS deployments that host SharePoint instances can be enabled to accept WebDAV
connections from web clients.
See “Using the remote SMB share option to index SharePoint documents” on page 536.
Enable WebDAV for SharePoint
1 Log on to the SharePoint system where you want to enable WebDAV.
2 Open the Internet Information Services (IIS) Manager console.
3 Select the server name in the IIS tree.
4 Expand the tree, click the Web Sites folder and expand it.
5 Select the SharePoint instance from the list.
6 Right-click the SharePoint instance and select New > Virtual Directory.
7 The Virtual Directory Creation Wizard appears. Click Next.
8 Enter a name in the Alias field (such as "WebDAV") and click Next.
9 Enter a directory path in the Web Site Content Directory field. It can be any directory
path as long as it exists. Click Next.
10 Select Read access and click Next.
 Detecting content using Indexed Document Matching (IDM) 539
Configuring IDM profiles and policy conditions

11 Click Finish.
12 Right-click the virtual directory that you created and select Properties.
13 In the Virtual Directory tab, select the option "A redirection to a URL" and click Create.
The alias name is populated in the Application Name field.
14 Enter the SharePoint site URL in the "Redirect to" field and click OK. WebDAV is now
enabled for this SharePoint instance.

Troubleshooting SharePoint document indexing

If you cannot connect the Enforce Server computer to the SharePoint Server computer after
enabling WebDAV, make sure that you have started the WebClient service on the Enforce
Server computer. You must start this service and test the WebDAV connection before you
configure IDM indexing.
See “Using the remote SMB share option to index SharePoint documents” on page 536.
If you plan to re-index SharePoint documents periodically as they are updated, it may be useful
to map the remote network resource to the local computer where the Enforce Server is installed.
You can use the "net use" MS-DOS command to map SharePoint using the UNC path. For
example:
■ net use
This command without parameters retrieves and displays a list of network connections.
■ net use s: \\sharepoint_server\Shared Documents
This command assigns (maps) the SharePoint server to the local "S" drive.
■ net use * \\sharepoint_server\Shared Documents
This command assigns (maps) the SharePoint server to the next available letter drive.
■ net use s: /delete
This command removes the network mapping to the specified drive.

Filtering documents by file name

When you configure an Indexed Document Profile, you have the option of using filters to include
or exclude documents in your data source from being indexed. There are two types of file
name filters: File Name Include Filters and File Name Exclude Filters. Symantec recommends
that if you choose to use file name filters you select either inclusion filters or exclusion filters,
but not both.
See “Filter documents from indexing to reduce false positives” on page 551.
Table 22-18 describes the differences between the include and exclude filters for file names.
 Detecting content using Indexed Document Matching (IDM) 540
Configuring IDM profiles and policy conditions

Table 22-18 File name filters distinguished

Filter Description

File Name Include Filters If the File Name Include Filters field is empty, matching is performed on all documents
in the document profile. If you enter anything in the File Name Include Filters field, it is
treated as an inclusion filter. In this case the document is indexed only if it matches the
filter you specify.

For example, if you enter *.docx in the File Name Include Filters field, the system
indexes only the *.docx files in the document source.

File Name Exclude Filters The Exclude Filters field lets you specify the documents to exclude in the matching
process.

If you leave the Exclude Filters field empty, the system performs matching on all
documents in the ZIP file or file share. If you enter any values in the field, the system
scans only those documents that do not match the filter.

The system treats forward slashes (/) and backslashes (\) as equivalent. The system ignores
whitespace at the beginning or end of the pattern. File name filtering does not support escape
characters, so you cannot match on literal question marks, commas, or asterisks.
Table 22-19 describes the syntax accepted by the File Name Filters feature. The syntax for
the Include and Exclude filters is the same.

Table 22-19 File name filtering syntax

Operator Description

Asterisk (*) Represents any number of characters.

Question mark (?) Represents a single character.

Comma (,) and newline Represents a logical OR.

Table 22-20 provides sample filters and descriptions of behavior if you enter them in the File
Name Include Filters field:

Table 22-20 File name filter examples

Filter string Description

*.txt,*.docx The system indexes only .txt and .docx files in the ZIP file or file share, ignoring
everything else.

?????.docx The system indexes files with the .docx extension and files with five-character
names, such as hello.docx and stats.docx, but not good.docx or
marketing.docx.
 Detecting content using Indexed Document Matching (IDM) 541
Configuring IDM profiles and policy conditions

Table 22-20 File name filter examples (continued)

Filter string Description

*/documentation/*,*/specs/* The system indexes only files in two subdirectories below the root directory, one
called "documentation" and the other called "specs."

Example with wildcards and
sub-directories:
*\scan_dir\l*.txt
IDM indexing fails or ignores the filter setting if the File Name Includes / Excludes
filter string starts with an alphanumeric character and includes a wildcard, for
example: l*.txt. The workaround is to configure the include/exclude filter with
the filter string as indicated in this example, that is, *\scan_dir\l*.txt.

For example, the filter 1*.txt does not work for a file path
\\dlp.symantec.com\scan_dir\lincoln-LyceumAddress.txt. However,
if the filter is configured as *\scan_dir\l*.txt, the indexer acknowledges the
filter and index the file.

Filtering documents by file size

Filters let you specify documents to include or exclude from indexing. The types of filters include
File Name Include Filters, File Name Exclude Filters, and File Size Filters. You use file size
filters to exclude files from the matching process based on their size. Any files that match the
size filters are ignored.
See “Filtering documents by file name” on page 539.
In the Size Filters fields, specify any restrictions on the size of files the system should index.
In general you should use only one type of file size filter.
See “Filter documents from indexing to reduce false positives” on page 551.
Table 22-21 describes the file size filter options.

Table 22-21 File size filter configuration options

Filter Description

Ignore Files Smaller Than To exclude files smaller than a particular size:

■ Enter a number in the field for Ignore Files Smaller Than.

■ Select the appropriate unit of measure Bytes, KB (kilobytes), or MB (megabytes)
from the drop-down list.

For example, to prevent indexing of files smaller than one kilobyte (1 KB), enter 1 in
the field and select KB from the corresponding drop-down list.
 Detecting content using Indexed Document Matching (IDM) 542
Configuring IDM profiles and policy conditions

Table 22-21 File size filter configuration options (continued)

Filter Description

Ignore Files Larger Than To exclude files larger than a particular size:
■ Enter a number in the field for Ignore Files Larger Than.
■ Select the appropriate unit of measure (Bytes, KB, or MB) from the drop-down list.

For example, to prevent indexing of files larger than two megabytes (2 MB), enter 2
in the field and select MB from the corresponding drop-down list.

Scheduling document profile indexing

When you configure a document profile, select Submit Indexing Job on Save to index the
document profile as soon as you save it. Alternatively, you can set up a schedule for indexing
the document source.
To schedule document indexing, select Submit Indexing Job on Schedule and select a
schedule from the drop-down list as described in Table 22-22.

Note: The Enforce Server can index only one document profile at a time. If one indexing
process is scheduled to start while another indexing process is running, the new process does
not begin until the first process completes.

Table 22-22 Options for scheduling Document Profile indexing

Parameter Description

Index Once On – Enter the date to index the document profile in the format MM/DD/YY. You can also click
the date widget and select a date.

At – Select the hour to start indexing.

Index Daily At – Select the hour to start indexing.

Until – Select this check box to specify a date in the format MM/DD/YY when the indexing
should stop. You can also click the date widget and select a date.

Index Weekly Day of the week – Select the day(s) to index the document.

At – Select the hour to start indexing.

Until – Select this check box to specify a date in the format MM/DD/YY when the indexing
should stop. You can also click the date widget and select a date.
 Detecting content using Indexed Document Matching (IDM) 543
Configuring IDM profiles and policy conditions

Table 22-22 Options for scheduling Document Profile indexing (continued)

Parameter Description

Index Monthly Day – Enter the number of the day of each month you want the indexing to occur. The number
must be 1 through 28.

At – Select the hour to start indexing.

Until – Select this check box to specify a date in the format MM/DD/YY when the indexing
should stop. You can also click the date widget and select a date.

Changing the default indexer properties

The server index contains the MD5 fingerprint of each file that has been indexed, either raw
binary or exact extracted content if the contents of the file can be extracted, and hashes of
discrete passages of content.
See “Using IDM to detect exact and partial file contents” on page 521.
The size of the passages depends on the low_threshold_k setting in the indexer properties
file (\SymantecDLP\Protect\config\indexer.properties). Generally, there is no need to
change the default settings. When you lower the default minimum, the Enforce Server creates
hashes out of smaller sections of the documents it indexes.
The default settings apply to the Whitelisted.txt file as well. If the amount of content you
need to whitelist is less than the minimum amount required for partial matching, you can adjust
the default minimum setting.
To change the default minimum for whitelisted text
1 On the Symantec Data Loss Prevention host, navigate to directory
\SymantecDLP\Protect\config on Windows, or /opt/SymantecDLP/Protect/config
on Linux.
2 Use a text editor to open file Indexer.properties
3 Locate the parameter low_threshold_k:

low_threshold_k=50
 Detecting content using Indexed Document Matching (IDM) 544
Configuring IDM profiles and policy conditions

4 Change the numerical portion of the parameter value to reflect the wanted minimum
number of characters that are allowed in Whitelisted.txt.
For example, to change the minimum to 30 characters, modify the value to look like the
following:

low_threshold_k=30

The value for this parameter must match the min_normalized_size value. The default
for min_normalized_size is 50.
5 Save the file.
For more information on IDM configuration and customization, see the article "Understanding
IDM configuration and customization" at http://www.support.symantec.com/doc/TECH234899
at the Symantec Support Center.

Enabling Agent IDM

You enable exact and partial match IDM on the Windows endpoint by setting the advanced
agent configuration parameter Detection.TWO_TIER_IDM_ENABLED.str to OFF. Once two-tier
detection is OFF, the DLP Agent performs exact and partial file and exact and partial file
contents matching, assuming you have generated the endpoint index.

Note: Two-tier deployment is not supported on the Mac Agent.

See “Creating and modifying Indexed Document Profiles” on page 529.

For new installations, exact and partial match IDM on the endpoint is the default setting for
the default endpoint agent configuration (TWO_TIER_IDM_ENABLED = OFF); you do not
need to enable it.
For upgraded systems, exact and partial match IDM on the endpoint is disabled
(TWO_TIER_IDM_ENABLED = ON) so that there is no change in functionality for existing IDM
policies deployed to the endpoint. If you want to use exact match IDM on the endpoint after
upgrade, you need to turn off two-tier detection and reindex each document data source.
See “To turn two-tier detection on or off” on page 544.
To turn two-tier detection on or off
1 Log on to the Enforce Server administration console.
2 Navigate to System > Agents > Agent Configuration.
3 Select the applicable agent configuration.
4 Select the Advanced Agent Settings tab.
5 Locate the Detection.TWO_TIER_IDM_ENABLED.str parameter.
 Detecting content using Indexed Document Matching (IDM) 545
Configuring IDM profiles and policy conditions

6 Change the value to either "ON" or "OFF" (case insensitive) depending on your
requirements.
See Table 22-23 on page 545.
7 Click Save at the top of the page to save the changes.
8 Apply the agent configuration to the agent group or groups.
See “Applying agent configurations to an agent group” on page 1848.

Table 22-23 Advanced agent settings for exact match IDM on the endpoint

Advanced Agent Setting parameter Value Default Detection Matching type

engine

Detection.TWO_TIER_IDM_ENABLED.str OFF New 14.6 DLP Agent Exact file

installation or
Partial file contents
system upgrade
from 12.5.

ON System upgrade Endpoint Server Exact file

from 12.0.x
Exact file contents

Partial file contents

Estimating endpoint memory use for agent IDM

DLP 14.6 uses about 20% less memory than DLP 14.0 for partial matching IDM document
profiles. For partial matching, DLP requires about 2 KB of RAM per file, or about 60 MB for
30,000 files for the agent. For exact matching only, DLP requires about 40 bytes per file.
See “About the server index files and the agent index files” on page 518.

Configuring the Content Matches Document Signature policy

condition
The Content Matches Document Signature From matches unstructured document content
based on the Indexed Document Profile. The Content Matches Document Signature From
condition is available for detection rules and exceptions.
See “About using the Content Matches Document Signature policy condition” on page 523.
 Detecting content using Indexed Document Matching (IDM) 546
Configuring IDM profiles and policy conditions

To configure the Content Matches Document Signature condition

1 Add an IDM condition to a policy rule or exception, or modify an existing one.
See “Configuring policies” on page 376.
See “Configuring policy rules” on page 380.
See “Configuring policy exceptions” on page 389.
2 Configure the IDM condition parameters.
See Table 22-24 on page 546.
3 Save the policy configuration.

Table 22-24 Content Matches Document Signature condition parameters

Action Description

Set the Minimum Select an option from the drop-down list.

Document Exposure.
Choose Exact to match document contents exactly.

Choose a percentage between 10% and 90% to match document contents partially.

Configure Match Select how you want to count matches:

Counting.
■ Check for existence
Reports a match count of 1 if there are one or more condition matches.
■ Count all matches
Reports a match count of the exact number of matches.

See “Configuring match counting” on page 384.

Select the components to Select one of the available message components to match on:
Match On.
■ Body – The content of the message.
■ Attachments – Any files that are attached to or transferred by the message.

See “Selecting components to match on” on page 386.

Configure additional Select this option to create a compound condition. All conditions must be met to trigger or
conditions to Also Match. except a match.

You can Add any available condition from the drop-down menu.

Test and tune the policy. See “Test and tune policies to improve match accuracy” on page 416.

See “Use parallel IDM rules to tune match thresholds” on page 553.

See “Troubleshooting policies” on page 408.

 Detecting content using Indexed Document Matching (IDM) 547
Best practices for using IDM

Best practices for using IDM

Indexed Document Matching (IDM) is designed to protect document content and images. IDM
relies on an index of fingerprinted documents to perform partial and derivative text-based
content matching. In addition, you can also use IDM to match indexed documents exactly
based on their binary stamp, including not only text-based documents but also graphics and
media files
Because of the broad range of matching supported by IDM, you should consider the best
practices in this section to implement IDM policies that accurately match the data you want to
protect.
Table 22-25 summarizes the IDM considerations discussed in this section, with links to individual
topics for each.

Table 22-25 IDM policy best practices

Consideration Description

Reindex IDM profiles after upgrade. See “Reindex IDM profiles after major upgrade”
on page 548.

Do not compress documents whose content you want to See “Do not compress files in the document source”
fingerprint. on page 548.

Prefer partial matching over exact matching on the DLP See “Prefer partial matching over exact matching on the
Agent. DLP Agent” on page 549.

Do not index text-based documents without content. See “Do not index empty documents” on page 548.

Be aware of the limitations of exact matching. See “Understand limitations of exact matching” on page 549.

Use white listing to exclude partial file contents from See “Use white listing to exclude non-sensitive content
matching and reduce false positives. from partial matching” on page 550.

Filter non-critical documents from indexing to reduce false See “Filter documents from indexing to reduce false
positives. positives” on page 551.

Change the index max size to index more than 1,000,000 See “Create separate profiles to index large document
documents. sources” on page 552.

Use remote indexing for large document sets. See “Remote IDM indexing” on page 554.

Use scheduled indexing to automate profile updates. See “Use scheduled indexing to keep profiles up to date”
on page 552.

Use multiple IDM rules in parallel to establish and tune See “Use parallel IDM rules to tune match thresholds”
match thresholds. on page 553.
 Detecting content using Indexed Document Matching (IDM) 548
Best practices for using IDM

Reindex IDM profiles after major upgrade

You must update each Indexed Document Matching profile by reindexing each associated
data source after performing a major upgrade of Symantec Data Loss Prevention.
If you have upgraded to Symantec Data Loss Prevention version 14.6 and you want to use
partial match IDM on the endpoint for existing IDM policies, you must reindex the data source
for each Indexed Document Profile so that each endpoint index is generated and deployed to
DLP Agents.
If you have upgraded to Data Loss Prevention 14.6 and you are not using agent IDM, you are
not required to reindex your data sources, but doing so is recommended.
See “Enabling Agent IDM” on page 544.

Do not compress files in the document source

For file formats whose content can be extracted, the server indexing process opens the
document, extracts the text-based content, and fingerprints the data in full and in part (sections).
However, the indexing process cannot recursively inspect document archives that are contained
in the document set. If a document whose file contents you want to index is compressed in an
archive file (such as ZIP, RAR, or TAR) within the document data source, the system cannot
extract the contents from the file and index its content. In this case, the system only takes a
cryptographic hash of the binary file signature. The embedded file is considered for exact file
matches only, like image files and other unsupported file formats.
This behavior is specific to the design-time indexing process only. At run-time the detection
server does recursively inspect document archives and extract the text of files contained in
those archives. But, to be able to evaluate such content, the IDM index must have been able
to index all content files.
The best practice is not to include any files whose content you want to index in a document
archive. The lone exception is the document archive ZIP file that you upload or copy to the
Enforce Server that contains the entire document set. All files in that container file must be
uncompressed. If the Document Archive uploaded to the Enforce Server for indexing contains
one or more embedded archive files (such as a ZIP), the system performs an exact binary
match on any file contained in the embedded archive file
See “Creating and modifying Indexed Document Profiles” on page 529.

Do not index empty documents

You should be careful about the documents you index. In particular, avoid indexing blank or
empty documents.
For example, indexing a PPTX file containing only photographs or other graphical content but
no textual content matches other blank PPTX files exactly and produces false positives. Is this
 Detecting content using Indexed Document Matching (IDM) 549
Best practices for using IDM

case, even though a PPTX file contains no user-entered text, the file does contain header and
footer placeholder text that the system extracts as file contents. Because the amount of text
extracted and normalized is more than 50 non-whitespace characters, the system treats the
file as not binary and creates a cryptographic hash of all of the file contents. As a result, all
other blank PPTX files produce exact file contents matches because the resulting MD5 of the
extracted content is the same.

Note: This behavior has not been observed with XLSX files; that is, false positives do not get
created if the blank files are different.

See “Using IDM to detect exact and partial file contents” on page 521.

Prefer partial matching over exact matching on the DLP Agent

If you are deploying IDM polices to the endpoint, partial match IDM is recommended. The main
advantage of partial match IDM on the endpoint is that matching is fast because it is done
locally by the agent instead of remotely by the server. In addition, partial match IDM lets you
use response rules directly on the endpoint.
See “Types of IDM detection” on page 514.

Understand limitations of exact matching

Exact match means just that: inbound data must match the MD5 fingerprint of either a binary
file signature or an exact match of extracted and normalized file contents. .
See “Supported forms of matching for IDM” on page 513.
Consider the following when implementing server exact match IDM:
■ White listing only applies to partial file contents matching.
■ For binary files and text-based files coming into the detection engine for exact file matching,
as an optimization the system checks the byte size of the file before computing the run-time
MD5 for comparison against the index. If the file byte sizes do not match there is no
comparison of the cryptographic hashes.
■ File type is never checked for exact file or exact file contents matching.
■ Some file formats change the byte size of a file if the file is opened by the native application
and then saved without changes, resulting in the file not matching exactly. For example, if
you open a file such as a JPEG image with Windows Picture and Fax Viewer and save the
file without making changes, the binary size of the file is nonetheless changed, resulting
in no exact match.
 Detecting content using Indexed Document Matching (IDM) 550
Best practices for using IDM

■ For some applications the Windows Print operation may alter the file data such that extracted
file contents does not match exactly. Known file types that are affected by this include
Microsoft Office documents.
Table 1 lists some known limitations with exact content matching. This list is not exhaustive
and there may be other file formats that change on resave.

Table 1 Limitations of exact file content matching

File type Application Result on resave

dwg AutoCAD 2012 Does not match

jpeg Windows Picture and Fax Viewer Does not match

doc Microsoft Office Word 2007 Does not match

xls Microsoft Excel 2007 Does not match

ppt Microsoft Presentation 2007 Does not match

pdf Adobe Acrobat 9 Pro Does not match

docx Microsoft Office Word 2007 Match

xlsx Microsoft Excel 2007 Match

pptx Microsoft Presentation 2007 Match

Use white listing to exclude non-sensitive content from partial

matching
White listing is designed to let you exclude partial file contents from matching. You use white
listing to exclude headers, footers, and boilerplate content from partial matching and reduce
false positives. Information contained in document headers and footers is likely to cause false
positives. Likewise boilerplate text, such as standard language and non-proprietary corporate
content that is often repeated across confidential documents can cause false positives.
Ideally, you should remove headers and footers from documents before you index them.
However, this may not be feasible, especially if you have a large document set. As a best
practice, you should whitelist header, footer, and boilerplate content so that this text is excluded
when the server index is generated. If you use white listing, generally you can lower the
Minimum Document Exposure setting in the policy without increasing false positives because
more of the content indexed is confidential data, instead of common, repeated content.

Note: White listing does not apply to exact file or exact file contents matching.
 Detecting content using Indexed Document Matching (IDM) 551
Best practices for using IDM

See “About white listing partial file contents” on page 524.

See “White listing file contents to exclude from partial matching” on page 527.

Filter documents from indexing to reduce false positives

When you configure an Indexed Document Profile, you have the option of using filters to include
or exclude documents in your data source for indexing. There are two types of filters: file name
and file size.
See “Creating and modifying Indexed Document Profiles” on page 529.
You use filtering to filter non-critical documents from indexing and ensure that your index is
protecting only confidential files and file contents. Filtering helps reduce false positives and
decrease the size of the IDM index.
See “Do not index empty documents” on page 548.
The best practice is to use either an exclusion filter or an inclusion filter for each filter type, but
not both. For example, you may not need to index all of the files you include in a document
archive or expose to the system by file share. In this case, you can enumerate the files you
want to include (inclusion filter) or list the file types you want to exclude from indexing (exclusion
filter), but you should not use both. You can also use file size filters to set a threshold for the
file size to include or exclude in the index.
See “Filtering documents by file name” on page 539.
See “Filtering documents by file size” on page 541.

Distinguish IDM exceptions from white listing and filtering

White listing lets you exclude partial file contents from matching. Filtering lets you exclude
specific documents from the indexing process. IDM exceptions, on the other hand, let you
except indexed files from exact matching at run-time.
You use the IDM condition as policy exception to exclude files from detection. To be excepted
from matching, an inbound file must be an exact match with a file in the IDM index. You cannot
use IDM exceptions to exclude content from matching. To exclude content, you must whitelist
it.

Note: White listing is not available for exact file or file contents matching; it is only available
for partial content matching.
 Detecting content using Indexed Document Matching (IDM) 552
Best practices for using IDM

Table 22-27 White listing, filters, and exceptions distinguished

IDM Use
Configuration

Exception Except exact file from matching

As an example, the CAN-SPAM Act policy template uses an IDM exception.

White listing Except file contents from matching

See “Use white listing to exclude non-sensitive content from partial matching” on page 550.

Filtering Include or exclude files from being indexed

See “Filter documents from indexing to reduce false positives” on page 551.

Create separate profiles to index large document sources

IDM detection is based on an Indexed Document Profile. The maximum single IDM profile size
in RAM is 2 GB. This maximum size limit is based on the overall number of the documents
being indexed. Depending on the size of the actual source files and their extracted text size,
this translates into approximately 1,000,000 files. You can change the 2 GB maximum size of
a single IDM profile index in the indexer.properties file using
com.vontu.profiles.documents.maxIndexSize.

See “About the document data source” on page 516.

If you need to index more than 1,000,000 files, the best practice is to organize the documents
into separate ZIP files or share directories. You should create a separate Indexed Document
Profile for each individual document set. Then, you can define separate rules that reference
each index and add the rules to one or more policies.

Use WebDAV or CIFS to index remote document data sources

For smaller document sets (50 MB or less), you can upload the files to the Enforce Server.
For larger document sets, consider using FTP Secure to upload the files to the Enforce Server.
Alternatively, you can remotely index documents that are stored on a file share that supports
the CIFS protocol, or on a web server that supports the WebDAV protocol, such as Microsoft
SharePoint or OpenText Livelink
See “About indexing remote documents” on page 517.

Use scheduled indexing to keep profiles up to date

You can use index scheduling to keep your IDM profiles up to date. The initial index scans all
the documents to be indexed. Any subsequent index only scans the differences between the
 Detecting content using Indexed Document Matching (IDM) 553
Best practices for using IDM

two. You should schedule indexing outside of normal business hours to reduce any potential
affect on the system.
See “Scheduling document profile indexing” on page 542.
Before you set up an indexing schedule, consider the following recommendations:
■ If you update your document sources occasionally (for example, less than once a month),
there is no need to create a schedule. Index the document each time you update it.
■ Schedule indexing for times of minimal system use. Indexing affects performance throughout
the Symantec Data Loss Prevention system, and large documents can take time to index.
■ Index a document as soon as you add or modify the corresponding document profile, and
re-index the document whenever you update it. For example, consider a situation where
every Wednesday at 2:00 A.M. you update a document. In this case scheduling the index
process to run every Wednesday at 3:00 A.M. is optimal. Scheduling document indexing
daily is not recommended because that is too frequent and can degrade server performance.
■ Monitor results and modify your indexing schedule accordingly. If performance is good and
you want more timely updates, schedule more frequent document updates and indexing.
■ Symantec Data Loss Prevention performs incremental indexing. When a previously indexed
share or directory is indexed again, only the files that have changed or been added are
indexed. Any files that are no longer in the archive are deleted during this indexing. So a
reindexing operation can run significantly faster than the initial indexing operation.

Use parallel IDM rules to tune match thresholds

The primary use case for IDM policies is to detect unstructured document content based on
a percentage match requirement called the Minimum Document Exposure. This value is a
configurable parameter that specifies the minimum percentage of content in the message that
must match the IDM index to produce a match. The IDM policy default is “Exact,” which means
that, for text-based documents, all of the content of the message must match the fingerprint
to create an incident. A Minimum Document Exposure setting of 10% means that, on average,
one page of a 10 page document must match the IDM index to create an incident.
A document might contain much more content, but Symantec Data Loss Prevention protects
only the content that is indexed as part of a document profile. For example, consider a situation
where you index a one-page document, and that one-page document is included as part of a
100-page document. The 100-page document is considered an exact match because its
content matches the one-page document exactly. In addition, the matched document does
not have to be of the same file type or format as the indexed document. For example, if you
index a Word document as part of a document profile, and its contents are pasted into the
body of an email message or used to create a PDF, the engine considers it a match
A rule-of-thumb for setting the Minimum Document Exposure setting is 60%. Minimum Document
Exposures set to less than 50% typically create many false positives. Starting with rate of 60%
 Detecting content using Indexed Document Matching (IDM) 554
Remote IDM indexing

should give you enough information to determine whether you should go to a higher or lower
match percentage without creating excessive false positives
As an alternative, consider taking a tiered approach to establishing Minimum Document
Exposure settings. For example, you can create multiple IDM rules, each with a different
threshold percentage, such as 80% for documents with a high match percentage, 50% for
documents with a medium match percentage, and 10% with a low match percentage. Using
this approach helps you filter out false positives and establish an accurate Minimum Document
Exposure setting for each IDM index you deploy as part of your policies.

Remote IDM indexing

This section provides instructions and reference content for using the Remote IDM Indexer.

About the Remote IDM Indexer

The Remote IDM Indexer is a standalone tool that lets you index your confidential documents
and files locally on the systems where these files are stored. Using the Remote IDM Indexer
frees you from having to collect and copy all the files you want to protect to the Enforce Server
host for indexing.
The Remote IDM Indexer generates a preindex file (*.prdx) that is encrypted and password
protected. You upload the preindex file to the Enforce Server host for final index generation
and deployment.
The Remote IDM Indexer is supported on Windows and Linux platforms. The tool is configured
using a command line interface (CLI) or a properties file. On Windows, you can use the graphical
user interface (GUI) edition of the tool to configure it.
You can integrate the tool with external systems to schedule indexing. In addition, you can
incrementally index a data source by specifying an existing *.prdx file when you run the tool.

Table 22-28 Remote IDM Indexer features

Feature Description

Familiar installation DLP installers for Windows and Linux

Various configuration options Properties file (default)

Command-line interface (CLI)

Graphical user interface GUI (Windows)

Secure preindex file Password protected

Encrypted data contents

 Detecting content using Indexed Document Matching (IDM) 555
Remote IDM indexing

Table 22-28 Remote IDM Indexer features (continued)

Feature Description

Incremental indexing Ability to load an existing preindex and scan only

new or updated files

Scheduled indexing Windows Task Scheduler

Linux cron job

See the Symantec Data Loss Prevention

Administration Guide for more details.

Secure upload to Enforce UI for uploading the preindex to the Enforce Server

User must provide password to complete the

indexing process

Installing the Remote IDM Indexer

You install the Remote IDM Indexer on one or more systems where the confidential files you
want to index are stored, or on a system from where it is convenient for you to access the
confidential files.
You can install the Remote IDM Indexer on the same Windows and Linux platforms supported
by the Data Loss Prevention suite. See the Symantec Data Loss Prevention System
Requirements Guide for details.
Installing the Remote IDM Indexer
1 Copy the appropriate ProtectInstaller application to the remote system.
Table 22-29 lists the Remote IDM Indexer installer applications.
2 Run the ProtectInstaller application.
See the Symantec Data Loss Prevention Installation Guide for your platform for
installation details.
3 Select only the Indexer option and de-select the other options.

Note: The Indexer includes both the Remote IDM Indexer and the Remote EDM Indexer.
See the Symantec Data Loss Prevention Administration Guide for details on using the
Remote EDM Indexer.

4 Verify installation of the Remote IDM Indexer.

 Detecting content using Indexed Document Matching (IDM) 556
Remote IDM indexing

Table 22-29 Remote IDM Indexer installers

Platform Installer

Linux ProtectInstaller64_15.1.sh

Windows ProtectInstaller64_15.1.exe

Table 22-30 Remote IDM Indexer editions

Platform Edition File path Executable

Linux CLI /opt/SymantecDLP/Protect/bin/ RemoteIDMIndexer

Windows CLI \SymantecDLP\Protect\bin RemoteIDMIndexer.exe

GUI RemoteIDMIndexerUI.exe

Indexing the document data source using the properties file

You can pass parameters to the Remote IDM Indexer using the properties file.
The properties file path is \SymantecDLP\Protect\config\remote_idm.properties (Windows)
or /opt/SymantecDLP/Protect/config/remote_idm.properties (Linux).
To index the data source using the properties file, you edit the file and provide the parameters,
then run the Remote IDM Indexer without any command line arguments. In this case, the
parameters are read from the remote_idm.properties file. For example, using the following
command without any arguments runs the tool which reads the arguments from the properties
file:
C:\SymantecDLP\protect\bin>RemoteIDMIndexer

Caution: If you run the tool from the command line with arguments, those arguments overwrite
the parameters in the properties file.

Table 22-31 lists and describes required parameters for running the Remote IDM Indexer from
the command line.

Note: Refer to the Symantec Data Loss Prevention Administration Guide for details on preparing
the document data source for indexing.
 Detecting content using Indexed Document Matching (IDM) 557
Remote IDM indexing

Table 22-31 Required property file parameters

Configuration file parameter Description

param.uri= This parameter is the local file path (directory folder) or

shared directory where the files to be indexed are stored.

If you want to index the files from a share, you need to

mount that share on the system that contains the indexer
and specify the file path of that share in the param.uri field
of the Remote IDM Indexer tool.

The files should not be encapsulated.

param.out= This parameter is the file path and name of the preindex
file that the tool generates.

Table 22-32 lists and describes optional parameters for running the Remote IDM Indexer from
the command line.

Note: Refer to the Symantec Data Loss Prevention Administration Guide for details on using
white listing and on using file type and file size filters.

Table 22-32 Optional property file parameters

Property file parameter Description

param.whitelist= This parameter is the full file path (including the name) to
the whitelist.txt file. The whitelist file must be local
to the Remote IDM Indexer.

Text in the whitelist file is ignored during detection for

partial file contents matching.

param.include_filter= This parameter is the file type to include for indexing.

Multiple file type entries should be separated by a comma.

param.exclude_filter= This parameter is the file type to exclude for indexing.

Multiple values are comma-separated.

param.min_filesize_bytes= This parameter is the minimum file size filter. File sizes
under the specified size are not indexed.

param.max_filesize_bytes= This parameter is the maximum file size filter. File sizes
over the specified size are not indexed.
 Detecting content using Indexed Document Matching (IDM) 558
Remote IDM indexing

Indexing the document data source using the CLI

The command line interface (CLI) lets you configure and run the Remote IDM Indexer from
the command line.
You can pass parameters to the tool directly from the command line or using a properties file.
Command line options overwrite property file parameters.
This example passes arguments via the command line. In this case the properties file is ignored.
C:\SymantecDLP\protect\bin>RemoteIDMIndexer -uri=\\10.66.195.173\remoteIDM\files
-out=C:\temp\myRemoteIDMPreIndex.prdx

Caution: If you run the tool from the command line with arguments, those arguments overwrite
the parameters in the properties file.

Table 22-33 lists and describes required parameters for running the Remote IDM Indexer from
the command line.

Note: Refer to the Symantec Data Loss Prevention Administration Guide for details on preparing
the document data source for indexing.

Table 22-33 Required CLI parameters

Command line parameter Description

-uri This parameter is the local file path (directory folder) or

shared directory where files to be indexed are stored

The files to be indexed should not be encapsulated.

-out This parameter is the file path and name of the preindex
file that the tool generates.

Table 22-34 lists and describes optional parameters for running the Remote IDM Indexer from
the command line.

Note: Refer to the Symantec Data Loss Prevention Administration Guide for details on using
white listing and on using file type and file size filters.
 Detecting content using Indexed Document Matching (IDM) 559
Remote IDM indexing

Table 22-34 Optional CLI parameters

Command line parameter Description

-whitelist This parameter is the full file path to the whitelist.txt

file.

The whitelist file must be local to the Remote IDM Indexer.

Text in the whitelist file is ignored during detection.

-include_filter This parameter is one or more file types to include for

indexing. Separate multiple entires with a comma.

-exclude_filter This parameter is one or more file types to exclude for

indexing. Separate multiple entires with a comma.

-min_filesize_bytes This parameter is the minimum file size filter. Files under
the specified size are not indexed.

-max_filesize_bytes This parameter is the maximum file size filter. Files over
the specified size are not indexed.

Scheduling remote indexing

If you are using the Windows GUI version of the Remote IDM Indexer, you can schedule or
edit a task directly from the tool. The following screen shots illustrate the process.
See “To schedule indexing using the Windows GUI version of the tool” on page 559.
See “To edit an existing scheduled task using the Windows GUI version of the tool” on page 561.
To schedule indexing using the Windows GUI version of the tool
1 Click the Schedule button, the tool opens the dialog. See “Scheduling remote indexing”
on page 559.
2 Click the Create button to create a new scheduled task. Or, if you already have a task
created, click Edit.
You are prompted to provide a UTF8-encoded password file in cleartext for the scheduled
job. Access to this file should be limited to the appropriate user, such as your Protect user.
When you click Create, you are prompted to provide the credentials to the Windows host.
3 Enter the user name and password for the Windows host where the Task Scheduler is
installed.
When you enter the appropriate credentials (generally administrator privileges are required),
the Remote IDM Indexer creates a new task in the Windows Task Scheduler. The tool
displays a dialog indicating that the task was successfully created and provides you with
the name of the task. See Figure 22-2 on page 560.
 Detecting content using Indexed Document Matching (IDM) 560
Remote IDM indexing

4 Click OK to close the dialog.

After completing this operation with Windows the interface appears.
5 Select the SymantecDLP folder in the Task Scheduler Library.
Notice to the right that there is a task created named "Remote IDM Indexer <time-stamp>".
See Figure 22-3 on page 560.
6 Double-click the created task.
This action brings up the Window Task Scheduler properties dialog for this task. Using
this dialog you can schedule when the Remote IDM Indexer should run. Refer to the Task
Scheduler help for details on using the Windows Task Scheduler.

Figure 22-1 Scheduling indexing dialog

Figure 22-2 Successfully scheduled task dialog

Figure 22-3 Symantec DLP scheduled task

 Detecting content using Indexed Document Matching (IDM) 561
Remote IDM indexing

To edit an existing scheduled task using the Windows GUI version of the tool
1 Click the Schedule button, the tool opens the dialog. See Figure 22-1 on page 560.
2 Click the Edit/Delete Existing Tasks button to open the Windows Task Scheduler utility.
This is where you can edit or delete an existing scheduled task.

Figure 22-4 Windows Task Scheduler properties configuration

Incremental indexing
You can incrementally index a remote data source by specifying an existing preindex file
(*.prdx) in the command line argument when you run the tool.
In the GUI version of the tool you can browse to and select an existing *.prdx file for the
Output File path.
The indexing process appends newly indexed files and file contents to the existing preindex
entries.
The tool compares the last modified date of the file. If the file has been modified after the file
that was pre-indexed, the tool updates the pre-index with the changes that were made to the
file. If the file modified date is the same, the pre-index is not updated. If you change any include,
exclude, or size filters in your existing preindex file, those filters are applied to any previously
indexed files. For example, for a remote data source with 10 .docx files and 10 .pptx files, if
your first remote indexing job has no filters, all files are indexed. If you add an exclude filter
 Detecting content using Indexed Document Matching (IDM) 562
Remote IDM indexing

for .docx files (-exclude_filter=*.docx) and run the indexing job again, the .docx files are
removed from the index and only the .pptx files remain.

Logging and troubleshooting

Remote IDM indexing status messages are logged to the Indexer.log file.
The log file path is \SymantecDLP\Protect\logs\debug\Indexer.log.
The log presents error messages that indicate if file access was denied and if file indexing
failed.

Copying the preindex file to the Enforce Server host

After you have generated the preindex file you must copy it to the Enforce Server host so it
can be loaded for profiling and deployment.
You copy the *.prdx file to the following directory on the Enforce Server host:
\SymantecDLP\Protect\documentprofiles.

You can use FTP or FTP/S to copy the *.prdx file to the Enforce Server host file system.

Note: Make sure that the Enforce user reading and loading the .prdx file has permission to
enable copying and loading of the file.

Loading the remote index file into the Enforce Server

The Enforce Server administration console provides a user interface for uploading remote IDM
preindexes to the Enforce Server.
The Data Loss Prevention administrator or policy author must specify the preindex password
that was entered when the preindex file was initially created.
Once uploaded the system uses the preindex to generate the final index that is deployed to
detection servers and agents (if Agent IDM is enabled).

Note: If you have not copied the preindex file to the proper directory on the Enforce Server
host (\SymantecDLP\Protect\documentprofiles), the file does not appear in the drop-down
field for selection.
 Detecting content using Indexed Document Matching (IDM) 563
Remote IDM indexing

Figure 22-5 Loading the remote index into Enforce

 Chapter 23
Detecting content using
Vector Machine Learning
(VML)
This chapter includes the following topics:

■ Introducing Vector Machine Learning (VML)

■ Configuring VML profiles and policy conditions

■ Best practices for using VML

Introducing Vector Machine Learning (VML)

Vector Machine Learning (VML) performs statistical analysis to protect unstructured data. The
analysis determines if content is similar to example content you train against.
With VML you do not have to locate and fingerprint all of the data you want to protect. You
also do not have to describe it and risk potential inaccuracies. Instead, you train the system
to learn the type of content you want to protect based on example documents you provide.
VML detection is based on a VML profile. You create a VML profile by uploading a
representative amount of content from a specific category of data. The system scans the
content, extracts the features, and creates a statistical model based on the frequency of
keywords in the example documents. At run-time the system applies the model to analyze and
detect the content that has the features that are statistically similar to the profile.
VML simplifies the detection of unstructured, text-based content and offers the potential for
high accuracy. The key to implementing VML is the example content you train the system
against. You must be careful to select the documents that are representative of the type of
content you want to protect. And, you must select good examples of content you want to ignore
that are closely related to the content you want to protect.
 Detecting content using Vector Machine Learning (VML) 565
Introducing Vector Machine Learning (VML)

See “Configuring VML profiles and policy conditions” on page 568.

About the Vector Machine Learning Profile

The Vector Machine Learning Profile is the data profile that you define for implementing VML
policies.
For example, you might create a VML profile to protect your source code. You train the system
using positive example documents (proprietary code that you want to protect). You also train
the system using negative example documents (open source code that you do not care to
protect). A VML policy references the VML profile to analyze message data and recognize the
content that is similar to the positive features. The VML profile can be tuned, and it can be
easily updated by adding or removing documents to or from the training sets.
See “Data Profiles” on page 334.
See “Creating new VML profiles” on page 569.

About the content you train

Collecting the documents for training is the most important step in the Vector Machine Learning
process. Vector Machine Learning is only as accurate as the example content you train against.
See “Configuring VML profiles and policy conditions” on page 568.
A VML profile is based on a category of content representing a specific business use case. A
category of content comprises two training sets: positive and negative.
The positive training set is content you want to protect. More specific categorization results in
better accuracy. For example, “Customer Purchase Orders” is better than “Financial Documents”
because it is more specific.
The negative training set is content you want to ignore, yet related to the positive training set.
For example, if the positive training set is “Weekly Sales Reports," the negative training set
might contain "Sales Press Releases."
You should collect an equal amount of positive and negative content that is primarily text-based.
You do not have to collect all the content you want to protect. However, you do need to
assemble training sets large enough to produce reliable statistics.
The recommended number of documents is 250 per training set. The minimum number of
documents per training set is 50.
Table 23-1summarizes the baseline requirements for the content you collect for VML profile
training.
 Detecting content using Vector Machine Learning (VML) 566
Introducing Vector Machine Learning (VML)

Table 23-1 VML training set requirements

Category of Type of data Training set Quantity Content Size

content

Positive Recommended: Content you want

250 documents to protect.

Minimum: 50
documents 30 MB per upload
Single, specific Text-based
business use case (primarily) No size limit per
Negative Approximately the Content you do
category.
same amount as not want to protect
the positive yet thematically
category. related to the
positive category.

About the base accuracy from training percentage rates

During the VML profile training process, the system extracts example document content and
converts it to raw text. The system selects features (or keywords) using a proprietary algorithm
and generates the VML profile. As part of the training process, the system calculates and
reports base accuracy rates for false positives and false negatives. The base accuracies from
training percentage rates indicate the quality of your positive and negative training sets.
The goal is to achieve 100% accuracy (0% base false rates), but obtaining this level of quality
for both training sets is usually not possible. You should reject a training profile if either the
base false positive rate or the base false negative rate is more than 5%. A relatively high base
false percentage rate indicates that the training set is not well categorized. In this case you
need to add documents to an under-represented training set or remove documents from an
over-represented training set, or both.
See “Managing training set documents” on page 576.
Table 23-2 describes what the base accuracy percentage rates from training mean in relation
to the positive and negative training sets for a given VML profile.

Table 23-2 Base accuracy rates from training

Accuracy rate Description

Base false positive rate The percentage of the content in the negative training set that is statistically similar to the
(%) positive content.

Base false negative Rrate The percentage of the content in the positive training set that is statistically similar to
(%) negative content.
 Detecting content using Vector Machine Learning (VML) 567
Introducing Vector Machine Learning (VML)

About the Similarity Threshold and Similarity Score

Each VML profile has a Similarity Threshold that can be set from 0 to 10. This setting is used
to make an adjustment for imperfect information within a training set to achieve the best
accuracy possible. During detection, a message must have a Similarity Score greater than the
Similarity Threshold for an incident to be generated. The Similarity Threshold is set at the
profile level—not within a policy. It is set this way because there is an ideal Similarity Threshold
setting that is unique to your training set where the best accuracy rates can be achieved (both
in terms of false positives and false negatives).
When a VML policy detects an incident, the system displays the Similarity Score in the match
highlighting section of the Incident Snapshot in the Enforce Server administration console.
The Similarity Score indicates how similar the detected content is to the VML profile. The
higher the score the more statistically similar the message is to the positive example documents
in your VML profile.
Consider an example where a Similarity Threshold is set to 4 and a message with a Similarity
Score of 5 is detected. In this case the system reports the match as an incident and displays
the Similarity Score during match highlighting. However, if a message is detected with a
Similarity Score of 3, the system does not report a match (and no incident) because the
Similarity Score is below the Similarity Threshold.
Table 23-3 describes the Similarity Threshold and Similarity Score numbers.

Table 23-3 Similarity Threshold and Similarity Score details

Similarity Description

Similarity Threshold The Similarity Threshold is a configurable parameter between 0 and 10 that is unique to each
VML profile. The default setting is 10, which requires the most similar match between the VML
profile features and the detected message content. As such, this setting is likely to produce
fewer incidents. A setting of 0 produces the most number of matches, many of which are likely
to be false positives.

See “Adjusting the Similarity Threshold” on page 581.

Similarity Score The Similarity Score is a read-only run-time statistic between 0 and 10 reported by the system
based on the detection results of a VML policy. To report an incident, the Similarity Score must
be higher than the Similarity Threshold, otherwise the VML policy does not report a match.

About using unaccepted VML profiles in policies

The system lets you create a policy that is based on a VML profile that has never been accepted.
However, the VML profile is not active and is not deployed to a referenced policy until the
profile is initially accepted.
See “Training VML profiles” on page 572.
 Detecting content using Vector Machine Learning (VML) 568
Configuring VML profiles and policy conditions

Where you have a VML policy that references a never-accepted VML profile, the result of this
configuration depends on the type of detection server. Table 23-4 describes the behavior:

Table 23-4 References to never-accepted VML profiles

Detection server Description

Discover Server Discover scanning does not begin until all policy dependencies are loaded.
A Discover scan based on a VML policy does not start until the referenced
VML profile is accepted. In this case the system displays a message in the
Discover scanning interface that indicates that the scan waits on the
dependency to load.

Network and Endpoint For a simple rule, or compound rule where the conditions are ANDed, the
Servers entire rule fails because the VML condition cannot match. If this is the only
rule in the policy, the policy does not work.

For a policy where there are multiple rules that are ORed, only the VML rule
fails; the other rules in the policy are evaluated.

See “Policy detection execution” on page 357.

Configuring VML profiles and policy conditions

Vector Machine Learning (VML) performs statistical analysis to protect unstructured data. It
also determines if content is similar to an example set of documents you train against.
See “Introducing Vector Machine Learning (VML)” on page 564.
The following table describes the process for implementing VML.

Table 23-5 Implementing VML

Step Action Description

Step 1 Collect the example documents for Collect a representative number of example documents that contain
training the system. the positive content that you want to protect and the negative
content you want to ignore.

See “About the content you train” on page 565.

Step 2 Create a new VML profile. Define a new VML profile based on the specific business category
of data from which you have derived your positive and negative
training sets.

See “Creating new VML profiles” on page 569.

 Detecting content using Vector Machine Learning (VML) 569
Configuring VML profiles and policy conditions

Table 23-5 Implementing VML (continued)

Step Action Description

Step 3 Upload the example documents. Upload the example positive and negative training sets separately
to the Enforce Server.

See “Uploading example documents for training” on page 571.

Step 4 Train the VML profile. Train the system to learn the type of content you want to protect
and generate the VML profile.

See “Training VML profiles” on page 572.

Step 5 Accept or reject the trained profile. Accept the trained profile to deploy it. Or, reject the profile, update
one or both of the training sets (by adding or removing example
documents), and restart the training process.

See “About the base accuracy from training percentage rates”

on page 566.

See “Managing VML profiles” on page 577.

Step 6 Create a VML policy and test Create a VML policy that references the VML profile.
detection.
See “Configuring the Detect using Vector Machine Learning Profile
condition” on page 579.

Test and review incidents based on the Similarity Score.

See “About the Similarity Threshold and Similarity Score”

on page 567.

Step 7 Tune the VML profile. Adjust the Similarity Threshold setting as necessary to optimize
detection results.

See “Adjusting the Similarity Threshold” on page 581.

Step 8 Follow VML best practices. See “Best practices for using VML” on page 587.

Creating new VML profiles

A VML profile contains the model that is generated from the training set contents. Once you
define a VML profile, you use it to create one or more VML policies.
See “Configuring VML profiles and policy conditions” on page 568.

Note: You must have Enforce Server administrator privileges to create VML profiles.
 Detecting content using Vector Machine Learning (VML) 570
Configuring VML profiles and policy conditions

To create a new VML profile

1 Click New Profile from the Manage > Data Profiles > Vector Machine Learning screen
(if you have not already done so).
2 Enter a Name for the VML profile in the Create New Profile dialog.
Use a logical name for the VML profile that corresponds to the category of data you want
to protect.
See “About the content you train” on page 565.
3 Optionally, enter a Description for the VML profile.
You may want to include a description that identifies the purpose of the VML profile.
4 Click Create to create the new VML profile.
Or, click Cancel to cancel the operation.
5 Click Manage Profile to upload example documents.
See “Uploading example documents for training” on page 571.

Working with the Current Profile and Temporary Workspace tabs

For any single VML profile there are two possible versions: Current and Temporary. The
Current Profile is the run-time version; the Temporary Profile is the design-time version. As
you develop a VML profile, you create a Current Profile that you have trained, accepted, and
perhaps deployed to one or more policies. You also create a Temporary Profile that you actively
edit and tune.
The Enforce Server administration console displays each version of the VML profile in separate
tabs:
■ Current Profile
This version is the active instance of the VML profile. This version has been successfully
trained and accepted; it is available for deployment to one or more policies.
■ Temporary Workspace
This version is an editable version of the VML profile. This version has not been trained,
or accepted, or both; it cannot be deployed to a policy.
Initially, when you create a new VML profile, the system displays only the Current Profile tab
with an empty training set. After you initially train and accept the VML profile, the Trained Set
table in the Current Profile tab is populated with details about the training set. The information
that is displayed in this table and tab is read-only.
 Detecting content using Vector Machine Learning (VML) 571
Configuring VML profiles and policy conditions

To edit a VML profile

◆ Click Manage Profile to the far right of the Current Profile tab.
The system displays the editable version of the profile in the Temporary Workspace tab.
You can now proceed with training and managing the profile.
See “Training VML profiles” on page 572.
The Temporary Workspace tab remains present in the user interface until you train and
accept a new version of the VML profile. In other words, there is no way to close the Temporary
Workspace tab without training and accepting, even if you made no changes to the profile.
Once you accept a new version of the VML profile, the system overwrites the previous Current
Profile with the newly accepted version. You cannot revert to a previously accepted Current
Profile. However, you can revert to previous versions of the training set for a Temporary Profile.
See “Managing training set documents” on page 576.

Uploading example documents for training

The training set comprises the example positive and negative documents you want to train
the system against. You upload the positive and the negative documents separately.

Note: You can upload individual documents. However, we recommended that you upload a
document archive (such as ZIP, RAR, or TAR) that contains the recommended (250) or
minimum (50) number of example documents. The maximum upload size is 30 MB. You can
partition the documents across archives if you have more than 30 MB of data to upload. See
“About the content you train” on page 565.

To upload the training set

1 Click Manage Profile from the Current Profile tab (if you have not already done so).
This action enables the VML profile for editing in the Temporary Workspace tab.
See “Working with the Current Profile and Temporary Workspace tabs” on page 570.
2 Click Upload Contents (if you have not already done so).
This action opens the Upload Contents dialog.
3 Select the category of content:
■ Choose Positive: match contents similar to these to upload a positive document
archive.
■ Choose Negative: ignore contents similar to these to upload a negative document
archive.

4 Click Browse to select the document archive to upload.

 Detecting content using Vector Machine Learning (VML) 572
Configuring VML profiles and policy conditions

5 Navigate the file system to where you have stored the example documents.
6 Choose the file to upload and click Open.
7 Verify that you have chosen the correct category of content: Positive or Negative.
If you mismatch the upload (select Negative but upload a Positive document archive), the
resulting profile is inaccurate.
8 Click Submit to upload the document archive to the Enforce Server.
The system displays a message indicating if the file successfully uploaded. If the upload
was successful, the document archive appears in the New Documents table. This table
displays the document type, name, size, date uploaded, and the user who uploaded it. If
the upload was not successful, check the error message and retry the upload. Click the
X icon in the Remove column to delete an uploaded document or document archive from
the training set.
9 Click Upload Contents to repeat the process for the other training set.
The profile is not complete and cannot be trained until you have uploaded the minimum
number of positive and negative example documents.
See Table 23-1 on page 566.
10 Once you have successfully uploaded both training sets you are ready to train the VML
profile.
See “Training VML profiles” on page 572.

Training VML profiles

During the profile training process, the system scans the training content, extracts key features,
and generates a statistical model. When the training process completes successfully, the
system prompts you to accept or reject the training profile. If you accept the training results,
that version of the VML profile becomes the Current Profile. The Current Profile is active and
available for use in one or more policies.
See “Configuring VML profiles and policy conditions” on page 568.
 Detecting content using Vector Machine Learning (VML) 573
Configuring VML profiles and policy conditions

Table 23-6 Training the VML profile

Step Action Description

Step 1 Enable training mode. Select the VML profile you want to train from the Manage > Data Profiles >
Vector Machine Learning screen. Or, create a new VML profile.

See “Creating new VML profiles” on page 569.

Click Manage Profile to the far right of the Current Profile tab. The system
displays the profile for training in the Temporary Workspace tab.

See “Working with the Current Profile and Temporary Workspace tabs”
on page 570.

Step 2 Upload the training Familiarize yourself with the training set requirements and recommendations.
content.
See “About the content you train” on page 565.

Upload the positive and the negative training sets in separate document archives
to the Enforce Server.

See “Uploading example documents for training” on page 571.

Step 3 Adjust the memory The default value is "High" which generally results in the best training set accuracy
allocation (only if rates. Typically you do not need to change this setting. For some situations you
necessary). may want to choose a "Medium" or "Low" memory setting (for example, deploying
the profile to the endpoint).

See “Adjusting the memory allocation” on page 575.

Note: If you change the memory setting, you must do so before you train the
profile to ensure accurate training results. If you have already trained the profile,
you must retrain it again after you adjust the memory allocation.

Step 4 Start the training Click Start Training to begin the profile training process.
process. During the training process, the system:

■ Extracts the key features from the content;

■ Creates the model;
■ Calculates the predicted accuracy based on the averaged false positive and
false negative rates for the entire training set;
■ Generates the VML profile.
 Detecting content using Vector Machine Learning (VML) 574
Configuring VML profiles and policy conditions

Table 23-6 Training the VML profile (continued)

Step Action Description

Step 5 Verify training When the training process completes, the system indicates if the training profile
completion. was successfully created.

If the training process failed, the system displays an error. Check the debug log
files and restart the training process.

See “Debug log files” on page 297.

On successful completion of the training process, the system displays the following
information for the New Profile:

■ Trained Example Documents

The number of example documents in each training set that the system has
trained against and profiled.
■ Accuracy Rate From Training
The quality of the training set expressed as base false positive and base false
negative percentage rates.
See “About the base accuracy from training percentage rates” on page 566.
■ Memory
■ The minimum amount of memory that is required to load the profile at run-time
for detection.

Note: If you previously accepted the profile, the system also displays the Current
Profile statistics for side-by-side comparison.

Step 6 Accept or reject the If the training process is successful, the system prompts you to accept or reject
training profile. the training profile. Your decision is based on the Accuracy Rate from Training
percentages.

See “About the base accuracy from training percentage rates” on page 566.
To accept or reject the training profile:

■ Click Accept to save the training results as the active Current Profile.
Once you accept the training profile, it appears in the Current Profile tab
and the Temporary Workspace tab is removed.
■ Click Reject to discard the training results.
The profile remains in the Temporary Workspace tab for editing. You can
adjust one or both of the training sets by adding or removing documents and
retraining the profile.
See “Managing training set documents” on page 576.

Note: A trained VML profile is not active until you accept it. The system lets you
create a policy based on a VML profile that has not been trained or accepted.
However, the VML profile is not deployed to that policy until the profile is accepted.
See “About using unaccepted VML profiles in policies” on page 567.
 Detecting content using Vector Machine Learning (VML) 575
Configuring VML profiles and policy conditions

Table 23-6 Training the VML profile (continued)

Step Action Description

Step 7 Test and tune the Once you have successfully trained and accepted the VML profile, you can now
profile. use it to define policy rules and tune the VML profile.

See “Configuring the Detect using Vector Machine Learning Profile condition”
on page 579.

See “About the Similarity Threshold and Similarity Score” on page 567.
Note: For more information, refer to the Symantec Data Loss Prevention Vector
Machine Learning Best Practices Guide, available at the Symantec Support
Center at (http://www.symantec.com/docs/DOC8733).

Adjusting the memory allocation

The Memory Allocation setting determines the amount of memory that is required to load
VML the profile at run-time for policy detection. When you allocate more memory to training
the larger the VML profile, the profile becomes larger. More features are modeled. By default
this value is set to "High." You should not normally adjust this value. Resources are limited on
the endpoint. If you intend to deploy the VML profile to the endpoint, use a lower memory
setting to reduce the size of the profile.
To adjust memory allocation
1 Click Adjust beside the Memory Allocation setting.
This setting is available in the Temorary Workspace tab. If it is not available, click Manage
Profile from the Current Profile tab.
See “Working with the Current Profile and Temporary Workspace tabs” on page 570.
2 Select the desired memory allocation level.
The following options are available:
■ High
Requires a higher amount of run-time memory; generally yields higher detection
accuracy (default setting).
■ Medium
■ Low
Requires less run-time memory; may result in lower detection accuracy.

3 Click Save to save the setting.

The Memory Setting display should reflect the adjustment you made.
 Detecting content using Vector Machine Learning (VML) 576
Configuring VML profiles and policy conditions

4 Click Start Training to start the training process.

You must adjust the memory allocation before you train the VML profile. If you have already
trained the profile, retrain after adjusting this setting.
See “Training VML profiles” on page 572.
5 Verify the amount of memory that is required to run the VML profile.
After you train the VML profile, the system displays the Memory Required (KB) value.
This value, represents the minimum amount of memory that is required to load the profile
at run-time.
See “Managing VML profiles” on page 577.

Managing training set documents

As you train and tune a VML profile, you may need to adjust one or both of the training sets.
For example, if you reject a training profile, you must add or remove example documents to
improve the training accuracy rates.
See “About the base accuracy from training percentage rates” on page 566.
To add documents to a training set
1 Click Manage Profile for the profile you want to edit.
The editable profile appears in the Temporary Workspace tab.
2 Click Upload Contents.
See “Uploading example documents for training” on page 571.
To remove documents from a training set
1 Click Manage Profile for the profile you want to edit.
The editable profile appears in the Temporary Workspace tab.
2 Click the red X in the Mark Removed column for the trained document you want to remove.
The removed document appears in the Removed Documents table. Repeat this process
as necessary to remove all unwanted documents from the training set.
3 Click Start Training to retrain the profile.
You must retrain and accept the updated profile to complete the document removal
process. If you do not accept the new profile the document you attempted to remove
remains part of the profile.
See “Training VML profiles” on page 572.
 Detecting content using Vector Machine Learning (VML) 577
Configuring VML profiles and policy conditions

To revert removed documents

1 Click the revert icon in the Revert column for a document you have removed.
The document is added back to the training set.
2 Click Start Training to retrain the profile.
You must retrain the profile and reaccept it even though you reverted to the original
configuration.

Managing VML profiles

The Manage > Data Profiles > Vector Machine Learning screen is the home page for
managing existing VML profiles and the starting point for creating new VML profiles.
See “Configuring VML profiles and policy conditions” on page 568.

Note: You must have Enforce Server administrator privileges to manage and create VML
profiles.

Table 1 Creating and managing VML profiles

Action Description

Create new profiles. Click New Profile to create a new VML profile.

See “Creating new VML profiles” on page 569.

View and sort The system lists all existing VML profiles and their state at the Vector Machine
profiles. Learning screen.

Click the column header to sort the VML profiles by name or status.

Manage and train Select a VML profile from the list to display and manage it.
profiles.
The Current Profile tab displays the active profile.

See “Working with the Current Profile and Temporary Workspace tabs” on page 570.

Click Manage Profile to edit the profile.

The editable profile appears in the Temporary Workspace tab. From this tab you
can:

■ Upload training set documents.

See “Uploading example documents for training” on page 571.
■ Train the profile.
See “Training VML profiles” on page 572.
■ Add and remove documents from the training sets.
See “Managing training set documents” on page 576.
 Detecting content using Vector Machine Learning (VML) 578
Configuring VML profiles and policy conditions

Table 1 Creating and managing VML profiles (continued)

Action Description

Monitor profiles. The system lists and describes the status of all VML profiles.
■ Memory Required (KB)
The minimum amount of memory that is required to load the profile in memory
for detection.
See “Adjusting the memory allocation” on page 575.
■ Status
The present status of the profile.
See Table 23-8 on page 578.
■ Deployment Status
The historical status of the profile.
See Table 23-9 on page 579.

Remove profiles. Click the X icon at the far right to delete an existing profile.

If you delete an existing profile, the system removes the profile metadata and the
Training Set from the Enforce Server.

The Status field displays the current state of each VML profile.

Table 23-8 Status values for VML profiles

Status value Description

Accepted on <date> The date the training profile was accepted.

Managing The current profile is enabled for editing.

Empty The profile is created, but no content is uploaded.

Awaiting Acceptance The profile is ready to be accepted.

Canceling Training The system is in the process of canceling the training.

Training Canceled The training process is canceled.

Failed The training process failed.

Training <time> The training is in progress (for the time indicated).

The Deployment Status field indicates if the VML profile has ever been accepted or not.
 Detecting content using Vector Machine Learning (VML) 579
Configuring VML profiles and policy conditions

Table 23-9 Deployment Status values for VML profiles

Status value Description

Never Accepted The VML profile has never been accepted.

See “About using unaccepted VML profiles in policies”
on page 567.

Accepted on <date> The VML profile was accepted on the date indicated.

Changing names and descriptions for VML profiles

If necessary you can change the name of a VML profile or edit its description. When you are
ready to deploy a VML profile to one or more policies, give the profile a self-describing name
so policy authors can easily recognize it.

Note: You do not have to retrain a profile if you change the name or description.

To change the VML profile name or description

1 Select the VML profile from the Manage > Data Profiles > Vector Machine Learning
screen.
See “Managing VML profiles” on page 577.
2 Click the Edit link beside the name of the VML profile.
3 Edit the name and description of the profile in the Change Name and Description dialog
that appears.
4 Click OK to save the changes to the VML profile name or description.
5 Verify the changes at the home screen for the VML profile.

Configuring the Detect using Vector Machine Learning Profile

condition
Once you have trained and accepted the VML profile, you configure a VML policy using the
Detect using Vector Machine Learning Profile condition. This condition references the VML
profile to detect the content that is similar to the example content you have trained against.
See “Configuring VML profiles and policy conditions” on page 568.
 Detecting content using Vector Machine Learning (VML) 580
Configuring VML profiles and policy conditions

Table 23-10 Configuring a VML policy rule

Step Action Description

Step 1 Create and train the VML See “Creating new VML profiles” on page 569.
profile.
See “Training VML profiles” on page 572.

See “About using unaccepted VML profiles in policies” on page 567.

Step 2 Configure a new or an existing See “Configuring policies” on page 376.

policy.

Step 3 Add the VML rule to the policy. From the Configure Policy screen:

■ Select Add Rule.

■ Select the Detect using Vector Machine Learning profile rule from
the list of content rules.
■ Select the VML profile you want to use from the drop-down menu.
■ Click Next.

Step 4 Configure the VML detection Name the rule and configure the rule severity.
rule.
See “Configuring policy rules” on page 380.

Step 5 Select components to match Select one or both message components to Match On:
on.
■ Body, which is the content of the message
■ Attachments, which are any files transported by the message

Note: On the endpoint, the Symantec DLP Agent matches on the entire
message, not individual message components.

See “Selecting components to match on” on page 386.

Step 6 Configure additional conditions Optionally, you can create a compound detection rule by adding more
(optional). conditions to the rule.

To add additional conditions, select the desired condition from the

drop-down menu and click Add.
Note: All conditions must match for the rule to trigger an incident.

See “Configuring compound match conditions” on page 392.

Step 7 Save the policy configuration. Click OK then click Save to save the policy.

Configuring VML policy exceptions

In some situations, you may want to implement a VML policy exception to ignore certain
content.
See “Configuring VML profiles and policy conditions” on page 568.
 Detecting content using Vector Machine Learning (VML) 581
Configuring VML profiles and policy conditions

Table 23-11 Configuring a VML policy exception

Step Action Description

Step 1 Create and train the VML profile. See “Creating new VML profiles” on page 569.
See “Training VML profiles” on page 572.

Step 2 Configure a new or an existing See “Configuring policies” on page 376.

policy.

Step 3 Add a VML exception to the From the Configure Policy screen:
policy.
■ Select Add Exception.
■ Select the Detect using Vector Machine Learning profile exception
from the list of content exceptions.
■ Select the VML profile you want to use from the drop-down menu.
■ Click Next.

Step 4 Configure the policy exception. Name the exception.

Select the components you want to apply the exception to:

■ Entire Message
Select this option to compare the exception against the entire
message. If an exception is found anywhere in the message, the
exception is triggered and no matching occurs.
■ Matched Components Only
Select this option to match the exception against the same
component as the rule. For example, if the rule matches on the Body
and the exception occurs in an attachment, the exception is not
triggered.

Step 5 Configure the condition. Generally you can accept the default condition settings for policy
exceptions.

See “Configuring policy exceptions” on page 389.

Step 6 Save the policy configuration. Click OK then click Save to save the policy.

Adjusting the Similarity Threshold

You adjust the Similarity Threshold setting to tune the VML profile. The Similarity Threshold
determines how similar detected content must be to a VML profile to produce an incident.
See “About the Similarity Threshold and Similarity Score” on page 567.

Note: You do not have to retrain the VML profile after you adjust the Similarity Threshold,
unless you modify a training set based on testing results.
 Detecting content using Vector Machine Learning (VML) 582
Configuring VML profiles and policy conditions

To adjust the Current Value of the Similarity Threshold

1 Click Edit beside the Similarity Threshold label for the VML profile you want to tune.
This action opens the Similarity Threshold dialog.
2 Drag the meter to the desired Curent Value setting.
You set the Similarity Threshold to a decimal value between 0 and 10. The default value
is 10, which produces fewer incidents; a setting of 0 produces more incidents.
3 Click Save to save the Similarity Threshold setting.
4 Test the VML profile using a VML policy.
Compare the Similarity Scores across matches. A detected message must have a Similarity
Score higher than the Similarity Threshold to produce an incident. Make further adjustments
to the Similarity Threshold setting as necessary to optimize and fine-tune the VML profile.
See “Configuring the Detect using Vector Machine Learning Profile condition” on page 579.

Testing and tuning VML profiles

You tune a VML profile by testing it with the Similarity Threshold set to 0. After you determine
the possible range of Similarity Scores for false positives, adjust the Similarity Threshold to
be greater than the highest Similarity Score that false positives reports. This process is known
as negative testing.
A good training set has a well-defined range where the Similarity Threshold is set to achieve
the best accuracy rates. A poor training set yields a poor accuracy result regardless of the
Similarity Threshold. A Similarity Threshold that is set too high or too low can result in a large
number of false positives or false negatives.
To determine the proper Similarity Threshold setting, the recommendation is to perform negative
testing as described in the following steps.

Table 23-12 Steps for tuning VML profiles

Step Action Description

Step 1 Train the VML profile. Follow the recommendations in this guide for defining the category and uploading
the training set documents. Adjust the memory allocation before you train the
profile. Refer to the Symantec Data Loss Prevention Administration Guide for help
performing the tasks involved.

Step 2 Set the Similarity The default Similarity Threshold is 10. At this value the system does not generate
Threshold to 0. any incidents. A setting of 0 produces the most incidents, many of which are likely
to be false positives. The purpose of setting the value to 0 is to see the entire
range of potential matches. It also servers to tune the profile to be greater than
the highest false positive score.
 Detecting content using Vector Machine Learning (VML) 583
Configuring VML profiles and policy conditions

Table 23-12 Steps for tuning VML profiles (continued)

Step Action Description

Step 3 Create a VML policy. Create a policy that references the VML profile you want to tune. The profile must
be accepted to be deployable to a policy.

Step 4 Test the policy. Test the VML policy using a corpus of test data. For example, you can use the
DLP_Wikipedia_sample.zip file to test your VML policies against. Create a
mechanism to detect incidents. The mechanism can be a Discover scan target of
a local file folder where you place the test data. Or it can be a DLP Agent scan of
a copy/paste operation.

Step 5 Review any incidents. Review any matches at the Incident Snapshot screen. Verify a relatively low
Similarity Score for each match. A relatively low Similarity Score indicates a false
positive. If one or more test documents produce a match with a relatively high
Similarity Score, you have a training set quality issue. In this case you need to
review the content and if appropriate add the document(s) to the positive training
set. You then need to retrain and retune the profile.

See “Log files for troubleshooting VML training and policy detection” on page 586.

Step 6 Adjust the Similarity Review the incidents to determine the highest Similarity Score among the detected
Threshold. false positives that you have tested the profile against. Then, you can adjust the
Similarity Threshold for the profile to be greater than the highest Similarity Score
for the false positives.

For example, if the highest detected false positive has a Similarity Score of 4.5,
set the Similarity Threshold to 4.6. This setting filters the known false positives
from being reported as incidents.

Properties for configuring training

VML includes several property files for configuring VML training and logging. The following
table lists and describes relevant VML configuration properties.

Table 23-13 Property files for VML

Property file at \Protect\config\ Description

MLDTraining.properties Main property file for configuring VML training settings.

See Table 23-14 on page 584.

Manager.properties Property file for the Enforce Server; contains 1 VML setting.

See Table 23-15 on page 585.

 Detecting content using Vector Machine Learning (VML) 584
Configuring VML profiles and policy conditions

Table 23-13 Property files for VML (continued)

Property file at \Protect\config\ Description

MLDTrainingLogging.properties Properties file for configuring VML logging.

See “Log files for troubleshooting VML training and policy
detection” on page 586.

The following table lists and describes the VML training parameters available for configuration
in properties file MLDTraining.properties.

Table 23-14 Relevant configuration parameters for VML training

Parameter Description

minimum_documents_per_category Specifies the minimum number of documents that are

required for each training set (positive and negative). The
default setting is 50. Reducing this number below 50 is
not recommended or supported.

See “Recommendations for training set definition”

on page 589.

mld_num_folds Specifies the number of folds to use for the k-fold

evaluation process. The default is 10.

Reducing this value speeds up the time the system takes

to train against the content because fewer folds are
evaluated. This speed up occurs potentially at the sacrifice
of visibility into profile quality. You don't need to change
this value, unless you have a large number of example
documents (and thus the training sets are very large). Or,
unless you know for certain that you have a
well-categorized overall training set.

See “Recommendations for accepting or rejecting a profile”

on page 592.

minimum_features_to_keep Specifies the minimum number of features to keep for the

profile. The default setting is 1000.

Lowering this value can help reduce the size of the profile.
However, adjusting this setting is not recommended.
Instead, use the memory allocation setting to tune the size
of the profile.

See “Guidelines for profile sizing” on page 591.

 Detecting content using Vector Machine Learning (VML) 585
Configuring VML profiles and policy conditions

Table 23-14 Relevant configuration parameters for VML training (continued)

Parameter Description

significance_threshold Specifies the minimum number of times a word must occur

before it is considered a feature. The default is 2.

Increasing this value (to 3 or 4, for example) may help

reduce the size of the profile because fewer words qualify
as features. You should not adjust this setting unless
setting the memory allocation to "Low" does not produce
a small enough profile for your deployment requirements.

See “Guidelines for profile sizing” on page 591.

stopword_file Specifies the default stopword file

\config\machinelearningconfig\stopwords.txt.

Stopwords are common words, such as articles and

prepositions. During training the system ignores (does not
consider for feature extraction) any word that is contained
in the stopwords file.

If you add words to be ignored, you must use all lower

case because VML feature extraction normalizes the
content to lower case for evaluation.

logging_config_file Specifies the configuration file for standard VML logging.

See “Log files for troubleshooting VML training and policy

detection” on page 586.

native_logging_config_file Specifies the configuration file for native VML logging.

See “Log files for troubleshooting VML training and policy

detection” on page 586.

The following parameter is available for configuration in properties file

MLDTraining.properties.

Table 23-15 Configuration parameter for VML profiles

Parameter Description

DEFAULT_SIMILARITY_THRESHOLD Establishes the default value for the Similarity Threshold,

which is 10. Changing this value affects the default value
only. You can adjust the value using the Enforce Server
administration console.

See “Testing and tuning VML profiles” on page 582.

 Detecting content using Vector Machine Learning (VML) 586
Configuring VML profiles and policy conditions

Log files for troubleshooting VML training and policy detection

The system provides debug log files for troubleshooting the VML training process and policy
detection. The following table lists and describes the debug log files.
See “Troubleshooting policies” on page 408.

Table 23-16 Debug log files for VML

Log file Description

machinelearning_training.log Records the accuracy from training percentage rates for

each fold of the evaluation process for each VML profile
training run.

Examines the quality of each training set at a granular,

per-fold level.

See “Recommendations for accepting or rejecting a

profile” on page 592.

machinelearning_native_filereader.log Records the "distance," which is expressed as a positive

or negative number, and the "confidence," which is a
similarity percentage, for each message evaluated by a
VML policy.

Examines all messages or documents evaluated by VML

policies, including positive matches with similarity
percentages beneath the Similarity Threshold, or
messages the system has categorized as negative
(expressed as a negative "distance" number).

See “Testing and tuning VML profiles” on page 582.

machinelearning_training_native_manager.log Records the total number of features modeled and the

number of features kept to generate the profile for each
training run.
The total number of features modeled versus the number
of features kept for the profile depends on the memory
allocation setting:

■ If "high" the system keeps 80% of the features.

■ If "medium" the system keeps 50% of the features.
■ If "low" the system keeps 30% of the features.

See “Guidelines for profile sizing” on page 591.

 Detecting content using Vector Machine Learning (VML) 587
Best practices for using VML

Best practices for using VML

This section provides best practices for implementing VML policies, including best practices
for testing and tuning your VML policies.
In addition, you can download example VML training set documents from the Symantec Support
Center at http://www.symantec.com/docs/TECH219962. These documents are provided under
the Creative Commons license (http://creativecommons.org/licenses/by-sa/3.0/).
Table 23-17 provides a summary of the VML best practices that are discussed in this section.
It includes links to individual topics for more in-depth recommendations.

Table 23-17 Summary of VML best practices

Functional area Best practice

Recommended Use VML to protect unstructured, text-based content. Do not use VML to protect graphics, binary
uses for VML data, or personally identifiable information (PII).

See “When to use VML” on page 588.

Category of content Define the VML profile based on a single category of content that you want to protect. The
category of content should be derived from a specific business use case. Narrowly defined
categories are better than broadly defined ones.

See “Recommendations for training set definition” on page 589.

Positive training set Archive and upload the recommended (250) number of example documents for the positive
training set, or at least the minimum (50).

See “Guidelines for training set sizing” on page 590.

Negative training Archive and upload the example documents for the negative training set. Ideally the negative
set training set contains a similar number of well-categorized documents as the positive training set.
In addition, add some documents containing generic or neutral content to your negative training
set.

See “Guidelines for training set sizing” on page 590.

Profile sizing Consider adjusting the memory allocation to low. Internal testing has shown that setting the
memory allocation to low may improve accuracy in certain cases.

See “Guidelines for profile sizing” on page 591.

Training set quality Reject the training result and adjust the example documents if either of the base accuracy rates
from training are more than 5%.

See “Recommendations for accepting or rejecting a profile” on page 592.

Profile tuning Perform negative testing to tune the VML profile by using a corpus of testable data.

See “Testing and tuning VML profiles” on page 582.

 Detecting content using Vector Machine Learning (VML) 588
Best practices for using VML

Table 23-17 Summary of VML best practices (continued)

Functional area Best practice

Profile deployment Remove accepted profiles not in use by policies to reduce detection server load. Tune the
Similarity Threshold before deploying a profile into production across all endpoints to avoid
network overhead.

See “Recommendations for deploying profiles” on page 594.

When to use VML

VML is designed to protect unstructured content that is primarily text-based. VML is well-suited
for protecting sensitive content that is highly distributed such that gathering all of it for
fingerprinting is not possible or practical. VML is also well-suited for protecting sensitive content
that you cannot adequately describe and achieve high matching accuracy.
The following table summarizes the recommended uses cases for VML.

Table 23-18 Recommended uses for VML

Use VML when Explanation

It is not possible or practical Often collecting all of the content you want to protect for fingerprinting is an impossible
to fingerprint all the data you task. This situation arises for many forms of unstructured data: marketing materials,
want to protect. financial documents, patient records, product formulas, source code, and so forth.

VML works well for this situation because you do not have to collect all of the content
you want to protect. You collect a smaller set of example documents.

You cannot adequately Often describing the data you want to protect is difficult without sacrificing some
describe the data you want to accuracy. This situation may arise when you have long keyword lists that are hard to
protect. generate, tune, and maintain.

VML works well in these situations because it automatically models the features
(keywords) you want to protect. It enables you to easily manage and update the source
content.

A policy reports frequent false Sometimes a certain category of information is a constant source of false positives.
positives. For example, a weekly sales report may consistently produce false positives for a Data
Identifier policy looking for social security numbers.

VML may work well here because you can train against the content that causes the
false positives and create a policy exception to ignore those features.
Note: The false positive contents must belong to a well-defined category for VML to
be an effective solution for this use case. See “Recommendations for training set
definition” on page 589.
 Detecting content using Vector Machine Learning (VML) 589
Best practices for using VML

When not to use VML

VML is not designed to protect structured data, such as Personally Identifiable Information
(PII), or binary content, such as documents that contain mostly graphics or image files.
The following table summarizes the non-recommended uses of VML.

Table 23-19 Non-recommended uses for VML

Do not use VML to Explanation

Protect personally identifiable Exact Data Matching (EDM) and Data Identifiers are the best option for protecting the
information (PII). common types of PII.

Protect binary files and Indexed Document Matching (IDM) is the best option to protect the content that is
images. largely binary, such as image files or CAD files.

Recommendations for training set definition

A VML category is the specific business use case from which you derive your example
documents for training the VML profile. The more specific the category the better the detection
results. For example, the category "Financial Documents" is not recommended because it is
too broad. A better category classification is "Sales Forecasts" or "Quarterly Earnings" because
each is particular to a specific business use case.
A VML category contains two sets of training content: positive and negative. The positive
training set contains content you want to protect; the negative training set contains content
you want to ignore. You should derive both the positive and negative training sets from the
same category of content such that all documents are thematically related.
Using an entirely generic content for the negative training set, while possible, is not
recommended. While generic content produces good design-time training accuracy rates, you
cannot detect the content you want to protect at run-time with sufficient accuracy.

Note: While a completely generic negative training set is not recommended, seeding the
negative training set with some neutral-content documents does have value. See “Guidelines
for training set sizing” on page 590.

The following table provides some example categories and possible positive and negative
training sets comprising those categories.
 Detecting content using Vector Machine Learning (VML) 590
Best practices for using VML

Table 23-20 Some example categories and training sets

Category Positive training set Negative training set

Product source code Proprietary product source code Source code from open source
projects

Product formulas Proprietary product formulas Non-proprietary product information

Quarterly earnings Pre-release earnings; sales estimates; Details of published annual accounts
accounting documents

Marketing plans Marketing plans Published marketing collateral and

advertising copy

Medical records Patient medical records Healthcare documents

Customer sales Customer purchasing patterns Publicly available consumer data

Mergers and acquisitions Confidential legal documents; M&A Publicly available materials; press
documents releases

Manufacturing methods Proprietary manufacturing methods Industry standards

and research

Guidelines for training set sizing

VML is only as accurate as the example content you train. To use VML you do not have to
locate all the data you want to protect, nor do you have to describe it. Instead, your sample
documents must accurately represent the type of content you want to protect They must also
represent content that you want to ignore. This content must be thematically related to the
positive content.
Higher numbers of example documents collected for training yield more accurate VML profiles.
A well-defined category of content contains 500 example documents: 250 positive and 250
negative. The minimum number of documents per training set is 50.
Ideally, you collect a similar number of negative and positive documents for training. You
should seed the negative training set with generic or neutral-content documents. The archive
file DLP_Wikipedia_sample.zip that is attached to this guide at the Symantec Support Center
is provided for this purpose.
As an example, your positive training set contains 250 example documents and your negative
training set contains 150 documents. You can add 100 to 200 generic documents to your
negative training set from the DLP_Wikipedia_sample.zip archive file. Internal testing has
shown that adding generic content to complement a well-defined negative training set can
improve accuracy for VML.
 Detecting content using Vector Machine Learning (VML) 591
Best practices for using VML

If you cannot collect enough positive documents to meet the minimum requirement, you can
upload the under-sized training set multiple times. For example, consider a case where you
have the category of content "Sales Forecasts." For this category you have collected 25 positive
spreadsheets and 50 negative documents. In this case, you can upload the positive training
set twice to reach the minimum document threshold and equal the number of negative
documents. Note that you should use this technique for development and testing purposes
only. Production profiles should be trained against at least the minimum number of documents
for both training sets.
Table 23-21 lists the optimal, recommended, and minimum number of documents to include
in each training set.

Note: These training set guidelines assume an average document size of 3 KB. If you have
larger-sized documents, fewer in number may be sufficient.

Table 23-21 Training set size guidelines

Training set Minimum Recommended

Positive example documents 50 250

Negative example documents 50 250

Total number of documents for the

100 500
category

Recommendations for uploading documents for training

While you can upload individual documents to the Enforce Server for training, it is recommended
that you upload a document archive (ZIP, RAR, TAR) that contains the example documents
for each training set. The maximum upload size is 30 MB. There is no training set size limit.
To gather the documents for training, it is recommended that you create a staging area. For
example, consider a category called "Sales Reports." In this case you would create a folder
called \VML\training_stage\sales_reports that represents the category. Within this folder
you would create two subfolders, one for the positive training set and the other for the negative
training set (for example: \VML\training_stage\sales_reports\positive). When you are
ready to train the profile, you compress the positive subfolder and the negative subfolder into
separate document archives. You can partition the training set across archives if you have
more than 30 MB of data to upload for a training set. Do not embed an archive within an archive.

Guidelines for profile sizing

Before you train a VML profile, you can adjust the amount of memory allocated to the profile.
The amount of memory you allocate determines how many features the system models, which
 Detecting content using Vector Machine Learning (VML) 592
Best practices for using VML

in turn affects the size of the profile. The higher the memory allocation setting, the more in-depth
the feature extraction and the plotting of the model, and the larger the profile. In general, for
server-based policy detection, the recommended memory allocation setting is high, which is
the default setting.
On the endpoint, the VML profile is deployed to the host computer and loaded into memory
by the DLP Agent. (Unlike EDM and IDM, VML does not rely on two-tier detection for endpoint
policies.) Because memory on the endpoint is limited, the recommendation is to allocate low
or medium memory for endpoint policies. Internal testing has shown that reducing the memory
allocation does not reduce the accuracy of the profile and may improve accuracy in certain
situations.

Table 23-22 Memory allocation recommendations

Memory allocation Description

High Default setting generally appropriate for server-based detection.

Medium Use this setting to reduce the size of the profile.

Low Use this setting for endpoint detection.

Recommendations for accepting or rejecting a profile

When you train a VML profile against the category content, the system selects features, creates
the model, and calculates the base accuracy rates for false positives and negatives. Base
accuracy rates are calculated using a standard and generally accepted process called k-folds
evaluation. The base accuracy rates provide you with an early indicator of the quality of your
category training sets.
To illustrate how the k-folds evaluation process works, assume that you have a category with
500 total example documents: 250 positive and 250 negative. During the training run, the
system divides the training set into 10 folds. Each fold is a distinct subset of the overall training
set and contain both positive and negative example documents. The system uses nine folds
to generate a VML profile, and one fold to test the profile. Any of the folds can become the
test fold for the first round of evaluation. For the next round, the next fold in the queue becomes
the test fold. This process repeats for all 10 folds. The system performs a final training run
called the cross-fold, averages the results of all folds, and generates the final model.
On successful completion of the training process, the system displays the averaged accuracy
rates and prompts you to accept or reject the training profile. The false positive accuracy rate
is the percentage of negative test documents that are misclassified as positive. The false
negative rate is the percentage of positive test documents that are misclassified as negative.
As a general guideline, you should reject the training profile if either rate is more than 5%.
 Detecting content using Vector Machine Learning (VML) 593
Best practices for using VML

Note: You can use the log file machinelearning_training.log to evaluate per-fold training
accuracy rates.
See “Log files for troubleshooting VML training and policy detection” on page 586.

Guidelines for accepting or rejecting training results

You decide to accept or reject a training profile based on the false positive and false negative
percentages that the system displays to you at the end of the training process.
See “About the Similarity Threshold and Similarity Score” on page 567.
To better understand how the system calculates the Machine Learning Profile training set
accuracy rates, consider the following example.
You have a training set that includes 1000 documents, 500 positive and 500 negative. When
you train the profile, the system takes 90% of the documents, extracts the features, and creates
a model. It takes the remaining 10% of the documents and evaluates their features against
the model for similarity. It then produces false positive and false negative accuracy rates. This
process is known as the "fold." For each training set, the system evaluates ten folds, each
time comparing a different 10% of the documents against the 90%. At the end of the cycle,
the system performs a cross-fold evaluation of all ten folds. It then produces an average
accuracy percentage rate for both the positive and negative categories.
Assume that the result of the training process yields a base false positive rate of approximately
1.2% and a base false negative rate of approximately 1%. On average, 1.2% of the negative
documents in the training set are mis-categorized as positive, and 1% of the documents in the
training set are mis-categorized as negative. While the goal is 0% for both rates, in general a
percentage rate under 5% for each category is acceptable.
The percentages that are produced at the end of the training process are averages across the
10 folds. So, rather than relying on the general 5% rule of thumb, the better practice is to review
the percentage rate results for each fold. To review the percentage rates, examine the log file
\SymantecDLP\Protect\logs\debug\mld0.log. As shown below, the individual fold rates
give a reading for each of the ten folds on which you can base your decision to accept or reject
the profile.

Table 23-23 Training set accuracy evaluation process

Fold evaluation Per fold category accuracy rates and cross-fold averages

Fold 0 false positive rate 2.013422727584839 false negative rate 0.0

Fold 1 false positive rate 1.3513513803482056 false negative rate 1.7857142686843872

Fold 2 false positive rate 1.3513513803482056 false negative rate 0.8928571343421936

Fold 3 false positive rate 1.3513513803482056 false negative rate 1.7857142686843872

 Detecting content using Vector Machine Learning (VML) 594
Best practices for using VML

Table 23-23 Training set accuracy evaluation process (continued)

Fold evaluation Per fold category accuracy rates and cross-fold averages

Fold 4 false positive rate 1.3513513803482056 false negative rate 0.8928571343421936

Fold 5 false positive rate 1.3513513803482056 false negative rate 2.6785714626312256

Fold 6 false positive rate 0.0 false negative rate 0.0

Fold 7 false positive rate 0.6756756901741028 false negative rate 0.0

Fold 8 false positive rate 1.3513513803482056 false negative rate 0.8928571343421936

Fold 9 false positive rate 1.3513513803482056 false negative rate 1.8018018007278442

Cross-fold Avg False Positive Rate 1.214855808019638 Avg False Negative Rate
1.0730373203754424

Recommendations for deploying profiles

Accepted VML profiles are transferred to every detection server and Symantec DLP Agent
even if those profiles are not required by the active policies on that server or endpoint. Detection
servers load all VML profiles into memory regardless of whether or not any associated VML
policies are deployed to those servers. DLP Agents only load the VML profiles that are required
by an active policy. To optimize server performance, it is recommended not to deploy (accept)
unnecessary VML profiles and remove any accepted (deployed) VML profiles that are not
required by active policies.
In addition, when you change the Similarity Threshold, the system re-syncs the entire profile
with the detection servers and DLP Agents. If you have a large VML profile and possible
bandwidth limitations (for example, deployment to many endpoints), this may cause network
congestion. In this case you should test and tune the profile at a select few endpoints before
deploying the profile into production at every endpoint on your network.
 Chapter 24
Detecting content using
Form Recognition -
Sensitive Image Recognition
This chapter includes the following topics:

■ About Form Recognition detection

■ Configuring Form Recognition detection

■ Managing Form Recognition profiles

■ Advanced server settings for Form Recognition

■ Viewing a Form Recognition incident

About Form Recognition detection

Form Recognition provides the ability to detect forms that contain sensitive information, such
as tax forms, medical forms, insurance forms, and so on.
Form Recognition detects form images in a variety of image formats, including the following:
■ PDF (version 1.2 and later only)
■ PDF that use AcroForms format
■ XFA (Only the hard-copy image, or the image that you would see if you printed the form,
is supported. Soft copies, such as fillable forms, are not supported. Text extraction from
XFA is also not supported
■ JPEG (.jpg, .jpeg)
■ PNG
 Detecting content using Form Recognition - Sensitive Image Recognition 596
Configuring Form Recognition detection

■ TIFF (single page or multi-page, .tif or .tiff)

■ Bitmap (.bmp, .dib)
Form Recognition is available for Network Monitor, Network Prevent for Email, Network Prevent
for Web, and Network Discover. Form Recognition is not available for Endpoint Discover,
Endpoint Prevent, or any cloud detectors.
See “Configuring Form Recognition detection” on page 596.

How Form Recognition works

Symantec Data Loss Prevention analyzes the features of your blank forms and stores the
results as key points in the Form Recognition profile. This process is called indexing. Then
the detection server compares images in network traffic or stored in data repositories to the
forms you have indexed. The extent that the detected form matches key points in indexed
blank form is called the alignment. By default, 85% of the key points must match or align for
the form to be considered a match.
The comparison between the detected image and the indexed blank form also allows Symantec
Data Loss Prevention to determine how much of the form has been filled in. The fill threshold
is represented as a range from 1-10, where 1 is a minimally filled-in form, and 10 is an entirely
filled-in form. You use the fill threshold to specify when Symantec Data Loss Prevention creates
an incident. A low fill threshold creates more incidents by detecting partially filled-in,
electronically fillable forms with at least one check-box filled, or incomplete forms. A high fill
threshold creates fewer incidents, but may not catch all possible data loss. A fill threshold of
0 detects all matching forms, including blank forms. By default, the fill threshold for a Form
Recognition profile is 1. You can specify another value when you create a profile. You can
also adjust this value for an existing profile to fine-tune your detection results.
See “Configuring Form Recognition detection” on page 596.
See “Managing Form Recognition profiles” on page 600.

Configuring Form Recognition detection

To configure Form Recognition, you collect a blank set of forms that you want to protect and
add them to a ZIP archive of single-page PDF files. This ZIP archive is called a Gallery Archive.
You then upload your gallery archive to a Form Recognition profile on the Enforce Server for
indexing. The Enforce Server indexes your forms and pushes the index out to your detection
servers. You also specify the fill threshold for the profile: the fill threshold specifies how much
of the form must be filled to trigger an incident.
Table 24-1 provides a high-level workflow for configuring Form Recognition detection:
 Detecting content using Form Recognition - Sensitive Image Recognition 597
Configuring Form Recognition detection

Table 24-1 Form Recognition workflow

Step Action More information

1 Collect and prepare blank copies of the forms you want to protect. See “Preparing a Form Recognition
Gallery Archive” on page 597.

2 Configure a Form Recognition profile. Specify the Gallery Archive See “Configuring a Form Recognition
with the forms you want to detect and a Fill Threshold for creating profile” on page 598.
incidents.

3 Configure a policy with a Form Recognition detection or exception See “Configuring the Form Recognition
rule using your Form Recognition profile. detection rule” on page 599.

See “Configuring the Form Recognition

exception rule” on page 600.

Preparing a Form Recognition Gallery Archive

The Form Recognition gallery archive is a ZIP archive containing single-page PDF copies of
the blank forms you want to protect. You use the gallery archive to create a Form Recognition
profile.
Symantec recommends that you index no more than 500 total images across all Form
Recognition profiles. To improve performance, Symantec recommends creating fewer profiles
that contain more forms, rather than more profiles that contain fewer forms.
For best results, ensure that the form images in your gallery archive meet the following
guidelines:
■ The PDF files containing the form images should be at least 200 DPI.
■ Forms with electronically fillable fields must be in ArcroForm format. Other interactive form
formats are not supported for detection.
■ Each form should have a sufficient amount of text and graphical content. Sparse forms
may cause more false matches.
■ Each form should contain unique content. Forms that share very similar content are harder
to match and may cause more false matches. For example, tax forms from 2014 and 2015
would share many similar features, and would be difficult to detect if they were in the same
profile.
■ Each form should have content evenly distributed across the page. Forms with clustered
content and sparse areas are more difficult to match.
■ Each form should have either white or light-colored backgrounds. Black or dark backgrounds
are not supported.
 Detecting content using Form Recognition - Sensitive Image Recognition 598
Configuring Form Recognition detection

To prepare a Form Recognition Gallery Archive

1 Collect blank copies of the forms you want to detect.
2 Save all blank copies of forms as PDF files. Consider the following guidelines as you
prepare PDF files:
■ The gallery must only contain PDF files. Symantec Data Loss Prevention ignores any
other folders and files in the ZIP archive.
■ If a form has two or more pages, separate them into single-page files, then convert to
PDF format.
For example, if your form is a single three-page Microsoft Word file titled
YourForm.docx, separate the file into three separate single-page files, then convert
them to PDF:
■ YourForm_1of3.PDF

■ YourForm_2of3.PDF

■ YourForm_3of3.PDF

■ If your form contains electronically fillable fields, use a PDF editing tool for the
conversion process that retains AcroForms formatting, for example Adobe Acrobat.
■ If your form includes several pages of un-fillable boilerplate, only add the fillable pages
to your gallery archive.

3 Add all single-page PDF files to a ZIP archive.

Configuring a Form Recognition profile

Configure a Form Recognition profile by uploading a Gallery Archive and specifying a Fill
Threshold.
See “Preparing a Form Recognition Gallery Archive” on page 597.
To configure and index a Form Recognition profile
1 Navigate to Manage > Data Profiles > Form Recognition to display the Form
Recognition Profiles screen.
2 Click Add Profile to display the Configure Form Recognition Profile.
3 Enter a name for the profile in the Name field.

Note: The name you enter is used when you configure policies and appears in the incident
snapshot for Form Recognition incidents.

4 (Optional) Enter a description for the profile in the Description field.

 Detecting content using Form Recognition - Sensitive Image Recognition 599
Configuring Form Recognition detection

5 Enter a value in the Fill Threshold field.

The fill threshold is a range from 1-10, where 1 represents a form that has been filled in
minimally, and 10 a form that has been filled in completely. You can also enter 0 to detect
blank forms.

Note: For electronically filled forms, entering 1 for the fill threshold detects any electronically
filled item on a form. For example, setting the threshold to 1 detects a single selected
check-box. In contrast, setting the threshold to 1 may not detect a similar check-box that
has been filled in using a pen.

6 Upload the gallery archive by clicking Browse and selecting the gallery archive ZIP file.
7 Click Save to begin indexing the profile.
When the gallery completes indexing, you can use it to configure a Form Recognition rule
in a policy.
See “Configuring the Form Recognition detection rule” on page 599.

Configuring the Form Recognition detection rule

You configure the detection rule by specifying a Form Recognition profile.
See “Configuring a Form Recognition profile” on page 598.
The indexed forms in the profile are compared against detected forms to determine if the forms
match. The Form Recognition rule matches on attachments only.
To configure the Form Recognition detection rule
1 Go to Manage Policies > Policy List, click New, and create a new blank policy or policy
from a template.
See “Adding a new policy or policy template” on page 375.
2 Click Add Rule on the Detection tab to display the Configure Policy - Add Rule.
3 Select Detect using Form Recognition Profile in the the Form Recognition section
and select the Form Recognition profile that contains the forms you want to protect.
4 Click Next to display the Configure Policy - Edit Rule page.
5 Enter a name for the rule in the Rule Name field.
6 Choose the rule severity.
See “Policy severity” on page 333.
 Detecting content using Form Recognition - Sensitive Image Recognition 600
Managing Form Recognition profiles

7 Select the conditions for the Form Recognition detection rule.

You can use the Also Match field to configure compound match conditions. See
“Compound conditions” on page 356.
8 Click OK to add the detection rule.
9 Click Save to apply the detection rule to the policy.
The new policy displays in the Policy List.

Configuring the Form Recognition exception rule

You configure the exception rule by specifying a Form Recognition profile.
See “Configuring a Form Recognition profile” on page 598.
To configure the Form Recognition exception rule
1 Go to Manage Policies > Policy List, click New, and create a new blank policy or policy
from a template.
See “Adding a new policy or policy template” on page 375.
2 Click Add Exception on the Detection tab to display the Configure Policy - Add
Exception.
3 Select Detect using Form Recognition Profile in the Form Recognition section and
select the Form Recognition profile that contains the forms you want to protect.
4 Click Next to display the Configure Policy - Edit Exception page.
5 Enter a name for the exception in the Exception Name field.
6 Select the conditions for the Form Recognition detection rule.
You can use the Also Match field to configure compound match conditions. See
“Compound conditions” on page 356.
7 Click OK to add the exception rule.
8 Click Save to apply the detection rule to the policy.
The new policy displays in the Policy List.

Managing Form Recognition profiles

The Form Recognition Profiles screen (Manage > Data Profiles > Form Recognition) to
provides a summarized view of all Form Recognition profiles. You can use this screen to
confirm that a profile was indexed successfully, view the indexing status, and so on.
 Detecting content using Form Recognition - Sensitive Image Recognition 601
Managing Form Recognition profiles

Table 24-2 Form Recognition Profiles details

Element Description

Add Profile Click Add Profile to configure a new Form Recognition profile.
See “Configuring a Form Recognition profile” on page 598.

Show Entries Select a value from Show Entries to specify the number of profiles
you can view on this page.

Page navigation You can use the following buttons to change the view of profiles:

■ Click Last to view profiles with the most recent dates in ascending
order.
■ Click a number to navigate to that specific page number.
■ Click Next to view the next page.
■ Click Previous to view the previous page.

Profile Name Click the Profile Name to view or edit the profile.
Note: You can sort column data in ascending order (A-Z/1-3) by
clicking the up arrow or descending order (Z-A/3-1) by clicking the
down arrow.

Description The profile description. You can edit the description by clicking the
profile name or the pencil icon in the Actions column.

State Each profile displays one of the following states:

■ Gallery missing or invalid displays when indexing for the profile

failed. The gallery did not upload because the ZIP archive is invalid.

■ Indexing not started displays when indexing for the profile did not
start. The uploaded gallery did not process.
■ Indexing in progress displays when the uploaded gallery is
indexing.
■ Profile indexed displays when indexing for this profile is complete
and the index successfully created.
■ Invalid gallery displays when indexing for the profile failed. The
uploaded gallery did not start indexing because it is invalid.
■ Index contains no images displays when indexing for the profile
failed. The uploaded gallery did not index because it contains no
compatible files.
■ Indexing failed displays when indexing for this profile failed. The
uploaded gallery was not indexed.
■ Indexing found some unusable files displays when indexing for
the profile completes with errors. Some of the files in the uploaded
gallery cannot be indexed.
 Detecting content using Form Recognition - Sensitive Image Recognition 602
Advanced server settings for Form Recognition

Table 24-2 Form Recognition Profiles details (continued)

Element Description

Gallery The gallery archive name.

You cannot edit the gallery name. You can upload a new gallery or an
existing gallery that has been renamed by clicking the profile name or
the pencil icon in the Actions column.

Usable Forms Count The total number of form images in the gallery that have been indexed
without errors and can be used in a policy.

Date Indexed The date when the profile was last indexed.

Index Version The version number of the index.

Fill Threshold The fill threshold value you provided when you configured the Form
Recognition profile. You can edit this value by clicking the profile name
or the pencil icon in the Actions column.

Actions Click the Pencil to edit profile details.

Click the red X to delete a profile. If you delete a profile, the system
removes the profile metadata and gallery from the Enforce Server.

Advanced server settings for Form Recognition

Some of the default Form Recognition server settings might require testing and fine-tuning to
determine what works best for your needs. You can modify these settings on the System >
Servers and Detectors > Overview > Server/Detector Detail - Advanced Settings page.
Symantec recommends that you contact Symantec Technical Support before modifying any
advanced server settings.
There are nine advanced settings related to Form Recognition:
■ ContentExtraction.ImageExtractorEnabled
■ ContentExtraction.MaxNumImagesToExtract
■ FormRecognition.ALIGNMENT_COEFFICIENT
■ FormRecognition.CANONICAL_FORM_WIDTH
■ FormRecognition.MAXIMUM_FORM_WIDTH
■ FormRecognition.MINIMUM_FORM_ASPECT_RATIO
■ FormRecognition.MINIMUM_FORM_WIDTH
■ FormRecognition.OPENCV_THREADPOOL_SIZE
 Detecting content using Form Recognition - Sensitive Image Recognition 603
Viewing a Form Recognition incident

■ FormRecognition.PRECLASSIFIER_ACTION
You can see details about these settings here:
See “Advanced server settings” on page 245.

Viewing a Form Recognition incident

You view and remediate Form Recognition incidents as you would any Symantec Data Loss
Prevention incident. See “About incident remediation” on page 1294.
In addition to the usual incident snapshot information, Form Recognition incidents include:
■ Yellow highlighted areas on the form, which indicate form elements that align and electronic
fields that have been filled.
■ Orange highlighted areas on the form, indicating questionable areas.
■ A Similarity Score which indicates how similar the form elements are. The higher the
score, the more statistically similar the field contents are to the form fields.
 Chapter 25
Detecting Content using
OCR - Sensitive Image
Recognition
This chapter includes the following topics:

■ About content detection with OCR Sensitive Image Recognition

■ OCR Server system requirements

■ Using the OCR Server Sizing Estimator spreadsheet

■ Setting up OCR Servers

■ Installing an OCR Sensitive Image Recognition license

■ Creating an OCR configuration

■ Using the OCR engine

■ More about languages and Dictionaries

■ Viewing OCR incidents in reports

About content detection with OCR Sensitive Image

Recognition
OCR Sensitive Image Recognition provides the capability to extract text from images (scanned
documents, screen shots, pictures, and so on) and from PDFs, enabling you to use new or
preexisting text-based detection rules on this content.
 Detecting Content using OCR - Sensitive Image Recognition 605
About content detection with OCR Sensitive Image Recognition

Note: Image extraction from Microsoft Office files is not supported.

The extracted text then enters the detection chain and is processed identically to conventionally
extracted text. Incident snapshots for OCR text are similar to those for conventionally extracted
text: the text excerpt is displayed, with the detected words highlighted. OCR incidents have
visual indicators denoting that the text came from OCR, and a thumbnail of the original image.
You can set up OCR to use various languages. To improve recognition results, you can also
choose a specialized dictionary (such as legal, financial, or medical) to enable supplemental
spell checking. You can also set up a customized dictionary to deal with proper nouns or other
terms specific to your business.
While OCR content extraction can integrate with both Windows and Linux detection servers,
Symantec supports installing the OCR Server on Windows servers only. OCR content extraction
is not supported on the Windows Agents, macOS Agents, the Data Loss Prevention cloud
services, or the Data Loss Prevention appliances (both virtual and physical). For information
on supported versions of Windows servers, see the Symantec Data Loss Prevention System
Requirements Guide at
http://www.symantec.com/docs/DOC10602

Note: Symantec Data Loss Prevention OCR Sensitive Image Recognition is introduced in
version 15.0, but the OCR Server version is not tied to any Symantec Data Loss Prevention
release and may be updated independently.

See “Installing an OCR Sensitive Image Recognition license” on page 607.

Detection types supported for OCR extraction

The following detection types are supported for OCR extraction:
■ Network Monitor
■ Network Prevent for Email
■ Network Prevent for Web
■ Network Discover

File types supported for OCR extraction

Images of the following file types are extracted and sent to OCR:
■ JPEG (.jpg, .jpeg)
■ PNG
 Detecting Content using OCR - Sensitive Image Recognition 606
OCR Server system requirements

■ TIFF (single page or multi-page, .tif or .tiff)

■ Bitmap (.bmp)
■ Images extracted from PDF files, such as pages from a scanned document.

OCR Server system requirements

The OCR Server has specific hardware, operating system, and server settings requirements,
different from the Data Loss Prevention Enforce Server and detection servers. You can find
the latest information on these requirements at the Symantec Support Center at
http://www.symantec.com/docs/doc10612.html
See “Using the OCR Server Sizing Estimator spreadsheet” on page 606.

Using the OCR Server Sizing Estimator spreadsheet

The OCR Server Sizing Estimator spreadsheet can help you to estimate how many OCR
Servers you need for each detection server in your deployment. The spreadsheet and directions
on how to use it are available at the Symantec Support Center at
http://www.symantec.com/docs/doc10612.html
See “Setting up OCR Servers” on page 606.

Setting up OCR Servers

OCR content extraction also requires installation of an OCR Server. You configure the OCR
Server (micro service) from the Enforce Server administration console. Symantec recommends
that you install the OCR Server on dedicated hardware, because of its high processing
requirements. A certificate for communication between the OCR client on the Enforce Server
and the OCR Server is also required.
The OCR Server is an independent server, separate from any Data Loss Prevention detection
server. You can configure the detection server to talk to an OCR address (IP address or host
name). That address can either be a single OCR Server, or a single load balancer in front of
several OCR Servers. You can use an external load balancer or another technology, such as
Windows Network Load Balancing.
Note: A detection server can only be configured with a single OCR Server address: the IP
address or hostname for a single OCR Server or the virtual IP address for a load balancer (or
pair of load balancers) that is front-ending multiple OCR Servers. If you want to configure a
detection server to communicate with a pool of OCR Servers, the detection server is limited
to supporting configuration of a single OCR Server address. Multiple OCR Servers need to
be front-ended by a load balancer that provides that single address.
 Detecting Content using OCR - Sensitive Image Recognition 607
Installing an OCR Sensitive Image Recognition license

In the single OCR Server case, it can be installed on a separate computer, or on the same
computer as the detection server (not recommended). Configuration information is included
with the request, so OCR Servers can service requests from different detection servers that
are configured differently.
For example, you can configure one detection server to detect English with the highest possible
OCR accuracy. Then, you can configure another detection server to detect Japanese, with
the highest possible speed. In this case, the same OCR Server is able to handle both types
of requests. Symantec recommends that you install the OCR Server on a computer separate
from the detection server. However, Symantec supports co-locating of the OCR Server with
a detection server.
You install an OCR Server using the Symantec DLP OCR Server Installer setup wizard.
To install an OCR Server
1 Open the OCR Server Installer.
2 Double click OCRServerInstaller64.
3 Click Next.
4 Select desired Destination directory. Click Next. The installer runs.
5 Click Finish when the installation is complete.
Now the OCR service is running and is ready to receive OCR requests.
See “Creating an OCR configuration” on page 607.

Installing an OCR Sensitive Image Recognition license

When you first purchase Symantec Data Loss Prevention, upgrade to a later version, or
purchase additional product modules, you must install one or more Symantec Data Loss
Prevention license files. License files have names in the format name.slf.
See Installing a new license file for more information on adding a license to Symantec Data
Loss Prevention.
See “OCR Server system requirements” on page 606.

Creating an OCR configuration

Adding an OCR profile
1 Go to System > Settings > OCR Engine Configuration.
2 Click Add OCR Engine Configuration.
 Detecting Content using OCR - Sensitive Image Recognition 608
Creating an OCR configuration

Configuring the OCR Engine

1 Enter the Name of the profile.
2 Enter an optional Description of the profile.
3 Enter the OCR server hostname of the server where the OCR requests should be sent.
It can be a single load balancer or an individual OCR Server.
4 Enter the Port number of the port where requests should be sent. The default port is 8555.
5 Enter the OCR Engine timeout (seconds) value. This setting defines how long before
an OCR request should be timed out. The default timeout is 30.
The timeout is how much time the request is allowed to spend inside the OCR Server,
and does not include transit time or other delays.
The timeout needs to be set with the other content timeout settings in the Advanced
Settings. As with other content extraction operations, if the timeout is reached, the OCR
component is skipped and the previously extracted content moves on to detection.

6 Enter a value for Accuracy vs speed. By default, the OCR Server sets the value
dynamically for each document. A Sensitive Image Recognition pre-classifier is present
on the detection server. This pre-classifier inspects each image and determines if it is
suitable for OCR content extraction (and form recognition). It then determines which preset
is most appropriate. If you uncheck this box, you can select a preset to use for all images.
You can choose from Accurate, Balanced, or Fast. This strategy can be appropriate for
Discover scans, where accuracy is prioritized over time.
7 In the Supported Languages section, select the candidate languages for OCR.
You can select one or more languages, and then the OCR Server selects a language
from that pool to use for the image. Symantec assumes that documents are primarily one
language (for example, all French, or all English, as opposed to mixed English and French).
The number of languages should be as small as possible. The more languages you select,
the slower the processing speed.
Even if a language is not selected, you may still get accurate text from that language. For
example, you can select English and German and submit a mixed English-French image
the OCR Server. It may choose English and still return some French text. The language
selection affects which spell-check dictionary to use. It also affects the pool of characters
to choose from if a character in the image is unclear.
8 In the Languages and Dictionaries Specialized Dictionaries section, you enable
supplemental spell checking for different businesses (legal, financial, medical) across
different languages.
 Detecting Content using OCR - Sensitive Image Recognition 609
Using the OCR engine

9 In the Languages and Dictionaries Custom Dictionary section, specify the name of
your custom dictionary file to aid recognition accuracy. For example, if certain proper
nouns give the OCR Server difficulty, you can place them in this custom dictionary.
Using Dictionaries and spell checking improves recognition results for low-quality scans
and images (such as faxes). If the characters are crisp and clean, the engine has less
uncertainty about what they might be, and the Dictionaries are less useful.
10 The custom dictionary is a text file, with one entry per line. This text file must be placed
in the dictionary directory of each server at c:\SymantecDLPOCR\Protect\bin.
Assign a profile to a detection server
1 Go to System > Servers and Detectors > Overview.
2 Select a monitor.
3 On the Server/Detector Detail page, click Configure.
4 On the Configure Server page, click OCR Engine. In OCR Engine Configuration select
the configuration that you want to use for the server.
5 Click Save.
See “Using the OCR engine” on page 609.

Using the OCR engine

You can see all of your OCR configurations and add an OCR Engine configuration on the OCR
Engine Configuration page. On this page you can
■ Click Add OCR Engine Configuration to add a new configuration.
■ Click the name of the configuration or the pencil icon to edit an existing configuration.
■ Click the red X to delete a configuration.
See “About content detection with OCR Sensitive Image Recognition” on page 604.
See “Viewing OCR incidents in reports” on page 611.

More about languages and Dictionaries

Instead of choosing from a pool of languages, the OCR Server assumes that all selected
languages may be in the image. This is a good strategy for the mixed language document use
case, but selecting more than four languages is not recommended, as it can adversely affect
both speed and accuracy.
 Detecting Content using OCR - Sensitive Image Recognition 610
More about languages and Dictionaries

Specialized Dictionaries available for OCR content extraction

The following specialized Dictionaries are available for OCR content extraction:
■ Dutch Legal Dictionary
■ Dutch Medical Dictionary
■ English Financial Dictionary
■ English Legal Dictionary
■ English Medical Dictionary
■ French Legal Dictionary
■ French Medical Dictionary
■ German Legal Dictionary
■ German Medical Dictionary

Languages supported for OCR extraction

The following languages are supported for OCR extraction:
■ Arabic
■ Chinese (Simplified)
■ Chinese (Traditional)
■ Czech
■ Danish
■ Dutch
■ English
■ Finnish
■ French
■ German
■ Greek
■ Hungarian
■ Italian
■ Japanese
■ Korean
■ Norwegian
 Detecting Content using OCR - Sensitive Image Recognition 611
Viewing OCR incidents in reports

■ Polish
■ Portuguese
■ Portuguese (Brazilian)
■ Romany
■ Russian
■ Spanish
■ Swedish
■ Turkish
Other languages can be detected if they use supported character sets.

Viewing OCR incidents in reports

OCR incidents are flagged and detected text is highlighted in yellow in incident reports.
Thumbnails of the page are included in the incident. Clicking on the thumbnail enables you to
view a larger version of the image. This image contains the extracted text that violates the
Symantec Data Loss Prevention policy.
 Chapter 26
Detecting content using
data identifiers
This chapter includes the following topics:

■ Introducing data identifiers

■ Configuring data identifier policy conditions

■ Modifying system data identifiers

■ Creating custom data identifiers

■ Best practices for using data identifiers

Introducing data identifiers

Symantec Data Loss Prevention provides data identifiers to detect specific instances of
described content. Data identifiers let you quickly implement precise, short-form data matching
with minimal effort.
Data identifiers are algorithms that combine pattern matching with data validators to detect
content. Patterns are similar to regular expressions but more efficient because they are tuned
to match the data precisely. Validators are accuracy checks that focus the scope of detection
and ensure compliance.
For example, the "Credit Card Number" system data identifier detects numbers that match a
specific pattern. The matched pattern is validated by a "Luhn check," which is an algorithm.
In this case the validation is performed on the first 15 digits of the number that evaluates to
equal the 16th digit.
Symantec Data Loss Prevention provides pre-configured data identifiers that you can use to
detect commonly used sensitive data, such as credit card, social security, and driver's license
numbers. Most data identifiers come in three breadths—wide, medium, and narrow—so you
 Detecting content using data identifiers 613
Introducing data identifiers

can fine-tune your detection results. Data identifiers offer broad support for detecting
international content.
If a system-defined data identifier does not meet your needs, you can modify it. You can also
define your own custom data identifiers to detect any content that you can describe.
See “System-defined data identifiers” on page 613.
See “Selecting a data identifier breadth” on page 629.

System-defined data identifiers

Symantec Data Loss Prevention provides several system-defined data identifiers to help you
detect and validate pattern-based sensitive data.

Table 26-1 System data identifiers

Category Description

Personal Identity Detect various types of identification numbers for the regions of Africa, Asia Pacific, Europe,
North America, and South America.

See Table 26-2 on page 614.

See Table 26-3 on page 614.

See Table 26-4 on page 615.

See Table 26-5 on page 618.

See Table 26-6 on page 619.

Financial Detect financial identification numbers, such as credit card numbers and ABA routing numbers.

See Table 26-7 on page 620.

Healthcare Detect U.S. and international drug codes, and other healthcare-related pattern-based sensitive
data.

See Table 26-8 on page 620.

Information Detect IP addresses.

Technology
See “Information technology data identifiers” on page 621.

International International keywords for PII data identifiers.

keywords
See “International keywords for PII data identifiers” on page 621.
 Detecting content using data identifiers 614
Introducing data identifiers

Personal identity data identifiers

Symantec Data Loss Prevention provides various data identifiers for detecting personally
identifiable information (PII) for the regions of Africa, Asia Pacific, Europe, North America, and
South America.
Table 26-2 lists system-defined data identifiers for the Middle East and Africa region.

Table 26-2 African personal identity

Data identifier Description

South African Personal Identification Number See “South African Personal Identification Number”
on page 1023.

Table 26-3 lists system-defined data identifiers for the Asia Pacific region.

Table 26-3 Asia Pacific personal identity

Data identifier Description

Australian Business Number See “Australian Business Number wide breadth”

on page 804.

Australian Company Number See “Australian Company Number” on page 805.

Australian Passport Number See “Australian Passport Number” on page 810.

Australian Tax File Number See “Australian Tax File Number” on page 812.

China Passport Number See “China Passport Number” on page 849.

Hong Kong ID See “Hong Kong ID” on page 916.

Indian Aadhaar Card Number See “Indian Aadhaar Card Number” on page 939.

Indian Permanent Account Number See “Indian Permanent Account Number” on page 941.

Indonesian Identity Card Number See “Indonesian Identity Card Number” on page 942.

Israel Personal Identification Number See “Israel Personal Identification Number” on page 954.

Japan Passport Number See “Japan Passport Number” on page 963.

Japanese Juki-Net Identification Number See “Japanese Juki-Net Identification Number”

on page 965.\

Japanese My Number - Corporate See “Japanese My Number - Corporate” on page 967.

Japanese My Number - Personal See “Japanese My Number - Personal” on page 968.

Korea Passport Number See “Korea Passport Number” on page 970.

 Detecting content using data identifiers 615
Introducing data identifiers

Table 26-3 Asia Pacific personal identity (continued)

Data identifier Description

Korean Residence Registration Number for Foreigners See “Korea Residence Registration Number for Foreigners”
on page 972.

Korean Residence Registration Number for Korean See “Korea Residence Registration Number for Korean”
on page 974.

Malaysian MyKad Number See “Malaysian MyKad Number (MyKad) ” on page 979.

New Zealand National Health Index Number See “New Zealand National Health Index Number”
on page 1001.

People's Republic of China ID See “People's Republic of China ID” on page 1005.

Singapore NRIC See “Singapore NRIC data identifier” on page 1023.

Taiwan ID See “Taiwan ROC ID” on page 1048.

Thailand Personal Identification Number See “Thailand Personal Identification Number” on page 1049.

United Arab Emirates Personal Number See “United Arab Emirates Personal Number” on page 1068.

Table 26-4 lists system-defined data identifiers for the European region.

Table 26-4 European personal identity

Data identifier Description

Austria Passport Number See “Austria Passport Number” on page 813.

Austria Tax Identification Number See “Austria Tax Identification Number” on page 814.

Austrian Social Security Number See “Austrian Social Security Number” on page 816.

Belgian National Number See “Belgian National Number” on page 818.

Belgium Driver's License Number See “Belgium Driver's License Number” on page 820.

Belgium Passport Number See “Belgium Passport Number” on page 822.

Belgium Tax Identification Number See “Belgium Tax Identification Number” on page 823.

Belgium Value Added Tax (VAT) Number See “Belgium Value Added Tax (VAT) Number”
on page 825.

Bulgarian Uniform Civil Number - EGN See “Bulgarian Uniform Civil Number - EGN” on page 840.

Burgerservicenummer See “Burgerservicenummer” on page 842.

 Detecting content using data identifiers 616
Introducing data identifiers

Table 26-4 European personal identity (continued)

Data identifier Description

Codice Fiscale See “Codice Fiscale” on page 850.

Czech Personal Identification Number See “Czech Personal Identification Number” on page 874.

Denmark Personal Identification Number See “Denmark Personal Identification Number” on page 877.

Finnish Personal Identification Number See “Finnish Personal Identification Number” on page 893.

France Driver's License Number See “France Driver's License Number” on page 895.

France Health Insurance Number See “France Health Insurance Number” on page 896.

France Tax Identification Number See “France Tax Identification Number” on page 898.

France Value Added Tax (VAT) Number See “France Value Added Tax (VAT) Number” on page 899.

French INSEE Code See “French INSEE Code” on page 902.

French Passport Number See “French Passport Number” on page 903.

French Social Security Number See “French Social Security Number” on page 905.

German Passport Number See “German Passport Number” on page 907.

German Personal ID Number See “German Personal ID Number” on page 909.

Germany Driver's License Number See “Germany Driver's License Number” on page 910.

Germany Value Added Tax (VAT) Number See “Germany Value Added Tax (VAT) Number”
on page 912.

Greek Tax Identification Number See “Greek Tax Identification Number” on page 914.

Hungarian Social Security Number (TAJ) See “Hungarian Social Security Number” on page 918.

Hungarian Tax Identification Number See “Hungarian Tax Identification Number” on page 920.

Hungarian VAT Number See “Hungarian VAT Number” on page 922.

Irish Personal Public Service Number See “Irish Personal Public Service Number ” on page 952.

Italy Driver's License Number See “Italy Driver's License Number” on page 956.

Italy Health Insurance Number See “Italy Health Insurance Number” on page 958.

Italy Passport Number See “Italy Passport Number” on page 960.

Italy Value Added Tax (VAT) Number See “Italy Value Added Tax (VAT) Number” on page 961.
 Detecting content using data identifiers 617
Introducing data identifiers

Table 26-4 European personal identity (continued)

Data identifier Description

Luxembourg National Register of Individuals Number See “Luxembourg National Register of Individuals Number
” on page 977.

Netherlands Driver's License Number See “Netherlands Driver's License Number” on page 993.

Netherlands Passport Number See “Netherlands Passport Number” on page 995.

Netherlands Tax Identification Number See “Netherlands Tax Identification Number” on page 996.

Netherlands Value Added Tax (VAT) Number See “Netherlands Value Added Tax (VAT) Number”
on page 999.

Norwegian Birth Number See “Norwegian Birth Number ” on page 1003.

Polish Identification Number See “Polish Identification Number” on page 1006.

Polish REGON Number See “Polish REGON Number” on page 1008.

Polish Social Security Number (PESEL) See “Polish Social Security Number (PESEL)” on page 1010.

Polish Tax Identification Number (NIP) See “Polish Tax Identification Number” on page 1012.

Romanian Numerical Personal Code (CNP) See “Romanian Numerical Personal Code” on page 1017.

Russian Passport Identification Number See “Russian Passport Identification Number” on page 1019.

Russian Taxpayer Identification Number See “Russian Taxpayer Identification Number” on page 1021.

Spain Driver's License Number See “Spain Driver's License Number” on page 1025.

Spanish Customer Account Number See “Spanish Customer Account Number” on page 1028.

Spanish DNI Identification Number See “Spanish DNI ID” on page 1030.

Spanish Passport Number See “Spanish Passport Number” on page 1032.

Spanish Social Security Number See “Spanish Social Security Number ” on page 1034.

Spanish Tax Identification (CIF) See “Spanish Tax Identification (CIF)” on page 1036.

Swedish Passport Number See “Swedish Passport Number” on page 1039.

Swedish Personal Identification Number See “Swedish Personal Identification Number” on page 1040.

Swiss AHV Number See “Swiss AHV Number” on page 1044.

Swiss Social Security Number (AHV) See “Swiss Social Security Number (AHV)” on page 1046.

Turkish Identification Number See “Turkish Identification Number” on page 1051.

 Detecting content using data identifiers 618
Introducing data identifiers

Table 26-4 European personal identity (continued)

Data identifier Description

UK Driver's License Number See “UK Drivers Licence Number” on page 1053.

UK Tax ID Number See “UK Tax ID Number” on page 1062.

UK Passport Number See “UK Passport Number” on page 1060.

UK National Insurance Number See “UK National Insurance Number” on page 1058.

UK National Health Service (NHS) Number See “UK National Health Service (NHS) Number”
on page 1056.

UK Electoral Roll Number See “UK Electoral Roll Number” on page 1055.

Ukraine Identity Card See “Ukraine Identity Card” on page 1065.

Ukraine Passport (Domestic) See “Ukraine Passport (Domestic)” on page 1064.

Ukraine Passport (International) See “Ukraine Passport (International)” on page 1067.

Table 26-5 lists system-defined data identifiers for the North American region.

Table 26-5 North American personal identity

Data identifier Description

Canadian Social Insurance Number See “Canadian Social Insurance Number” on page 844.

Driver's License Number – CA State See “Drivers License Number – CA State ” on page 879.

Driver's License Number – IL State See “Drivers License Number - IL State” on page 882.

Driver's License Number – NJ State See “Drivers License Number - NJ State” on page 883.

Driver's License Number – NY State See “Drivers License Number - NY State” on page 885.

Driver's License Number – FL, MI, MN States See “Drivers License Number - FL, MI, MN States ”
on page 881.

Driver's License Number -WA State See “Driver's License Number - WA State” on page 886.

Driver's License Number - WI State See “Driver's License Number - WI State” on page 888.

Mexican Personal Registration and Identification Number See “Mexican Personal Registration and Identification
Number” on page 981.

Mexican Tax Identification Number See “Mexican Tax Identification Number” on page 983.
 Detecting content using data identifiers 619
Introducing data identifiers

Table 26-5 North American personal identity (continued)

Data identifier Description

Mexican Unique Population Registry Code (CURP) See “Mexican Unique Population Registry Code”
on page 986.

Mexico CLABE Number See “Mexico CLABE Number” on page 987.

Randomized US Social Security Number (SSN) See “Randomized US Social Security Number (SSN)”
on page 1015.

US Individual Tax ID Number (ITIN) See “UK Tax ID Number” on page 1062.

US Passport Number See “US Passport Number” on page 1073.

US Social Security Number (SSN) See “US Social Security Number (SSN)” on page 1074.
Note: This data identifer is replaced by the Randomized
US SSN data identifier.

US ZIP+4 Postal Codes See “US ZIP+4 Postal Codes” on page 1077.

Table 26-6 lists system-defined data identifiers for the South American region.

Table 26-6 South American personal identity

Data identifier Description

Argentina Tax Identification Number See “Argentina Tax Identification Number” on page 801.

Brazilian Bank Account Number See “Brazilian Bank Account Number” on page 827.

Brazilian Election Identification Number See “Brazilian Election Identification Number” on page 830.

Brazilian National Registry of Legal Entities Number See “Brazilian National Registry of Legal Entities Number”
on page 833.

Brazilian Natural Person Registry Number See “Brazilian Natural Person Registry Number (CPF)”
on page 836.

Chilean National Identification Number See “Chilean National Identification Number” on page 846.

Colombian Addresses See “Colombian Addresses” on page 851.

Colombian Cell Phone Number See “Colombian Cell Phone Number” on page 854.

Colombian Personal Identification Number See “Colombian Personal Identification Number”

on page 857.

Colombian Tax Identification Number See “Colombian Tax Identification Number” on page 859.
 Detecting content using data identifiers 620
Introducing data identifiers

Table 26-6 South American personal identity (continued)

Data identifier Description

Venezuela National Identification Number See “Venezuela National Identification Number”

on page 1079.

Financial data identifiers

Table 26-7 lists system-defined data identifiers for detecting financial identification numbers,
such as credit card numbers and ABA routing numbers.

Table 26-7 Financial data identifiers

Data identifier Description

ABA Routing Number See “ABA Routing Number” on page 798.

Credit Card Number See “Credit Card Number ” on page 863.

Credit Card Magnetic Stripe Data See “Credit Card Magnetic Stripe Data” on page 861.

CUSIP Number See “CUSIP Number ” on page 872.

IBAN Central See “IBAN Central” on page 924.

IBAN East See “IBAN East” on page 928.

IBAN West See “IBAN West” on page 934.

International Securities Identification Number See “International Securities Identification Number”

on page 946.

SWIFT Code See “SWIFT Code ” on page 1043.

Healthcare data identifiers

Table 26-8 lists system-defined data identifiers for detecting U.S. and international drug codes,
and healthcare provider and consumer information.

Table 26-8 Healthcare

Data identifier Description

Australian Medicare Number See “Australian Medicare Number” on page 807.

British Columbia Personal Healthcare Number See “British Columbia Personal Healthcare Number”
on page 838.
 Detecting content using data identifiers 621
Introducing data identifiers

Table 26-8 Healthcare (continued)

Data identifier Description

Drug Enforcement Agency (DEA) Number See “Drug Enforcement Agency (DEA) Number”
on page 891.

National Drug Code See “National Drug Code (NDC)” on page 989.

National Provider Identifier Number See “National Provider Identifier Number” on page 991.

Information technology data identifiers

See Table 26-9 on page 621. lists system-defined data identifiers for detecting information
technology related patterns, such as IPv4 and IPv6 addresses, and mobile device identification
numbers.

Table 26-9 Information technology

Data identifier Description

International Mobile Equipment Identity Number See “International Mobile Equipment Identity Number”
on page 944.

IP Address See “IP Address” on page 948.

IPv6 Address See “IPv6 Address” on page 950.

International keywords for PII data identifiers

Symantec Data Loss Prevention lets you modify system data identifiers and customize the
input keywords to detect a broad range of international content.
See “Extending and customizing data identifiers” on page 621.
See “Use custom keywords for system data identifiers” on page 708.

Extending and customizing data identifiers

You can customize data identifiers to suit your requirements. You can extend system-defined
data identifiers by modifying them. And, you can create new data identifiers for custom data
matching.
The most common use case for modifying a system-defined data identifier is to edit the data
input for a validator that accepts data input. For example, if the data identifier implements the
"Find keywords" validator, you may want to add or remove values from the list of keywords.
Another use case may involve adding or removing validators to or from the data identifier, or
changing one or more of the patterns defined by the data identifier.
 Detecting content using data identifiers 622
Introducing data identifiers

See “Cloning a system data identifier before modifying it” on page 649.
To create a custom data identifier, you implement one or more detection pattern(s), select one
or more data validators, provide the data input if the validator requires it, and choose a data
normalizer.
See “Custom data identifier configuration” on page 668.
Policy authors can reuse modified and custom data identifiers in one or more policies.

About data identifier configuration

You can configure three types of data identifiers:
■ Instance – defined at the policy level
See “Configuring data identifier policy conditions” on page 625.
■ Modified – configured at the system-level
See “Modifying system data identifiers” on page 648.
■ Custom – created at the system-level
See “Creating custom data identifiers” on page 666.
The type of data identifier you implement depends on your business requirements. For most
use cases, configuring a policy instance using a non-modified, system-defined data identifier
is sufficient to accurately detect data loss. Should you need to, you can extend a system-defined
data identifier by modifying it, or you can implement one or more custom data identifiers to
detect unique data.
Data identifier configuration done at the policy instance-level is specific to that policy.
Modifications you make to data identifiers at the system-level apply to all data identifiers derived
from the modified data identifier.

About data identifier breadths

System data identifiers are implemented by breadth. The breadth defines the scope of detection
for that data identifier. Each data identifier implements at least one breadth of detection. The
widest option available for the data identifier is likely to produce the most false positive matches;
the narrowest option produces the least. Generally the validators and often the patterns differ
among breadths.
See “Using data identifier breadths” on page 629.
For example, the Driver's License Number – CA State data identifier provides wide and medium
breadths, with the medium breadth using a keyword validator.
 Detecting content using data identifiers 623
Introducing data identifiers

Note: Not all system data identifiers provide each breadth of detection. Refer to the complete
list of data identifiers and breadths to determine what is available.
See “Selecting a data identifier breadth” on page 629.

About optional validators for data identifiers

Optional validators help you refine the scope of detection for a data identifier. When you
configure a data identifier instance, you can select among five optional validators.
See “Using optional validators” on page 643.
The type of characters accepted by each optional validator depends on the data identifier.
See “Acceptable characters for optional validators” on page 645.

Note: Optional validators only apply to the policy instance you are actively configuring; they
do not apply system-wide.

About data identifier patterns

Data identifiers implement patterns to match data. The data identifier pattern syntax is similar
to the regular expression language, but more limited. For example, the data identifier pattern
syntax does not support some regular expression features, including grouping, lookahead and
lookbehind expressions, and many special characters (notably the dot "." character). In addition,
the system only allows the use of ASCII characters for data identifier patterns.
See “Using the data identifier pattern language” on page 669.
When you edit a system data identifier, the system exposes the pattern for viewing and editing.
The system-defined data identifier patterns have been tuned and optimized for precise content
matching.
See “Selecting a data identifier breadth” on page 629.
In addition, you can create a custom data identifier in which case you are required to implement
at least one pattern. The best way to understand how to write patterns is to examine the
system-defined data identifier patterns.
See “Writing data identifier patterns to match data” on page 671.
The data identifier pattern language is a subset of the regular expression language.
See “Data identifier pattern language specification” on page 669.
 Detecting content using data identifiers 624
Introducing data identifiers

About pattern validators

Pattern validators are validation checks applied to data matched by a data identifier pattern.
Validators help refine the scope of detection and reduce false positives. Many validators allow
for data input. For example, the Keyword validator lets you enter a list of keywords.
See “Using pattern validators” on page 672.
When you modify a data identifier, you can edit the input values for any validator that accepts
data.
See “Editing pattern validator input” on page 650.
When you modify a data identifier, you can add and remove pattern validators. When you
create custom data identifiers , you can configure one or more validators. The system also
provides you with the ability to author a custom script validator to define your own validation
check.
See “Selecting pattern validators” on page 679.

About data normalizers

A data normalizer reconciles the data detected by the data identifier pattern with the format
expected by the normalizer. You cannot modify the normalizer of a system-defined data
identifier. When you create a custom data identifier, you select a data normalizer.
See “Acceptable characters for optional validators” on page 645.
See “Selecting a data normalizer” on page 680.

About cross-component matching

Data identifiers support component matching. This means that you can configure data identifiers
to match on one or more message components. However, if the data identifier implements a
validator (optional or required), such as Find keywords, the validated data and the matched
data must exist in the same component to trigger or except an incident.
See “Detection messages and message components” on page 354.
For example, consider a scenario where you implement the Randomized US Social Security
Number (SSN) data identifier. This data identifier detects on various 9-digits patterns and uses
a keyword validator to narrow the scope of detection. (The keyword and phrases in the list are
"social security number, ssn, ss#"). If the detection engine receives a message with the number
pattern 123-45-6789 and the keyword "social security number" and both data items are
contained in the message attachment component, the detection engine reports a match.
However, if the attachment contains the number but the body contains the keyword validator,
the detection engine does not consider this to be a match.
See “Configuring the Content Matches data identifier condition” on page 628.
 Detecting content using data identifiers 625
Configuring data identifier policy conditions

About unique match counting

Data identifiers, keywords, and regular expressions support unique match counting. This
feature lets you count only those pattern matches that are unique.
Unique match counting is useful when you are only concerned with detecting the presence of
unique patterns and not with detecting every matched pattern. For example, you could use
unique match counting to trigger an incident if a document contains 10 or more unique social
security numbers. In this case, if a document contained 10 instances of the same social security
number, the policy would not trigger an incident.
See “Using unique match counting” on page 647.
See “Configuring unique match counting” on page 648.

Configuring data identifier policy conditions

Table 26-10 lists and describes the configuration options for data identifier conditions.
See “Introducing data identifiers” on page 612.
See “Configuring the Content Matches data identifier condition” on page 628.

Table 26-10 Policy instance data identifier configuration

Selectable at the policy level Not configurable

■ Breadth ■ Patterns
You can implement any breadth the data identifier You cannot modify the match patterns at the instance
supports at the instance level. level.
■ Optional Validators ■ Mandatory Validators
You can select one or more optional validators at You cannot modify, add, or remove required validators at
the instance level. the instance level.

Workflow for configuring data identifier policies

Table 26-11 describes the workflow for implementing system-defined data identifiers.

Table 26-11 Workflow for implementing data identifiers

Step Action Description

1 Decide the type of data See “Introducing data identifiers” on page 612.
identifier you want to
implement.

2 Decide the data identifier See “About data identifier breadths” on page 622.
breadth.
 Detecting content using data identifiers 626
Configuring data identifier policy conditions

Table 26-11 Workflow for implementing data identifiers (continued)

Step Action Description

3 Configure the data See “Configuring the Content Matches data identifier condition” on page 628.
identifier.

4 Test and tune the data See “Best practices for using data identifiers” on page 681.
identifier policy.

Managing and adding data identifiers

The Manage > Policies > data identifiers screen lists all data identifiers, including system-
and custom-defined. From this screen you manage and modify existing data identifiers, and
add new ones.
See “Introducing data identifiers” on page 612.

Table 26-12 Manage data identifiers

Action Description

Edit a data identifier. Select the data identifier from the list to modify it.

See “Selecting a data identifier breadth” on page 629.

See “Extending and customizing data identifiers” on page 621.

See “Editing data identifiers” on page 626.

Define a custom data Click Add data identifier to create a custom data identifier.
identifier.
See “Custom data identifier configuration” on page 668.

See “Workflow for creating custom data identifiers” on page 666.

Sort and view data The list is sorted alphabetical by Name.

identifiers.
You can also sort by the Category.

A pencil icon to the left means that the data identifier is modified from its original state, or is
custom.

Remove a data Click the X icon on the right side to delete a data identifier.
identifier.
The system does not let you delete system data identifiers. You can only delete custom data
identifiers.

Editing data identifiers

You can modify system-defined data identifiers, including the patterns, validators, and validator
input. Modifications are propagated to any policy that declares the data identifier. You cannot
 Detecting content using data identifiers 627
Configuring data identifier policy conditions

rename a system data identifier. Consider manually creating a cloned copy before you modify
a system data identifier.
See “Extending and customizing data identifiers” on page 621.

Note: The system does not export data identifiers in a policy template. The system exports a
reference to the system data identifier. The target system where the policy template is imported
provides the actual data identifier. If you modify a system-defined data identifier, the
modifications do not export to the template.

Table 26-13 Workflow for editing data identifiers

Step Action Description

1 Clone the system data Clone the system data identifier before you modify it.
identifier you want to modify.
See “Cloning a system data identifier before modifying it” on page 649.

See “Clone system-defined data identifiers before modifying to preserve

original state” on page 682.

2 Edit the cloned data identifier. If you modify a system data identifier, click the plus sign to display the breadth
and edit the data identifier.

See “Selecting a data identifier breadth” on page 629.

3 Edit one or more Patterns. You can modify any pattern that the Data Identifier provides.

See “Writing data identifier patterns to match data” on page 671.

4 Edit the data input for any See “Editing pattern validator input” on page 650.
validator that accepts input.
See “List of pattern validators that accept input data” on page 650.

5 Optionally, you can add or See “Selecting pattern validators” on page 679.
remove Validators, as
necessary.

6 Save the data identifier. Click Save to save the modifications.

Once the data identifier is saved, the icon at the Data Identifiers screen
indicates that it is modified from its original state, or is custom.

See “Managing and adding data identifiers” on page 626.

Note: Click Cancel to not save the Data Identifier.

7 Implement the data identifier See “Configuring the Content Matches data identifier condition” on page 628.
in a policy rule or exception.
 Detecting content using data identifiers 628
Configuring data identifier policy conditions

Configuring the Content Matches data identifier condition

You can configure the Content Matches data identifier condition in policy detection rules and
exceptions.
See “Introducing data identifiers” on page 612.

Table 26-14 Configuring the Content Matches data identifier condition

Step Action Description

1 Add a data identifier rule Select the Content Matches data identifier condition at the Add Detection
or exception to a policy, Rule or Add Exception screen.
or configure an existing
See “Adding a rule to a policy” on page 378.
one.
See “Adding an exception to a policy” on page 387.

2 Choose a data identifier. Choose a data identifier from the list and click Next.

See “System-defined data identifiers” on page 613.

3 Select a Breadth of Use the breadth option to narrow the scope of detection.
detection.
See “About data identifier breadths” on page 622.

Wide is the default setting and detects the broadest set of matches. Medium
and narrow breadths, if available, check additional criteria and detect fewer
matches.

See “Selecting a data identifier breadth” on page 629.

4 Select and configure one Optional validators restrict the match criteria and reduce false positives.
or more Optional
See “About optional validators for data identifiers” on page 623.
Validators.

5 Configure Match Select how you want to count matches:

Counting.
■ Check for existence
Do not count multiple matches; report a match count of 1 for one or more
matches.
■ Count all matches
Count each match; specify the minimum number of matches to report an
incident.
See “Configuring match counting” on page 384.
■ Count all unqiue matches
This is the default setting for version 11.6 and higher.
See “About unique match counting” on page 625.
See “Configuring unique match counting” on page 648.
 Detecting content using data identifiers 629
Configuring data identifier policy conditions

Table 26-14 Configuring the Content Matches data identifier condition (continued)

Step Action Description

6 Configure the message Select one or more message components on which to match.
components to Match
On the endpoint, the detection engine matches the entire message, not
On.
individual components.

See “Selecting components to match on” on page 386.

If the data identifier uses optional or required keyword validators, the keyword
must be present in the same component as the matched data identifier content.

See “About cross-component matching” on page 624.

7 Configure additional Optionally, you can Add one or more additional conditions from any available
conditions to Also Match. in the Also Match condition list.

All conditions in a compound rule or exception must match to trigger or except

an incident.

See “Configuring compound match conditions” on page 392.

Using data identifier breadths

Each system data identifier provides one or more breadths of detection. When you configure
a system data identifier instance, or when you modify a system data identifier, you select which
breadth to implement. Not all breadth options are available for each data identifier.
See “About data identifier breadths” on page 622.

Table 26-15 Available rule breadths for system data identifiers

Breadth Description

Wide The wide breadth defines a single or multiple patterns to create the greatest number of matches.
In general this breadth produces a higher rate of false positives than the medium and narrow
breadths.

Medium The medium breadth may refine the detection pattern(s) and/or add one or more data validators
to limit the number of matches.

Narrow The narrow breadth offers the tightest patterns and strictest validation to provide the most accurate
positive matches. In general this option requires the presence of a keyword or other validating
restriction to trigger a match.

Selecting a data identifier breadth

You cannot change the normalizer that a system data identifier implements. This information
is useful to know when you implement one or more optional validators.
 Detecting content using data identifiers 630
Configuring data identifier policy conditions

See “Acceptable characters for optional validators” on page 645.

Table 26-16 System data identifier breadths and normalizers

Data identifier Breadth(s) Normalizer

ABA Routing Number Wide Digits

See “ABA Routing Number” on page 798. Medium

Narrow

Argentina Tax Identification Number Wide Digits

See “Argentina Tax Identification Number” on page 801. Medium

Narrow

Australian Business Number Wide Digits

See “Australian Business Number wide breadth” on page 804. Medium

Narrow

Australian Company Number Wide Digits

See “Australian Company Number” on page 805. Medium

Narrow

Australian Medicare Number Wide Digits

See “Australian Medicare Number” on page 807. Medium

Narrow

Australian Passport Number Wide Lowercase

See “Australian Passport Number” on page 810. Narrow

Australian Tax File Number Wide Digits

See “Australian Tax File Number” on page 812. Medium

Narrow

Austria Passport Number Wide Digits and Letters

See “Austria Passport Number” on page 813. Narrow

Austria Tax Identification Number Wide Digits

See “Austria Tax Identification Number” on page 814. Narrow

Austrian Social Security Number Wide Digits

See “Austrian Social Security Number” on page 816. Medium

Narrow
 Detecting content using data identifiers 631
Configuring data identifier policy conditions

Table 26-16 System data identifier breadths and normalizers (continued)

Data identifier Breadth(s) Normalizer

Belgian National Number Wide Digits

See “Belgian National Number” on page 818. Medium

Narrow

Belgium Driver's License Number Wide Digits

See “Belgium Driver's License Number” on page 820. Narrow

Belgium Passport Number Wide Digits and Letters

See “Belgium Passport Number” on page 822. Narrow

Belgium Tax Identification Number Wide Digits

See “Belgium Tax Identification Number” on page 823. Narrow

Belgium Value Added Tax (VAT) Number Wide Digits and Letters

See “Belgium Value Added Tax (VAT) Number” on page 825. Medium

Narrow

Brazilian Bank Account Number Wide Digits

See “Brazilian Bank Account Number” on page 827. Medium

Narrow

Brazilian Election Identification Number Wide Digits

See “Brazilian Election Identification Number” on page 830. Medium

Narrow

Brazilian National Registry of Legal Entities Number Wide Digits

See “Brazilian National Registry of Legal Entities Number” Medium

on page 833.
Narrow

Brazilian Natural Person Registry Number Wide Digits

See “Brazilian Natural Person Registry Number (CPF)” Medium

on page 836.
Narrow

British Columbia Personal Healthcare Number Wide Digits

See “British Columbia Personal Healthcare Number” Medium

on page 838.
Narrow
 Detecting content using data identifiers 632
Configuring data identifier policy conditions

Table 26-16 System data identifier breadths and normalizers (continued)

Data identifier Breadth(s) Normalizer

Bulgarian Uniform Civil Number - EGN Wide Digits

See “Bulgarian Uniform Civil Number - EGN” on page 840. Medium

Narrow

Burgerservicenummer Wide Digits

See “Burgerservicenummer” on page 842. Narrow

Canadian Social Insurance Number Wide Digits

See “Canadian Social Insurance Number” on page 844. Medium

Narrow

Chilean National Identification Number Wide Digits and Letters

See “Chilean National Identification Number” on page 846. Medium

Narrow

China Passport Number Wide Digits and Letters

See “China Passport Number” on page 849. Narrow

Codice Fiscale Wide Digits and Letters

See “Codice Fiscale” on page 850. Narrow

Colombian Addresses Wide Lowercase

See “Colombian Addresses” on page 851. Narrow

Colombian Cell Phone Number Wide Digits

See “Colombian Cell Phone Number” on page 854. Narrow

Colombian Personal Identification Number Wide Digits

See “Colombian Personal Identification Number” on page 857. Narrow

Colombian Tax Identification Number Wide Digits

See “Colombian Tax Identification Number” on page 859. Narrow

Credit Card Magnetic Stripe Data Medium Digits

See “Credit Card Magnetic Stripe Data” on page 861.

Credit Card Number Wide Digits

See “Credit Card Number ” on page 863. Medium

Narrow
 Detecting content using data identifiers 633
Configuring data identifier policy conditions

Table 26-16 System data identifier breadths and normalizers (continued)

Data identifier Breadth(s) Normalizer

CUSIP Number Wide Lowercase

See “CUSIP Number ” on page 872. Medium

Narrow

Czech Personal Identification Number Wide Digits

See “Czech Personal Identification Number” on page 874. Medium

Narrow

Denmark Personal Identification Number Wide Digits and Letters

See “Denmark Personal Identification Number” on page 877. Medium

Narrow

Driver's License Number – CA State Wide Lowercase

See “Drivers License Number – CA State ” on page 879. Medium

Driver's License Number – FL, MI, MN States Wide Lowercase

See “Drivers License Number - FL, MI, MN States ” Medium

on page 881.

Driver's License Number – IL State Wide Lowercase

See “Drivers License Number - IL State” on page 882. Medium

Driver's License Number – NJ State Wide Lowercase

See “Drivers License Number - NJ State” on page 883. Medium

Driver's License Number – NY State Wide Lowercase

See “Drivers License Number - NY State” on page 885. Medium

Driver's License Number – WA State Wide Lowercase

See “Driver's License Number - WA State” on page 886. Medium

Narrow

Driver's License Number – WI State Wide Digits and Letters

See “Driver's License Number - WI State” on page 888. Medium

Narrow
 Detecting content using data identifiers 634
Configuring data identifier policy conditions

Table 26-16 System data identifier breadths and normalizers (continued)

Data identifier Breadth(s) Normalizer

Drug Enforcement Agency (DEA) Number Wide Lowercase

See “Drug Enforcement Agency (DEA) Number” on page 891. Medium

Narrow

Finnish Personal Identification Number Wide Lowercase

See “Finnish Personal Identification Number” on page 893. Medium

Narrow

France Driver's License Number Wide Digits

See “France Driver's License Number” on page 895. Narrow

France Health Insurance Number Wide Digits

See “France Health Insurance Number” on page 896. Narrow

France Tax Identification Number Wide Digits

See “France Tax Identification Number” on page 898. Narrow

France Value Added Tax (VAT) Number Wide Digits and Letters

See “France Value Added Tax (VAT) Number” on page 899. Medium

Narrow

French INSEE Code Wide Digits

See “French INSEE Code” on page 902. Narrow

French Passport Number Wide Digits and Letters

See “French Passport Number” on page 903. Narrow

French Social Security Number Wide Digits and Letters

See “French Social Security Number” on page 905. Medium

Narrow

German Passport Number Wide Lowercase

See “German Passport Number” on page 907. Medium

Narrow

German Personal ID Number Wide Lowercase

See “German Personal ID Number” on page 909. Medium

Narrow
 Detecting content using data identifiers 635
Configuring data identifier policy conditions

Table 26-16 System data identifier breadths and normalizers (continued)

Data identifier Breadth(s) Normalizer

Germany Driver's License Number Wide Digits and Letters

See “Germany Driver's License Number” on page 910. Narrow

Germany Value Added Tax (VAT) Number Wide Digits and Letters

See “Germany Value Added Tax (VAT) Number” on page 912. Medium

Narrow

Greek Tax Identification Number Wide Digits

See “Greek Tax Identification Number” on page 914. Medium

Narrow

Hong Kong ID Wide Lowercase

See “Hong Kong ID” on page 916. Narrow

Hungarian Social Security Number Wide Digits

See “Hungarian Social Security Number” on page 918. Medium

Narrow

Hungarian Tax Identification Number Wide Digits

See “Hungarian Tax Identification Number” on page 920. Medium

Narrow

Hungarian VAT Number Wide Lowercase

See “Hungarian VAT Number” on page 922. Medium

Narrow

IBAN Central Wide Do nothing

See “IBAN Central” on page 924. Narrow

IBAN East Wide Do nothing

See “IBAN East” on page 928. Narrow

IBAN West Wide Do nothing

See “IBAN West” on page 934. Narrow

Indian Aadhaar Card Number Wide Digits

See “Indian Aadhaar Card Number” on page 939. Medium

Narrow
 Detecting content using data identifiers 636
Configuring data identifier policy conditions

Table 26-16 System data identifier breadths and normalizers (continued)

Data identifier Breadth(s) Normalizer

Indian Permanent Account Number Wide Digits and Letters

See “Indian Permanent Account Number” on page 941. Narrow

Indonesian Identity Card Number Wide Digits

See “Indonesian Identity Card Number” on page 942. Medium

Narrow

International Mobile Equipment Identity Number Wide Digits

See “International Mobile Equipment Identity Number” Medium

on page 944.
Narrow

International Securities Identification Number Wide Lowercase

See “International Securities Identification Number” Medium

on page 946.
Narrow

IP Address Wide Do nothing

See “IP Address” on page 948. Medium

Narrow

IPv6 Address Wide Do nothing

See “IPv6 Address” on page 950. Medium

Narrow

Irish Personal Public Service Number Wide Lowercase

See “Irish Personal Public Service Number ” on page 952. Medium

Narrow

Israel Personal Identification Number Wide Digits

See “Israel Personal Identification Number” on page 954. Medium

Narrow

Italy Driver's License Number Wide Digits and Letters

See “Italy Driver's License Number” on page 956. Narrow

Italy Health Insurance Number Wide Digits and Letters

See “Italy Health Insurance Number” on page 958. Narrow

 Detecting content using data identifiers 637
Configuring data identifier policy conditions

Table 26-16 System data identifier breadths and normalizers (continued)

Data identifier Breadth(s) Normalizer

Italy Passport Number Wide Digits and Letters

See “Italy Passport Number” on page 960. Narrow

Italy Value Added Tax (VAT) Number Wide Digits and Letters

See “Italy Value Added Tax (VAT) Number” on page 961. Medium

Narrow

Japan Passport Number Wide Digits and Letters

See “Japan Passport Number” on page 963. Narrow

Japanese Juki-Net Identification Number Wide Digits

See “Japanese Juki-Net Identification Number” on page 965. Medium

Narrow

Japanese My Number - Corporate Wide Digits

See “Japanese My Number - Corporate” on page 967. Narrow

Japanese My Number - Personal Wide Digits

See “Japanese My Number - Personal” on page 968. Medium

Narrow

Korea Passport Number Wide Digits and Letters

See “Korea Passport Number” on page 970. Narrow

Korea Residence Registration Number for Foreigners Wide Digits

See “Korea Residence Registration Number for Foreigners” Medium

on page 972.
Narrow

Korea Residence Registration Number for Korean Wide Digits

See “Korea Residence Registration Number for Korean” Medium

on page 974.
Narrow

Luxembourg National Register of Individuals Number Wide Digits

See “Luxembourg National Register of Individuals Number ” Medium

on page 977.
Narrow
 Detecting content using data identifiers 638
Configuring data identifier policy conditions

Table 26-16 System data identifier breadths and normalizers (continued)

Data identifier Breadth(s) Normalizer

Malaysian MyKad Number Wide Digits

See “Malaysian MyKad Number (MyKad) ” on page 979. Medium

Narrow

Mexican Personal Registration and Identification Number Wide Digits and Letters

See “Mexican Personal Registration and Identification Number” Medium

on page 981.
Narrow

Mexican Tax Identification Number Wide Digits and Letters

See “Mexican Tax Identification Number” on page 983. Medium

Narrow

Mexican Unique Population Registry Code (CURP) Wide Lowercase

See “Mexican Unique Population Registry Code” on page 986. Medium

Narrow

Mexico CLABE Number Wide Digits

See “Mexico CLABE Number” on page 987. Medium

Narrow

National Drug Code Wide Do nothing

See “National Drug Code (NDC)” on page 989. Medium

Narrow

National Provider Identifier Number Wide Digits

See “National Provider Identifier Number” on page 991. Medium

Narrow

Netherlands Driver's License Number Wide Digits

See “Netherlands Driver's License Number” on page 993. Narrow

Netherlands Passport Number Wide Digits and Letters

See “Netherlands Passport Number” on page 995. Narrow

Netherlands Tax Identification Number Wide Digits

See “Netherlands Tax Identification Number” on page 996. Medium

Narrow
 Detecting content using data identifiers 639
Configuring data identifier policy conditions

Table 26-16 System data identifier breadths and normalizers (continued)

Data identifier Breadth(s) Normalizer

Netherlands Value Added Tax (VAT) Number Wide Digits and Letters
See “Netherlands Value Added Tax (VAT) Number” Medium
on page 999.
Narrow

New Zealand National Health Index Number Wide Lowercase

See “New Zealand National Health Index Number” on page 1001. Medium

Narrow

Norwegian Birth Number Wide Digits

See “Norwegian Birth Number ” on page 1003. Medium

Narrow

People's Republic of China ID Wide Lowercase

See “People's Republic of China ID” on page 1005. Narrow

Polish Identification Number Wide Digits and Letters

See “Polish Identification Number” on page 1006. Medium

Narrow

Polish REGON Number Wide Digits

See “Polish REGON Number” on page 1008. Medium

Narrow

Polish Social Security Number (PESEL) Wide Digits

See “Polish Social Security Number (PESEL)” on page 1010. Medium

Narrow

Polish Tax Identification Number (NIP) Wide Digits

See “Polish Tax Identification Number” on page 1012. Medium

Narrow

Randomized US Social Security Number (SSN) Medium Digits

See “Randomized US Social Security Number (SSN)” Narrow

on page 1015.
 Detecting content using data identifiers 640
Configuring data identifier policy conditions

Table 26-16 System data identifier breadths and normalizers (continued)

Data identifier Breadth(s) Normalizer

Romanian Numerical Personal Code Wide Digits

See “Romanian Numerical Personal Code” on page 1017. Medium

Narrow

Russian Passport Identification Number Wide Digits

See “Russian Passport Identification Number” on page 1019. Narrow

Russian Taxpayer Identification Number Wide Digits

See “Russian Taxpayer Identification Number” on page 1021. Medium

Narrow

Singapore NRIC Wide Lowercase

See “Singapore NRIC data identifier” on page 1023.

South African Personal Identification Number Wide Digits

See “South African Personal Identification Number” Medium

on page 1023.
Narrow

Spain Driver's License Number Wide Digits and Letters

See “Spain Driver's License Number” on page 1025. Narrow

Spanish Customer Account Number Wide Digits

See “Spanish Customer Account Number” on page 1028. Medium

Narrow

Spanish DNI ID Wide Digits and Letters

See “Spanish DNI ID” on page 1030. Narrow

Spanish Social Security Number Wide Digits

See “Spanish Social Security Number ” on page 1034. Medium

Narrow

Spanish Tax Identification (CIF) Wide Digits and Letters

See “Spanish Tax Identification (CIF)” on page 1036. Medium

Narrow

Swedish Passport Number Wide Digits and Letters

See “Swedish Passport Number” on page 1039. Narrow

 Detecting content using data identifiers 641
Configuring data identifier policy conditions

Table 26-16 System data identifier breadths and normalizers (continued)

Data identifier Breadth(s) Normalizer

Swedish Personal Identification Number Wide Digits

See “Swedish Personal Identification Number” on page 1040. Medium

Narrow

SWIFT Code Wide Swift

See “SWIFT Code ” on page 1043. Narrow

Swiss AHV Number Wide Digits

See “Swiss AHV Number” on page 1044. Narrow

Swiss Social Security Number (AHV) Wide Digits

See “Swiss Social Security Number (AHV)” on page 1046. Medium

Narrow

Taiwan ROC ID Wide Do nothing

See “Taiwan ROC ID” on page 1048. Narrow

Thailand Personal Identification Number Wide Digits

See “Thailand Personal Identification Number” on page 1049. Medium

Narrow

Turkish Identification Number Wide Digits

See “Turkish Identification Number” on page 1051. Medium

Narrow

UK Driver's License Number Wide Digits and Letters

See “UK Drivers Licence Number” on page 1053. Medium

Narrow

UK Electoral Roll Number Narrow Lowercase

See “UK Electoral Roll Number” on page 1055.

UK National Health Service (NHS) Number Medium Digits

See “UK National Health Service (NHS) Number” on page 1056. Narrow

UK National Insurance Number Wide Lowercase

See “UK National Insurance Number” on page 1058. Medium

Narrow
 Detecting content using data identifiers 642
Configuring data identifier policy conditions

Table 26-16 System data identifier breadths and normalizers (continued)

Data identifier Breadth(s) Normalizer

UK Passport Number Wide Do nothing

See “UK Passport Number” on page 1060. Medium

Narrow

UK Tax ID Number Wide Do nothing

See “UK Tax ID Number” on page 1062. Medium

Narrow

Ukraine Identity Card Wide Digits

See “Ukraine Identity Card” on page 1065. Medium

Narrow

Ukraine Passport (Domestic) Wide Digits

See “Ukraine Passport (Domestic)” on page 1064. Narrow

Ukraine Passport (International) Wide Digits and Letters

See “Ukraine Passport (International)” on page 1067. Narrow

United Arab Emirates Personal Number Wide Digits

See “United Arab Emirates Personal Number” on page 1068. Medium

Narrow

US Individual Tax ID Number (ITIN) Wide Digits

See “US Individual Tax Identification Number (ITIN)” Medium

on page 1070.
Narrow

US Passport Number Wide Digits

See “US Passport Number” on page 1073. Narrow

US Social Security Number (SSN) Wide Digits

See “US Social Security Number (SSN)” on page 1074. Medium

Narrow

US ZIP+4 Postal Codes Wide Digits and Letters

See “US ZIP+4 Postal Codes” on page 1077. Medium

Narrow
 Detecting content using data identifiers 643
Configuring data identifier policy conditions

Table 26-16 System data identifier breadths and normalizers (continued)

Data identifier Breadth(s) Normalizer

Venezuela National ID Number Wide Digits and Letters

See “Venezuela National Identification Number” on page 1079. Medium

Narrow

Using optional validators

Table 26-17 lists the optional validators policy authors can configure for system data identifiers.
See “About optional validators for data identifiers” on page 623.

Table 26-17 Available optional validators for policy instances

Optional validator Description

Require beginning Match the characters that begin (lead) the matched data item.
characters
For example, for the CA Drivers License data identifier, you could require the beginning
character to be the letter "C." In this case the engine matches a license number C6457291.

See “Acceptable characters for optional validators” on page 645.

Require ending characters Match the characters that end (trail) the matched data item.

See “Acceptable characters for optional validators” on page 645.

Exclude beginning Exclude from matching characters that begin (lead) the matched data.
characters
See “Acceptable characters for optional validators” on page 645.

Exclude ending Exclude from matching the characters that end (trail) the matched data item.
characters
See “Acceptable characters for optional validators” on page 645.
 Detecting content using data identifiers 644
Configuring data identifier policy conditions

Table 26-17 Available optional validators for policy instances (continued)

Optional validator Description

Find keywords Match one or more keywords or key phrases in addition to the matched data item. Can
check for the proximity of matched data against a list of keywords.

Keywords can also be scanned for case sensitivity. Then a check is performed for the
proximity of the matched data identifier patterns against a list of keywords. An incident is
generated when all of the data identifier patterns in the rule match. Captured keywords
are highlighted in incidents. Proximity, case sensitivity, and validator highlighting are
disabled by default and must be enabled to work.

The keyword must be detected in the same message component as the data identifier
content to report a match.

See “About cross-component matching” on page 624.

This optional validator accepts any characters (numbers, letters, others).

See “Acceptable characters for optional validators” on page 645.

See “List of pattern validators that accept input data” on page 650.

Configuring optional validators

You implement optional validators to refine the scope of a data identifier defined in a policy
instance. System and custom data identifiers support the configuration of optional validators.
See “About optional validators for data identifiers” on page 623.
The type of input allowed by an optional validator (numbers, letters, characters) depends on
the data identifier. If you enter unacceptable input characters and attempt to save the
configuration, the system reports an error.
For example, the US Social Security Number (SSN) data identifier accepts numbers only. If
you configure the "Require ending character" optional validator and provide input as letters,
you receive the following error when you attempt to save the configuration: Input to "Require
ending characters" Validator is incorrect: List contains non-number character.
See Table 26-18 on page 645.
To configure an optional validator
1 Click the plus sign beside the Optional Validators label for the data identifier instance
you are configuring.
See “Configuring the Content Matches data identifier condition” on page 628.
2 Select one or more optional validators.
See “About optional validators for data identifiers” on page 623.
 Detecting content using data identifiers 645
Configuring data identifier policy conditions

3 Provide the expected input for each optional validator you select.
Each value can be of any length. Use commas to separate multiple values.
4 Click Save to save the configuration.
If the system displays an error message, make sure you have entered the correct type of
expected character input.
See Table 26-18 on page 645.

Acceptable characters for optional validators

Each optional validator requires you to enter in some data values. You must enter the
appropriate type of data according for that data identifier. Table 26-18 lists the acceptable data
type for each data identifier/optional validator pairing.
See “About optional validators for data identifiers” on page 623.

Note: The Find keyword optional validator accepts any characters as values for all data
identifiers .

The type of data expected by the optional validator depends on the data identifier. Most data
identifier/optional validator pairings accept numbers only; some accept alphanumeric values,
and a few accept any characters. If you enter unacceptable input and attempt to save the
policy, the system reports an error.
See “Configuring optional validators” on page 644.

Table 26-18 Acceptable characters for optional validators

Data Identifier Require ending Exclude ending Require Exclude beginning

characters characters beginning characters
characters

US Social Security Number (SSN) Numbers only

Canadian Social Insurance Number Numbers only

US Individual Tax Identification Numbers only

Number (ITIN)

Driver's License Number – CA State Numbers only Any characters (normalized to lowercase)

Driver's License Number – IL State Numbers only Any characters (normalized to lowercase)

Driver's License Number – NJ State Numbers only Any characters (normalized to lowercase)

Driver's License Number – NY State Numbers only

 Detecting content using data identifiers 646
Configuring data identifier policy conditions

Table 26-18 Acceptable characters for optional validators (continued)

Data Identifier Require ending Exclude ending Require Exclude beginning

characters characters beginning characters
characters

Driver's License Number – FL, MI, Numbers only Any characters (normalized to lowercase)
MN States

Credit Card Number Numbers only

ABA Routing Number Numbers only

CUSIP Number Numbers only

SWIFT Code Alphanumeric (numbers or letters)

Credit Card Magnetic Stripe Data Numbers only

IBAN West Alphanumeric (numbers or letters)

IBAN Central Alphanumeric (numbers or letters)

IBAN East Alphanumeric (numbers or letters)

National Drug Code Numbers only

Australian Medicare Number Numbers only

IP Address Any characters

Codice Fiscale Numbers only

Spanish DNI ID Numbers only

Burgerservicenummer Numbers only

UK Driver's License Number Alphanumeric (normalized to lowercase)

UK Tax ID Number Numbers only

UK Passport Number Numbers only

UK National Insurance Number Alphanumeric (normalized to lowercase)

UK National Health Service (NHS) Numbers only

Number

UK Electoral Roll Number Numbers only Any characters (normalized to lowercase)

French INSEE Code Numbers only

Swiss AHV Number Numbers only

 Detecting content using data identifiers 647
Configuring data identifier policy conditions

Table 26-18 Acceptable characters for optional validators (continued)

Data Identifier Require ending Exclude ending Require Exclude beginning

characters characters beginning characters
characters

Australian Tax File Number Numbers only

People's Republic of China ID Numbers only

Hong Kong ID Numbers only

Singapore NRIC Numbers only

Taiwan ID Numbers only

Using unique match counting

When you define a new data identifier rule, a new keyword rule, or a new regular expression
rule Count all unique matches is the default method for counting matches.
The following table describes unique match counting characteristics.

Table 26-19 Unique match counting characteristics

Unique match counting Description

characteristic

First match is unique A unique match is the first match found in a message component.

See “Detection messages and message components” on page 354.

Match count updated for each unique The match count is incremented by 1 for each unique pattern match.
match

Only unique matches are highlighted Duplicate matches are neither counted nor highlighted at the Incident Snapshot
screen

See “Remediating incidents” on page 1297.

Uniqueness does not span message For example, if the same SSN appears in both the message body and
components attachment, two unique matches will be generated, not one. This is because
each instance is detected in a separate message component.

Compound rule with data identifier In a compound rule combining a data identifier condition with a keyword condition
and keyword proximity conditions that specifies keyword proximity logic, the reported match will be the first match
found
 Detecting content using data identifiers 648
Modifying system data identifiers

Configuring unique match counting

Count all unique matches is the default selection for new data identifiers you create. After
upgrading Data Loss Prevention, you may need to manually configure pre-existing data identifier
rules to use unique match counting, if you have not done so prior to upgrade
See “About unique match counting” on page 625.
To configure unique match counting
1 Select the policy containing the data identifier rule or rules you want to update at the
Manage > Policies > Policy List screen.
2 Select the data identifier rule at the Configure Policy screen.
3 Select the match counting option Count all unique matches.
4 Click OK to apply the unique match counting configuration change.
5 Click Save to save the policy change.
6 Test unique match counting.
Create an incident with multiple instances of a data identifier pattern, such as several
instances of the same social security number in the same message component (for
example, in an email attachment).
At the Incident Snapshot verify that only unique matches are highlighted and counted.

Modifying system data identifiers

The system lets you modify system-defined data identifiers, but you cannot delete them. Any
modifications you make to the configuration of a system-defined data identifier take effect
system-wide. This means that the modifications apply to any policies that actively or
subsequently declare the data identifier.
There is no way to automatically revert a data identifier to its original configuration once it is
modified. Before you modify a system data identifier, consider cloning it.
, and any custom data identifiers that you have created. Any modification you make to a Data
identifier takes effect system wide. This means the modifications apply to any policy that
declares the modified Data identifier.
The system does not include modified data identifiers in policies exported as templates. Before
modifying a system data identifier, export any policies that declare it.
See “Editing data identifiers” on page 626.
See “Editing pattern validator input” on page 650.
 Detecting content using data identifiers 649
Modifying system data identifiers

Note: The system does not export modified and custom data identifiers in a policy template.
The system exports a reference to the system Data identifier. The target system where the
policy template is imported provides the actual Data identifier. See “Clone system-defined data
identifiers before modifying to preserve original state” on page 682.

See “Editing data identifiers” on page 626.

Table 26-20 System Data identifier modification options

Modifiable at the system level Not configurable

■ Patterns ■ Name, Description, and Category

You can edit one or more Data identifier patterns at You cannot modify the name, description, or category of
the system level. a system Data identifier.
■ Active Validators ■ Breadth
You can add or remove required validators at the You cannot define a new detection breadth for a system
system level. Data identifier; you can only modify an existing breadth.
■ Data Entry ■ Optional Validators
You can edit the input of an active validator for a You cannot define optional validators at the system level.
system Data identifier. You can only configure optional validators at the policy
level.
■ Data Normalizer
You cannot modify the type of data normalizer
implemented by a system Data identifier.
■ Delete
You cannot delete a system Data identifier.

Cloning a system data identifier before modifying it

The Enforce Server does not provide an automated mechanism for cloning a system Data
Identifier.
See “Extending and customizing data identifiers” on page 621.
Before you modify a system Data Identifier, consider manually cloning it so you can revert to
the original configuration, if necessary. At the least, you should export a policy as a template
before you modify any system Data Identifier declared by that policy.
To manually clone a system Data Identifier
1 Review the original configuration of the Data Identifier you want to modify.
2 Create a custom Data Identifier.
See “Workflow for creating custom data identifiers” on page 666.
 Detecting content using data identifiers 650
Modifying system data identifiers

3 Copy the configuration of the original Data Identifier to the custom Data Identifier.
Add the pattern(s), validator(s), any data input, and the normalizer.
See “Selecting a data identifier breadth” on page 629.
4 Save the custom Data Identifier.
5 Modify the custom Data Identifier to suit your needs.

Editing pattern validator input

At the system-level you can edit the data input that a required validator accepts. Not all
validators accept data input.
See “About pattern validators” on page 624.
To edit required validator input
1 Edit the data identifier by selecting it from the Manage > Policies > data identifiers
screen.
2 Select the Rule Breadth you want to modify.
Generally, the medium and narrow breadth options include validators that accept data
input.
3 Select the editable validator from the Active Validators list whose input you want to edit.
For example, select Find keywords.
See “List of pattern validators that accept input data” on page 650.
4 Edit the input for the validator in the Description and Data Entry field.
5 Select the qualities you want for the keyword;
■ Proximity - To find a keyword only within the set proximity of the matched patterns,
check this box and also indicate the Word Distance or proximity.
■ Case sensitive - Check this box if you want to search for a case-sensitive match.
■ Highlight keywords in incident - Check this box if you want to highlight the matched
keywords in incidents.

6 Click Update Validator to save the changes you have made to the validator input.
Click Discard Changes to not save the changes.
7 Click Save to save the data identifier.

List of pattern validators that accept input data

The following table lists all available pattern validators that require data input. The input data
is editable at the system-level definition of the data identifier.
 Detecting content using data identifiers 651
Modifying system data identifiers

Note: Input you use for beginning and ending validators concern the text of the match itself.
Input you use for prefix and suffix validators concern characters before and after matched text.

Table 26-21 Pattern validators that accept input data

Validator Description

Exact Match Enter a comma-separated list of values. If the values are numeric, do NOT enter
any dashes or other separators. Each value can be of any length.

Exclude beginning characters Enter a comma-separated list of values. If the values are numeric, do NOT enter
any dashes or other separators. Each value can be of any length.

Exclude ending characters Enter a comma-separated list of values. If the values are numeric, do NOT enter
any dashes or other separators. Each value can be of any length.

Exclude exact match Enter a comma-separated list of values. Each value can be of any length.

Exclude prefix Enter a comma-separated list of values. Each value can be of any length.

Exclude suffix Enter a comma-separated list of values. Each value can be of any length.

Find keywords Enter a comma-separated list of values. Each value can be of any length.

Require beginning characters Enter a comma-separated list of values. If the values are numeric, do NOT enter
any dashes or other separators. Each value can be of any length.

Require ending characters Enter a comma-separated list of values. If the values are numeric, do NOT enter
any dashes or other separators. Each value can be of any length.

Editing keywords for international PII data identifiers

Data identifiers offer broad support for detecting international content.
See “Introducing data identifiers” on page 612.
Some international data identifiers offer a wide breadth of detection only. In this case you can
implement the Find Keywords optional validator to narrow the scope of detection. Implementing
this optional validator may help you eliminate any false positives that your policy matches.
See “Selecting a data identifier breadth” on page 629.
 Detecting content using data identifiers 652
Modifying system data identifiers

To use keywords for international data identifiers

1 Create a policy using one of the system-provided international data identifiers that is listed
in the table.
See “List of keywords for international system data identifiers” on page 652.
2 Select the Find Keywords optional validator.
See “Configuring the Content Matches data identifier condition” on page 628.
3 Copy and past the appropriate comma-separated keywords from the list to the Find
Keywords optional validator field.
See “Configuring optional validators” on page 644.

List of keywords for international system data identifiers

Table 26-22 provides keywords for several system-defined international data identifiers. You
can modify the specified data identifier using the corresponding keyword(s).
See “Extending and customizing data identifiers” on page 621.
See “Introducing data identifiers” on page 612.
See “Selecting a data identifier breadth” on page 629.

Table 26-22 Keyword list for international PII data identifiers

Data identifier Language Keywords English translation

Argentina Tax Spanish Número de Identificación Fiscal, Tax identification number,

Identification Number número de contribuyente, taxpayer number, Argentina tax
Número de identificación fiscal identification number, Argentina
Argentina, Argentina número de taxpayer number
contribuyente

Austria Passport Number German REISEPASS, ÖSTERREICHISCH Passport, Austrian passport

REISEPASS, reisepass

Austria Tax Identification German Österreich, Steuernummer Austria, tax number

Number

Austrian Social Security German sozialversicherungsnummer, Social insurance number, social

Number soziale sicherheit
kein,Versicherungsnummer,
Österreichischen SSN,
Österreichischen
Sozialversicherungs
security number, insurance
number, Austrian SSN, Austrian
social insurance
 Detecting content using data identifiers 653
Modifying system data identifiers

Table 26-22 Keyword list for international PII data identifiers (continued)

Data identifier Language Keywords English translation

Belgian National Number French
Numéro national, numéro de
sécurité, numéro d'assuré,
identifiant national,
identifiantnational#,
Numéronational#
National number, security number,
number of insured, national
identification, national
identification #, national number
#

Belgium Driver's License German, French, Führerschein, Fuhrerschein, Driver's license, driver's license
Number Frisian Fuehrerschein, number, driving permit, driving
Führerscheinnummer, permit number
Fuhrerscheinnummer,
Fuehrerscheinnummer,
Führerscheinnummer,
Fuhrerscheinnummer,
Fuehrerscheinnummer,
Führerschein- Nr, Fuhrerschein-
Nr, Fuehrerschein- Nr, permis de
conduire,
rijbewijs,Rijbewijsnummer,
Numéro permis conduire

Belgium Passport Dutch, German, Paspoort, paspoort, Passport, passport number,

Number French paspoortnummer, Reisepass passport book, passport card
kein, Reisepass, Passnummer,
Passeport, Passeport livre,
Passeport carte, numéro
passeport

Belgium Tax Identification Dutch, German, Numéro de registre national, National registry number, tax
Number French numéro d'identification fiscale, identification number, tax number
belasting aantal,Steuernummer

Belgium Value Added German, French Numéro T.V.A, VAT number, tax identification
Tax (VAT) Number Umsatzsteuer-Identifikationsnummer, number
Umsatzsteuernummer

Brazilian Bank Account Brazilian Itauaccountno#, número conta
Number Portuguese bancária, conta n, número conta,
Conta bancária Itaú Número,
código de conta bancária, Conta
Sem, contan#, númeroconta#,
Conta Sem
Itaú account number, bank
account number, Itaú bank
account number, bank account
code, account number
 Detecting content using data identifiers 654
Modifying system data identifiers

Table 26-22 Keyword list for international PII data identifiers (continued)

Data identifier Language Keywords English translation

Brazilian Election Brazilian número identificação, Identification number, voter

Identification Number Portuguese identificação do eleitor, ID eleitor
eleição, número identificação
eleitoral, Número identificação
eleitoral brasileira,
IDeleitoreleição#
identification, electoral
identification number, Brazilian
electoral identification number,

Brazilian National Brazilian Brasileira ID Legal, entidades Brazilian legal identification, legal
Registry of Legal Entities Portuguese jurídicas ID,Registro Nacional de entities ID, National Registry of
Number Pessoas Jurídicas n º, Legal Entities No
BrasileiraIDLegal#

Brazilian Natural Person Brazilian Cadastro de Pessoas Físicas, Registration of individuals,

Registry Number Portuguese Brasileiro Pessoa Natural Número Brazilian Natural Person Registry
de Registro, pessoa natural Number, natural person registry
número de registro, pessoas number, individual registration
singulares registro NO number

Bulgarian Uniform Civil Bulgarian Униформ граждански номер, Uniform civil number, Uniform ID,
Number - EGN Униформ ID, Униформ Uniform civil ID, Bulgarian uniform
граждански ID, Униформ civil number
граждански не., български
Униформ граждански номер,
УниформгражданскиID#,
Униформгражданскине.#

Burgerservicenummer Dutch Persoonsnummer, sofinummer, person number, social-fiscal

(BSN) sociaal-fiscaal nummer, number (abbreviation),
persoonsgebonden social-fiscal number,
person-related number

Chilean National Spanish Chilena número identificación, Chileand identification number,

Identification Number nacional identidad, número national identity, identification
identificación, número number, national identification
identificación nacional, identidad number, identity number, Unique
número, National Role
NúmerodeIdentificación#,
Identidadchilenano#, Rol Único
Nacional, RolÚnicoNacional#,
nacionalidentidad#

China Passport Number Chinese 中国护照, 护照, 护照本 Chinese passport, passport,
passport book
 Detecting content using data identifiers 655
Modifying system data identifiers

Table 26-22 Keyword list for international PII data identifiers (continued)

Data identifier Language Keywords English translation

Codice Fiscale Italian codice fiscal, dati anagrafici, tax code, personal data, VAT
partita I.V.A., p. iva number, VAT number

Columbian Addresses Spanish Calle, Cll, Carrera, Cra, Cr, Street, St, Career, Avenue,
Avenida, Av, Dg, Diagonal, Diag, Diagonal, Transversal, sidewalk
Tv, Trans, Transversal, vereda

Columbian Cell Phone Spanish numero celular, número de Cellular number, telephone
Number teléfono, teléfono celular no., number, cellular telephone
numero celular# number

Columbian Personal Spanish cedula, cédula, c.c., c.c,C.C., C.C, Identification card, citizenship
Identification Number cc, CC, NIE., NIE, nie., nie, cedula card, identification document
de ciudadania, cédula de
ciudadanía, cc#, CC #, documento
de identificacion, documento de
identificación, Nit.

Columbian Tax Spanish NIT., NIT, nit., nit, Nit. TIN (tax identification number)
Identification Number

Czech Personal Czech Česká Osobní identifikační číslo, Czech Personal Identification
Identification Number Osobní identifikační číslo., Number, personal identification
identifikační číslo, čeština number, Czech identification
identifikační číslo number

Denmark Personal Danish Nationalt identifikationsnummer, National identification number,

Identification Number personnummer, unikt personal number, unique
identifikationsnummer, identification number, identification
identifikationsnummer, centrale number, central registry of
personregister, persons, CPR number
cpr,cpr-nummer,cpr#,
cpr-nummer#,
identifikationsnummer#,
personnummer#
 Detecting content using data identifiers 656
Modifying system data identifiers

Table 26-22 Keyword list for international PII data identifiers (continued)

Data identifier Language Keywords English translation

Finnish Personal Finnish tunnistenumero, henkilötunnus, Identification number, personal

Identification Number yksilöllinen henkilökohtainen identification number, unique
tunnistenumero, Ainutlaatuinen personal identification number,
henkilökohtainen tunnus, identity number, Finnish personal
identiteetti numero, Suomen identification number, national
kansallinen henkilötunnus, identification number
henkilötunnusnumero#,
kansallisen tunnistenumero,
tunnusnumero,kansallinen
tunnus numero

France Driver's License French permis de conduire Driver's license

Number

France Health Insurance French carte vitale, carte d'assuré social Health card, social insurance card
Number

France Tax Identification French numéro d'identification fiscale Tax identification number
Number

France Value Added Tax French Numéro d'identification taxe sur Value added tax identification
(VAT) Number valeur ajoutée, Numéro taxe number, value added tax number,
valeur ajoutée, taxe valeur value added tax, VAT number,
ajoutée, Taxe sur la valeur French VAT number, SIREN
ajoutée, Numéro de TVA identification number
intracommunautaire, n° TVA,
numéro de TVA, Numéro de TVA
en France, français numéro de
TVA, Numéro d'identification
SIREN

French INSEE Code French INSEE, numéro de sécu, code INSEE, social security number,
sécu social security code

French Passport Number French Passeport français, Passeport, French passport, passport,
Passeport livre, Passeport carte, passport book, passport card,
numéro passeport passport number

French Social Security French sécurité sociale non., sécurité Social secuty number, social
Number sociale numéro, code sécurité security code, insurance number
sociale, numéro d'assurance,
sécuritésocialenon.#,
sécuritésocialeNuméro#
 Detecting content using data identifiers 657
Modifying system data identifiers

Table 26-22 Keyword list for international PII data identifiers (continued)

Data identifier Language Keywords English translation

German Passport German Reisepass kein, Reisepass, Passport number, passport,

Number Deutsch Passnummer, German passport number,
Passnummer, Reisepasskein#, passport number
Passnummer#

German Personal ID German persönliche Personal identification number, ID

Number identifikationsnummer, number, Germane personal ID
ID-Nummer, Deutsch number, personal ID number,
persönliche-ID-Nummer, clear ID number, personal
persönliche ID Nummer, number, identity number,
eindeutige ID-Nummer, insurance number
persönliche Nummer,identität
nummer, Versicherungsnummer,
persönlicheNummer#,
IDNummer#

Germany Driver's German Führerschein, Fuhrerschein, Driver's license, driver's license

License Number Fuehrerschein, number
Führerscheinnummer,
Fuhrerscheinnummer,
Fuehrerscheinnummer,
Führerscheinnummer,
Fuhrerscheinnummer,Fuehrerscheinnummer,
Führerschein- Nr, Fuhrerschein-
Nr, Fuehrerschein- Nr

Germany Value Added German Mehrwertsteuer, MwSt, Value added tax, value added tax
Tax (VAT) Number Mehrwertsteuer identification number, value added
Identifikationsnummer, tax number
Mehrwertsteuer nummer

Greek Tax Identification Greek Αριθμός Φορολογικού Μητρώου, Tax identification number, TIN, tax
Number AΦΜ, Φορολογικού Μητρώου registry number
Νο., τον αριθμό φορολογικού
μητρώου

Hong Kong ID Chinese 身份證 , 三顆星 Identity card, Hong Kong

(Traditional) permanent resident ID Card
 Detecting content using data identifiers
Modifying system data identifiers
Table 26-22 Keyword list for international PII data identifiers (continued)
Data identifier Language Keywords
Hungarian Social Hungarian Magyar társadalombiztosítási
Security Number szám, Társadalombiztosítási
szám, társadalombiztosítási ID,
szociális biztonsági kódot,
szociális biztonság nincs.,
társadalombiztosításiID#
Hungarian Tax Hungarian Magyar adóazonosító jel no,
Identification Number adóazonosító szám, magyar
adószám, Magyar adóhatóság
no., azonosító szám,
adóazonosító no., adóhatóság no
Hungarian VAT Number Hungarian Közösségi adószám, Általános
forgalmi adó szám,
hozzáadottérték adó, magyar
Közösségi adószám
Indonesian Identity Card Indonesian, Kartu Tanda Penduduk nomor,
Number Portuguese número do cartão, Kartu identitas
Indonesia no, kartu no., Kartu
identitas Indonesia nomor, Nomor
Induk Kependudukan,
númerodocartão,kartuno.,
KartuidentitasIndonesiano
International Bank French Code IBAN, numéro IBAN
Account Number (IBAN)
Central
International Bank French Code IBAN, numéro IBAN
Account Number (IBAN)
East
International Bank French Code IBAN, numéro IBAN
Account Number (IBAN)
West
Irish Personal Public Gaelic Gaeilge Uimhir Phearsanta
Service Number Seirbhíse Poiblí, PPS Uimh.,
uimhir phearsanta seirbhíse
poiblí, seirbhíse Uimh, PPS Uimh,
PPS seirbhís aon
658
English translation
Hungarian social security number,
social security number, social
security ID, social security code
Hungarian tax identification
tumber, tax identification number,
Hungarian tax number, Hungarian
tax authority number, tax number,
tax authority number
Value added tax identification
number, sales tax number, value
added tax, Hungarian value added
tax number
Identity card number, card
number, Indonesian identity card
number, card no., Indonesian
identity card number, ID number
IBAN Code, IBAN number
IBAN Code, IBAN number
IBAN Code, IBAN number
Irish personal public service
number, PPS no., personal public
service number, service no., PPS
no., PPS service one
 Detecting content using data identifiers 659
Modifying system data identifiers

Table 26-22 Keyword list for international PII data identifiers (continued)

Data identifier Language Keywords English translation

Israel Personal Hebrew, Arabic ‫זהות‬,‫מספר זיהוי ישראלי‬,‫מספר זיהוי‬ Israeli identity number, identity
Identification Number ‫هوية‬,‫هويةاسرائيلية عدد‬,‫ישראלית‬ number, unique identity number,
‫عدد هوية فريدة من نوعها‬,‫رقم الهوية‬,‫ إسرائيلية‬personal ID, unique personal ID,
unique ID

Italy Driver's License Italian patente guida numero, patente di Driver's license number, driver's
Number guida numero, patente di guida, license
patente guida

Italy Health Insurance Italian TESSERA SANITARIA, tessera Health insurance card, Italian
Number sanitaria, tessera sanitaria health insurance card
italiana

Italian Passport Number Italian
Repubblica Italiana Passaporto,
Passaporto, Passaporto Italiana,
passport number, Italiana
Passaporto numero, Passaporto
numero, Numéro passeport
italien, numéro passeport
Italian Republic passport,
passport, Italian passport, Italian
passport number, passport
number

Italy Value Added Tax Italian IVA, numero partita IVA, IVA#, VAT, VAT number, VAT#, VAT
(VAT) Number numero IVA number

Japanese Juki-Net ID Japanese 住基ネット識別番号, 住基ネット番 Juki-Net identification number,

Number 号, 識別番号, 個人識別番号 Juki-Net number, identification
number, personal identification
number

Japanese My Number - Japanese マイナンバー, 共通番号 My number, common number

Corporate

Japanese My Number - Japanese マイナンバー, 個人番号, 共通番号 My number, personal number,

Personal common number

Japan Passport Number Japanese 日本国旅券, パスポート, パスポー Japanese passport, passport,
ト数 passport number

Korea Passport Number Korean 한국어 여권, 여권, 여권 번호, 대한 Korean passport, passport,
민국 passport number, Republic of
Korea

Korea Residence Korean 외국인 등록 번호, 주민번호 Foreigner registration number,

Registration Number for social security number
Foreigners
 Detecting content using data identifiers 660
Modifying system data identifiers

Table 26-22 Keyword list for international PII data identifiers (continued)

Data identifier Language Keywords English translation

Korean Residence Korean 주민등록번호, 주민번호 Resident registration number,

Registration Number for social security number
Korean

Luxembourg National German, French Eindeutige ID-Nummer, Unique ID number, unique ID,
Register of Individuals Eindeutige ID, ID personnelle, personal ID, personal identification
Number Numéro d'identification number
personnel, IDpersonnelle#,
Persönliche
Identifikationsnummer,
EindeutigeID#

Malaysian MyKad Malay nombor kad pengenalan, kad Identification card number,
Number (MyKad) pengenalan no, kad pengenalan identification card no., Malaysian
Malaysia, bilangan identiti unik, identification card, unique identity
nombor peribadi, number, personal number
nomborperibadi#,
kadpengenalanno#

Mexican Personal Spanish Clave de Registro de Identidad
Registration and Personal, Código de
Identification Number Identificación Personal mexicana,
número de identificación
personal mexicana
Personal identity registration key,
Mexican personal identification
code, Mexican personal
identification number

Mexican Tax Spanish Registro Federal de Federal taxpayer registry, tax

Identification Number Contribuyentes, número de
identificación de impuestos,
Código del Registro Federal de
Contribuyentes, Número RFC,
Clave del RFC
identification number, federal
taxpayer registry number, RFC
number, RFC key

Mexican Unique Spanish Única de registro de Población,
Population Registry Code clave única, clave única de
identidad, clave personal
Identidad, personal Identidad
Clave, ClaveÚnica#,
clavepersonalIdentidad#
Unique population registry, unique
key, unique identity key, unique
personal identity, personal identity
key

Mexico CLABE Number Spanish Clave Bancaria Estandarizada, Standardized banking code,
Estandarizado Banco número de standardized bank code number,
clave, número de clave, clave code number
número, clave#
 Detecting content using data identifiers 661
Modifying system data identifiers

Table 26-22 Keyword list for international PII data identifiers (continued)

Data identifier Language Keywords English translation

Netherlands Driver's Dutch RIJMEWIJS, permis de conduire, Driver's license, driving permit,
License Number rijbewijs, Rijbewijsnummer, driver's license number
RIJBEWIJSNUMMER

Netherlands Passport Dutch Nederlanden paspoort nummer, Dutch passport number, passport,
Number Paspoort, paspoort, Nederlanden passport number
paspoortnummer,
paspoortnummer

Netherlands Tax Dutch, Nederlands belasting Dutch tax identification number,

Identification Number Pampiamento, identificatienummer, tax identification number, Dutch
Norwegian identificatienummer van tax identification, Dutch tax
belasting, identificatienummer number, tax number
belasting, Nederlands belasting
identificatie, Nederlands belasting
id nummer, Nederlands
belastingnummer, btw nummer,
Nederlandse belasting
identificatie, Nederlands
belastingnummer, netherlands
tax identification tal, netherland's
tax identification tal, tax
identification tal, tax tal,
Nederlânske tax identification tal,
Hollânske tax identification,
Nederlânsk tax tal, Hollânske tax
id tal, netherlands impuesto
identification number,
netherland's impuesto
identification number, impuesto
identification number, impuesto
number, hulandes impuesto
identification number, hulandes
impuesto identification, hulandes
impuesto number, hulandes
impuesto id number

Netherlands Value Added Dutch, Frisian wearde tafoege tax getal, BTW Value added tax number, VAT
Tax (VAT) Number nûmer, BTW-nummer number

Norwegian Birth Number Norwegian fødsel nummer, Fødsel nr, fødsel Birth number
nei, fødselnei#, fødselnummer#
 Detecting content using data identifiers 662
Modifying system data identifiers

Table 26-22 Keyword list for international PII data identifiers (continued)

Data identifier Language Keywords English translation

People's Republic of Chinese 身份证,居民信息,居民身份信息 Identity Card, Information of

China ID (Simplified) resident, Information of resident
identification

Polish Identification Polish owód osobisty, Tożsamości Identification card, national

Number narodowej, osobisty numer identity, identification card
identyfikacyjny, niepowtarzalny number, unique number, number
numer, numer

Polish REGON Number Polish numer statystyczny, REGON, Statistical number, REGON
numeru REGON, number
numerstatystyczny#,
numeruREGON#

Polish Social Security Polish PESEL Liczba, społeczny PESEL number, social security
Number (PESEL) bezpieczeństwo liczba, społeczny number, social security ID, social
bezpieczeństwo ID, społeczny security code
bezpieczeństwo kod,
PESELliczba#,
społecznybezpieczeństwoliczba#

Polish Tax Identification Polish Numer Identyfikacji Podatkowej, Tax identification number, Polish
Number Polski numer identyfikacji tax identification number
podatkowej,
NumerIdentyfikacjiPodatkowej#

Romanian Numerical Romanian Cod Numeric Personal, cod
Personal Code identificare personal, cod unic
identificare, număr personal unic,
număr identitate, număr
identificare personal,
număridentitate#,
CodNumericPersonal#,
numărpersonalunic#
Personal numeric code, personal
identification code, unique
identification code, identity
number, personal identification
number

Russian Passport Russian паспорт нет, паспорт, номер
Identification Number паспорта, паспорт ID,
Российской паспорт, Русский
номер паспорта, паспорт#,
паспортID#, номерпаспорта#
Passport no., passport, passport
number, passport ID, Russian
passport, Russian passport
number
 Detecting content using data identifiers 663
Modifying system data identifiers

Table 26-22 Keyword list for international PII data identifiers (continued)

Data identifier Language Keywords English translation

Russian Taxpayer Russian НДС, номер TIN (tax identification number),

Identification Number налогоплательщика, taxpayer number, taxpayer ID, rax
Налогоплательщика ИД, налог number
число, налогчисло#, ИНН#,
НДС#

South African Personal Afrikaans nasionale identifikasie nommer, National identification number,
Identification Number nasionale identiteitsnommer, national identity number,
versekering aantal, persoonlike insurance number, personal
identiteitsnommer, unieke identity number, unique identity
identiteitsnommer, number, identity number
identiteitsnommer,
identiteitsnommer#,
versekeringaantal#,
nasionaleidentiteitsnommer#

South Korea Resident Korean 주민등록번호, 주민번호 Resident Registration Number,

Registration Number Resident Number

Spain Driver's License Spanish permiso de conducción, permiso Driver's license, driver's license
Number conducción, Número licencia number, driving license, driving
conducir, Número de carnet de permit, driving permit number
conducir, Número carnet
conducir, licencia conducir,
Número de permiso de conducir,
Número de permiso conducir,
Número permiso conducir,
permiso conducir, licencia de
manejo, el carnet de conducir,
carnet conducir

Spanish Customer Spanish número cuenta cliente, código Customer account number,
Account Number cuenta, cuenta cliente ID, número account code, customer account
cuenta bancaria cliente, código ID, customer bank account
cuenta bancaria number, bank account code

Spanish DNI ID Spanish NIE número, Documento Nacional NIE number, national identity
de Identidad, Identidad único, document, unique identity,
Número nacional identidad, DNI national identity number, DNI
Número number

Spanish Passport Spanish libreta pasaporte, número passport book, passport number,
Number pasaporte, Número Pasaporte, Spanish passport, passport
España pasaporte, pasaporte
 Detecting content using data identifiers 664
Modifying system data identifiers

Table 26-22 Keyword list for international PII data identifiers (continued)

Data identifier Language Keywords English translation

Spanish Social Security Spanish Número de la Seguridad Social, Social security number
Number número de la seguridad social

Spanish Tax ID (CIF) Spanish número de contribuyente, número taxpayer number, corporate tax
de impuesto corporativo, número number, tax identification number,
de Identificación fiscal, CIF CIF number
número, CIFnúmero#

Swedish Passport Swedish Passnummer, pass, sverige pass, Passport number, passport,
Number SVERIGE PASS, sverige Swedish passport, Swedish
Passnummer passport number

Swedish Personal Swedish personnummer ID, personligt ID number, personal ID number,

Identification Number id-nummer, unikt id-nummer, unique ID number, personal,
personnummer, identification number
identifikationsnumret,
personnummer#,
identifikationsnumret#

Swiss AHV Number French Numéro AVS, numéro d'assuré, AVS number, insurance number,
identifiant national, numéro national identifier, national
d'assurance vieillesse, numéro insurance number, social security
de sécurité soclale, Numéro AVH number, AVH number

German AHV-Nummer, Matrikelnumme, AHV number, Swiss Registration

Personenidentifikationsnummer number, PIN

Italian AVS, AVH AVS, AVH

Taiwan ROC ID Chinese 中華民國國民身分證 Taiwan ID

(Traditional)

Thailand Personal ID Thai ประกันภัยจำนวน, Insurance number, personal

Number หมายเลขประจำตัวส่วนบุคคล, identification, identification number
หมายเลขประจำตัวที่ไม่ซ้ำกัน,
ประกันภัยจำนวน#,
หมายเลขประจำตัวส่วนบุคคล#,
หมายเลขประจำตัวที่ไมซ้ำกัน#

Turkish Identification Turkish Kimlik Numarası, Türkiye Identification number, Turkish

Number Cumhuriyeti Kimlik Numarası,
vatandaş kimliği, kişisel kimlik
no, kimlik Numarası#, vatandaş
kimlik numarası, Kişisel kimlik
Numarası
Republic identification number,
citizen identity, personal
identification number, citizen
identification number
 Detecting content using data identifiers 665
Modifying system data identifiers

Table 26-22 Keyword list for international PII data identifiers (continued)

Data identifier Language Keywords English translation

Ukraine Identity Card Ukrainian посвідчення особи України Ukraine identity card

Ukraine Passport Ukrainian паспорт, паспорт України, Passport, Ukraine passport,

Number (Domestic) номер паспорта, персональний passport number

Ukraine Passport Ukranian паспорт, паспорт України, Passport, Ukraine passport,

Number (International) номер паспорта passport number

Updating policies to use the Randomized US SSN data identifier

The Randomized US Social Security Number (SSN) data identifier detects both traditional and
randomized SSNs.
See “Use the Randomized US SSN data identifier to detect SSNs” on page 684.
All policy templates that previously used the US Social Security Number (SSN) data identifier
to detect SSNs are updated to use the Randomized US Social Security Number (SSN) data
identifier. In addition, the Randomized US SSN data identifier is updated for Symantec Data
Loss Prevention version 14.0.
See “Updating policies after upgrading to the latest version” on page 410.
If you have existing policies that use the US SSN data identifier to detect SSNs, you should
update each policy to use the Randomized US SSN data identifier. If you have created policies
using the version 12.5 Randomized US SSN data identifier, you should update each to use
the version 14.0 Randomized US SSN data identifier.
To update a policy to use the Randomized US SSN data identifier provides steps for updating
your SSN policies.
To update a policy to use the Randomized US SSN data identifier
1 Edit the policy that implements the US SSN data identifier or the 12.5 Randomized US
SSN data identifier.
See “Configuring policies” on page 376.
2 Edit the rule that contains the US SSN data identifier.
See “Configuring policy rules” on page 380.
3 Remove the US SSN data identifier.
4 Add the Randomized US SSN data identifier.
See “Managing and adding data identifiers” on page 626.
5 Save the policy.
 Detecting content using data identifiers 666
Creating custom data identifiers

6 Test policy detection for both traditional and randomized US SSNs.

See “Test and tune policies to improve match accuracy” on page 416.
7 Deploy the updated SSN policy into production.
See “Policy deployment” on page 332.

Creating custom data identifiers

You can create and delete one or more custom data identifiers. A custom data identifier may
be a system data identifier that you have cloned and intend to modify, or one that you create
from scratch. A custom data identifier is reusable across policies. Changes made to a custom
data identifier at the system-level affect any policies that actively or subsequently declare the
custom data identifier.
Table 26-23 lists the components of custom data identifiers.
See “Workflow for creating custom data identifiers” on page 666.

Table 26-23 Custom data identifier components

Component Description

Patterns Define one or more regular expression patterns, separated by line breaks.

See “About data identifier patterns” on page 623.

Validators Add or remove validators to perform validation checks on the data detected by the
pattern(s).

See “About pattern validators” on page 624.

Data Entry Provide comma-separated data values for any validators that require data input.

See “About pattern validators” on page 624.

Normalizer Select a normalizer to standardize the data before matching against it.

See “Selecting a data normalizer” on page 680.

Workflow for creating custom data identifiers

You can implement custom data identifiers to detect unique content. To implement a custom
data identifier, you must define at least one pattern and select a data normalizer. Validators
are optional.
See “Custom data identifier configuration” on page 668.
 Detecting content using data identifiers 667
Creating custom data identifiers

When you define a custom data identifier, the system assigns it to the "Wide" breadth by
default. This is not a limitation, however, because the actual scope of detection is determined
by the pattern(s) and validator(s) that you define.

Table 26-24 Implementing custom data identifiers

Step Action Description

1 Select Manage > Policies > The Data Identifiers screen lists all data identifiers available in the system.
Data Identifiers.

2 Select Add data identifier. Enter a Name for the custom data identifier.

The name must be unique.

Enter a Description for the custom data identifier.

A custom data identifier is assigned to the Custom category by default and

cannot be changed.

The description field is limited to 255 characters per line.

3 Enter one or more Patterns You must enter at least one pattern for the custom data identifier to be valid.
to match data.
Separate multiple patterns by line breaks.

See “Writing data identifier patterns to match data” on page 671.

4 Select a Data Normalizer. You must select a data normalizer.

See “Selecting a data normalizer” on page 680.

The following normalizers are available:
■ Digits
■ Digits and Letters
■ Lowercase
■ Swift codes
■ Do nothing
Select this option if you do not want to normalize the data.

5 Select zero or more Including a validator to check and verify pattern matching is optional.
Validators.
See “Selecting pattern validators” on page 679.

6 Save the custom data Click Save at the upper left of the screen.
identifier.
Once you define and save a custom data identifier, it appears alphabetically
in the list of data identifiers at the Data Identifiers screen.

To edit a custom data identifier, select it from the list.

See “Editing data identifiers” on page 626.

Note: Click Cancel to not save the custom data identifier.
 Detecting content using data identifiers 668
Creating custom data identifiers

Table 26-24 Implementing custom data identifiers (continued)

Step Action Description

7 Implement the custom data The system lists all custom data identifiers beneath the Custom category
identifier in one or more for the "Content Matches data identifier" condition at the Configure Policy
policies. - Add Rule and the Configure Policy - Add Exception screens.

See “Configuring the Content Matches data identifier condition” on page 628.

You can configure optional validators at the policy instance level for custom
data identifiers.

See “Configuring optional validators” on page 644.

Custom data identifier configuration

You can create and delete one or more custom data identifiers . A custom Data identifier can
be used across policies. Changes made to a custom Data identifier at the system-level affect
any policies that actively or subsequently declare the custom Data identifier.
See “Workflow for creating custom data identifiers” on page 666.

Table 26-25 Custom data identifier configuration

Configurable at the custom level Not configurable

■ Name and Description ■ Category

You must give a custom Data identifier a unique The system assigns a custom Data identifier to the
name. Custom category. You cannot change this setting.
It is good practice to provide a description for the ■ Breadth
custom Data identifier. The system assigns a custom Data identifier to the Wide
You can change the name or description of a custom rule breadth. You cannot change this setting.
Data identifier when you modify it. ■ Optional Validators
■ Patterns Custom data identifiers support all optional validators, but
You must define at least one pattern for the custom they are configured at the policy instance level.
Data identifier to be valid.
■ Active Validators
You can add one or more required validators to a
custom Data identifier.
■ Data Entry
You can edit the input of an active validator that
accepts data input.
■ Data Normalizer
You must select a data normalizer when defining a
custom Data identifier.
 Detecting content using data identifiers 669
Creating custom data identifiers

Using the data identifier pattern language

The data identifier pattern language is a limited subset of the regular expression lexicon. The
data identifier pattern language does not support all of the regular expressions characters and
constructs. A regular expression pattern converted to a data identifier pattern will require some
syntactical modifications.
Data identifier patterns are limited to 100 characters per line. The pattern itself can be more
than 100 characters, but a line cannot have more than 100 character. You should split the
pattern up by lines not longer than 100 characters.
See “Input character limits for policy configuration” on page 393.
Table 26-26 lists the known differences between regular expressions and the Data identifier
pattern language. For more detailed information about the data identifier pattern language,
see Data identifier pattern language specification.

Table 26-26 Data identifier pattern language limitations

Character Description

* The asterisk (*), pipe (|), and dot (.) characters are not supported for Data identifier
patterns.
|

\w The \w construct cannot be used to match the underscore character (_).

\s The \s construct cannot be used to match a whitespace character; instead, use an actual
whitespace.

\d For digits, use the construct \d.

Grouping Grouping only works at the beginning of the pattern, for example:

\d{4} – 2049 does not work; instead use 2049 – \d{4}

\d{2} /19 \d{2} does not work; instead use \d{2} /[1][9] \d{2}

Groupings are allowed at the beginning of the pattern, like in the credit card Data identifier.

Data identifier pattern language specification

You can use three types of tokens when defining a data identifier pattern. Tokens are sequences
of non-whitespace characters at the beginning of the file, or preceded by one or more
whitespace characters, followed by whitespace characters or the end of the file. The three
token types that are used in data identifier patterns are:
■ Character literals
■ Bracket expressions
 Detecting content using data identifiers 670
Creating custom data identifiers

■ Special characters
You can follow each token by an optional quantifier.
See the section called “Quantifiers” on page 671.
Data identifier patterns only match a complete token or set of tokens.

Literal characters, metacharacters, and special characters

Most characters are literal matches in the data identifier pattern language. For example, the
character a in the data identifier pattern matches the character a in your content. The data
identifier pattern language includes four metacharacters. To match these metacharacters as
character literals, use the backslash to escape the characters in your data identifier pattern.
See Table 26-27 for descriptions of these metacharacters.

Table 26-27 Metacharacters

Character Description

[ This character is used to begin a bracket expression.

{ This character is used to quantify the preceding token.

? This character is used to quantify the preceding token.

\ This character is used to escape the following character.

The data identifier pattern language includes five predefined special characters. See Table 26-28
for descriptions of these special characters.

Table 26-28 Special characters

Character Description

\l This special character matches any ASCII letter.

\L This special character matches any non-ASCII letter character, including

Unicode characters.

\d This special character matches any ASCII digit.

\D This special character matches any non-ASCII digit, including Unicode

characters.

\w This special character matches any character not matched by \l or \d,

including Unicode characters.
 Detecting content using data identifiers 671
Creating custom data identifiers

Bracket expressions
Bracket expressions begin with [ and end with ], and contain at least one character within in
the body of the expression. For example, the bracket expression [abcd] matches any of the
letters "a," "b," "c," or "d."
You can include a character range within a bracket expression by separating two characters
with a hyphen: -. For example, the bracket expression [a-z] matches the lower-case letters
"a" through "z". Any two characters separated by - are interpreted as a range. The relative
ordering of the range does not matter: [a-z] and [z-a] match the same characters.
You can include the characters "]" and "-" in your bracket expression if you follow these rules:
■ The "]" character must appear as the first character in your bracket expression. For example:
[]a-z] matches the "]" character or any lower-case letter between "a" and "z."

■ The "-" character must appear as either the first or last character in your bracket expression.
If your bracket expression contains both the "]" and "-" characters, the "]" must be the first
character, and "-" the last character. For example: []-] matches either "]" or "-."

Order of interpretation
Data identifier patters are interpreted from left to right. For example, the bracket expression
[a-d-z] is interpreted as the range a-d and then the literals - and z.

Quantifiers
You can follow any token in your data identifier pattern with a quantifier. The quantifier specifies
how many occurrences of the pattern to match. See Table 26-29 for a description of the
quantifiers available in the data identifier pattern language.

Table 26-29 Quantifiers

Quantifier Description

? This quantifier specifies that the expression should match zero or one
occurrences of the preceding token.

{n} This quantifier specifies that the expression should match exactly n occurrences
of the preceding token.

{n, m} This quantifier specifies that the expression should match between n and m
occurrences of the preceding token (inclusive).

Writing data identifier patterns to match data

If you modify an existing data identifier, you can edit its patterns. If you create a custom data
identifier, you must implement at least one pattern. Data identifier patterns are implemented
 Detecting content using data identifiers 672
Creating custom data identifiers

using a syntax that is similar to the regular expression language, with limitations. In addition,
the system only allows the use of ASCII characters for data identifier patterns.
See “About data identifier patterns” on page 623.
To edit or implement a pattern
1 Review the patterns for the data identifier you want to modify.
See “Selecting a data identifier breadth” on page 629.
2 Consider cloning the data identifier, if you are modifying a system data identifier.
See “Cloning a system data identifier before modifying it” on page 649.
3 Select Manage > Policies > Data Identifiers in the Enforce Server administration console.
4 Select the data identifier you want to modify.
5 Select the breadth for the data identifier you want to modify.
Generally, patterns vary among detection breadths.
6 In the Patterns field, modify an existing pattern, or enter one or more new patterns,
separated by line breaks.
Data identifier patterns are implemented as regular expressions. However, much of the
regular expression syntax is not supported.
See “Using the data identifier pattern language” on page 669.
7 Click Save to save the data identifier.

Using pattern validators

The following table lists all available pattern validators. Validators marked with an asterisk (*)
beside the name in the table below require data input.

Table 26-30 Available validators for system and custom data identifiers

Validator Description

ABA Checksum Every ABA routing number must start with the following two digits:
00-15,21-32,61-72,80 and pass an ABA specific, position-weighted check sum.

Advanced KRRN Validation Validates that 3rd and 4th digits are a valid month, that 5th and 6th digits are a valid
day, and the checksum matches the check digit.

Advanced SSN Validator checks whether SSN contains zeros in any group, the area number (first
group) is less than 773 and not 666, the delimiter between the groups is the same,
the number does not consist of all the same digits, and the number is not reserved
for advertising (123-45-6789, 987-65-432x).
 Detecting content using data identifiers 673
Creating custom data identifiers

Table 26-30 Available validators for system and custom data identifiers (continued)

Validator Description

Argentinian Tax Identity Number Computes the checksum and validates the pattern against it.
Validation Check

Australian Company Number Computes the checksum and validates the pattern against it.
Validation Check

Australian Medicare Number Computes the checksum and validates the pattern against it.
Validation Check

Australian Tax File validation Computes the checksum and validates the pattern against it.
check

Austrian Social Security Number Computes the checksum and validates the pattern against it.
Validation Check

Basic SSN Performs minimal SSN validation.

Belgian National Number Computes the checksum and validates the pattern against it.
Validation Check

Belgium VAT Number Validation Computes the checksum and validates the pattern against it.
Check

Brazil Election Identification Computes the checksum and validates the pattern against it.
Number Validation Check

Brazilian Bank Account Number Computes the checksum and validates the pattern against it.
Validation Check

Brazilian National Registry of Computes the checksum and validates the pattern against it.
Legal Entities Number Validation
Check

Brazilian Natural Person Computes the checksum and validates the pattern against it.
Registry Number Validation
Check

British Columbia Personal Computes the checksum and validates the pattern against it.
Healthcare Number Validation
Check

Bulgarian Uniform Civil Number Computes the checksum and validates the pattern against it.
Validation Check

Burgerservicenummer Check Performs a check for the Burgerservicenummer.

 Detecting content using data identifiers 674
Creating custom data identifiers

Table 26-30 Available validators for system and custom data identifiers (continued)

Validator Description

Chilean National Identification Computes the checksum and validates the pattern against it.
Number Validation Check

China ID checksum validator Computes the checksum and validates the pattern against it.

Codice Fiscale Control Key Computes the control key and checks if it is valid.
Check

Cusip Validation Validator checks for invalid CUSIP ranges and computes the CUSIP checksum
(Modulus 10 Double Add Double algorithm).

Custom Script* Enter a custom script to validate pattern matches for this Data identifier breadth.

See “Creating custom script validators” on page 680.

Czech Personal Identity Number Computes the checksum and validates the pattern against it.
Validation Check

Denmark Personal Identification Computes the checksum and validates the pattern against it.
Number Validation Check

DNI control key check Computes the control key and checks if it is valid.

Driver's License Number WA Computes the checksum and validates the pattern against it.
State Validation Check

Driver's License Number WI Computes the checksum and validates the pattern against it.
State Validation Check

Drug Enforcement Agency Computes the checksum and validates the pattern against it.
Number Validation Check

Duplicate digits Ensures that a string of digits are not all the same.

Dutch Tax Identification Number Computes the checksum and validates the pattern against it.
Validation Check

Exact Match* Enter a comma-separated list of values. If the values are numeric, do NOT enter
any dashes or other separators. Each value can be of any length.

Exclude beginning characters* Enter a comma-separated list of values. If the values are numeric, do NOT enter
any dashes or other separators. Each value can be of any length.
Note: Beginning and ending validators concern the text of the match itself. Prefix
and suffix validators concern characters before and after matched text.

Exclude ending characters* Enter a comma-separated list of values. If the values are numeric, do NOT enter
any dashes or other separators. Each value can be of any length.
 Detecting content using data identifiers 675
Creating custom data identifiers

Table 26-30 Available validators for system and custom data identifiers (continued)

Validator Description

Exclude exact match* Enter a comma-separated list of values. Each value can be of any length.

Exclude prefix* Enter a comma-separated list of values. Each value can be of any length.
Note: Prefix and suffix validators concern characters before and after matched text.
Beginning and ending validators concern the text of the match itself.

Exclude suffix* Enter a comma-separated list of values. Each value can be of any length.

Find keywords* Enter a comma-separated list of values. Each value can be of any length.

Finnish Personal Identification Computes the checksum and validates the pattern against it.
Number Validation Check

France VAT Number Validation Computes the checksum and validates the pattern against it.
Check

French Social Security Number Computes the checksum and validates the pattern against it.
Validation Check

German ID Number Validation Computes the checksum and validates the pattern against it.
Check

German Passport Number Computes the checksum and validates the pattern against it.
Validation Check

Germany VAT Number Computes the checksum and validates the pattern against it.
Validation Check

Greek Tax Identification Number Computes the checksum and validates the pattern against it.
Validation Check

Hong Kong ID Computes the checksum and validates the pattern against it.

Hungarian Social Security Computes the checksum and validates the pattern against it.
Validation Check

Hungarian Tax Identification Computes the checksum and validates the pattern against it.
Number Validation Check

Hungarian VAT Number Computes the checksum and validates the pattern against it.
Validation Check

Indonesian Kartu Tanda Computes the checksum and validates the pattern against it.
Penduduk Validation Check
 Detecting content using data identifiers 676
Creating custom data identifiers

Table 26-30 Available validators for system and custom data identifiers (continued)

Validator Description

INSEE Control Key Validator computes the INSEE control key and compares it to the last 2 digits of the
pattern.

IP Basic Check Every IP address must match the format x.x.x.x and every number must be less than
256.

IP Octet Check Every IP address must match the format x.x.x.x, every number must be less than
256, and no IP address can contain only single-digit numbers (1.1.1.2).

IP Reserved Range Check Checks whether the IP address falls into any of the "Bogons" ranges. If so the match
is invalid.

IPv6 Basic Validation Check Every IPv6 address must match the format xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx
and every number must be lower than ffff.

Ipv6 Medium Validation Check Every IPv6 address must match the format xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx
and every number must be lower than ffff. No IPv6 address can start with 0.

Ipv6 Reserved Validation Check Every IPv6 address must match the format xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx.xxxx
and every number must be lower than ffff. No IPv6 address can start with 0. Each
IPv6 address must be fully compressed.

Irish Personal Public Service Computes the checksum and validates the pattern against it.
Number Validation Check

Israel Personal Identification Computes the checksum and validates the pattern against it.
Number Validation Check

Italy VAT Number Validation Computes the checksum and validates the pattern against it.
Check

Japanese Juki-Net ID Validation Computes the checksum and validates the pattern against it.
Check

Japanese My Number Validation Computes the checksum and validates the pattern against it.
Check

Luhn Check Validator computes the Luhn checksum which every Canadian Insurance Number
must pass.

Luxembourg National Register Computes the checksum and validates the pattern against it.
of Individuals Number Validation
Check

Malaysian MyKad Number Computes the checksum and validates the pattern against it.
Validation Check
 Detecting content using data identifiers 677
Creating custom data identifiers

Table 26-30 Available validators for system and custom data identifiers (continued)

Validator Description

Mexican Unique Population Computes the checksum and validates the pattern against it.
Registry Code Validation Check

Mexico CLABE Number Computes the checksum and validates the pattern against it.
Validation Check

Mod 97 Validator Computes the ISO 7064 Mod 97-10 checksum of the complete match.

National Provider Identifier Computes the checksum and validates the pattern against it.
Number Validation Check

National Securities Identification Computes the checksum and validates the pattern against it.
Number Validation Check

Netherlands VAT Number Computes the checksum and validates the pattern against it.
Validation Check

New Zealand National Health Computes the checksum and validates the pattern against it.
Index Number Validation Check

No Validation Performs no validation.

Norwegian Birth Number Computes the checksum and validates the pattern against it.
Validation Check

Number Delimiter Validates a match by checking the surrounding digits.

Polish ID Number Validation Computes the checksum and validates the pattern against it.
Check

Polish REGON Number Computes the checksum and validates the pattern against it.
Validation Check

Polish Social Security Number Computes the checksum and validates the pattern against it.
Validation Check

Polish Tax ID Number Validation Computes the checksum and validates the pattern against it.
Check

Require beginning characters* Enter a comma-separated list of values. If the values are numeric, do NOT enter
any dashes or other separators. Each value can be of any length.

Require ending characters* Enter a comma-separated list of values. If the values are numeric, do NOT enter
any dashes or other separators. Each value can be of any length.

Romanian Numerical Personal Computes the checksum and validates the pattern against it.
Code Check
 Detecting content using data identifiers 678
Creating custom data identifiers

Table 26-30 Available validators for system and custom data identifiers (continued)

Validator Description

Russian Taxpayer Identification Computes the checksum and validates the pattern against it.
Number Validation Check

Singapore NRIC Computes the Singapore NRIC checksum and validates the pattern against it.

South African Personal Computes the checksum and validates the pattern against it.
Identification Number Validation
Check

Spanish Customer Account Computes the checksum and validates the pattern against it.
Number Validation Check

Spanish SSN Number Validation Computes the checksum and validates the pattern against it.
Check

Spanish Tax ID Number Computes the checksum and validates the pattern against it.
Validation Check

SSN Area-Group number For a given area number (first group), not all group numbers (second group) might
have been assigned by the SSA. Validator eliminates SSNs with invalid group
numbers.

Swedish Personal Identification Computes the checksum and validates the pattern against it.
Number Validation Check

Swiss AHV Swiss AHV Modulus 11 Checksum.

Swiss Social Security Number Computes the checksum and validates the pattern against it.
Validation Check

Taiwan ID Taiwan ID checksum.

Thailand Personal Identification Computes the checksum and validates the pattern against it.
Number Validation Check

Turkish Identification Number Computes the checksum and validates the pattern against it.
Validation Check

UK Drivers License Every UK drivers license must be 16 characters and the number at the 8th and 9th
position must be larger than 00 and smaller than 32.

UK NHS UK NHS checksum.

Venezuela Identification Number Computes the checksum and validates the pattern against it.
Validation Check

Verhoeff Validation Check Computes the checksum and validates the pattern against it.
 Detecting content using data identifiers 679
Creating custom data identifiers

Table 26-30 Available validators for system and custom data identifiers (continued)

Validator Description

Ukraine Identity Card Check Computes the checksum and validates the pattern against it.

Selecting pattern validators

Symantec Data Loss Prevention provides a comprehensive set of validators to facilitate pattern
matching accuracy.
See “About pattern validators” on page 624.
When you modify a data identifier, the system exposes the active validators used by the data
identifier. When you modify or create a data identifier, the system displays all system-defined
data validators from which you can choose.

Note: The active validators that allow for and define input are not to be confused with the
"Optional validators" that can be configured for any runtime instance of a particular data
identifier. Optional validators are always configurable at the instance level. Active validators
are only configurable at the system level.

Select a validator from the "Validation Checks" list on the left, then click Add Validator to the
right. If the validator requires input, provide the required data using a comma-separated list
and then click Add Validator.
See “Selecting pattern validators” on page 679.
To select a pattern validator
1 Create a custom data identifier.
See “Workflow for creating custom data identifiers” on page 666.
2 In the Validators section, select the desired validator.
See “About pattern validators” on page 624.
3 If the validator does not require data input, click Add Validator.
The validator is added to the Active Validators list.
4 If the validator requires data input, enter the data values in the Description and Data
Entry field.
5 Edit the input for the validator in the Description and Data Entry field. If you are using
the Find keywords validator, edit the input for the validator in the Description and Data
Entry field. Then select the qualities you want for the keyword:
 Detecting content using data identifiers 680
Creating custom data identifiers

■ Proximity: Finds a keyword only within the set proximity of the matched patterns.
Check this box and also indicate the Word Distance.
■ Case sensitive: Check this box if you want to search for a case-sensitive match.
■ Highlight keywords in incident: Check this box if you want to highlight the matched
keywords in incidents.

6 Click Add Validator when you are done entering the values.
The validator is added to the Active Validators list.
7 To remove a validator, select it in the Active Validators list and click the red X icon.
8 Click Save to save the configuration of the data identifier.

Selecting a data normalizer

When you create a custom Data identifier, you must select a normalizer to reconcile the data
detected by the pattern with the format expected by the validators.
See “Workflow for creating custom data identifiers” on page 666.
Table 26-31 lists and describes the normalizers you can implement for custom data identifiers
.

Note: You cannot modify the normalizer of a system-defined Data identifier.

Table 26-31 Available data normalizers

Normalizer Description

Digits Only numeric characters are allowed.

Digits and Letters Alphanumeric characters are allowed.

Lowercase Only letters are allowed, normalized to lowercase.

Swift codes Code must match SWIFT requirements.

Do nothing The data is not normalized, evaluated as entered by the user.

Creating custom script validators

The custom script validation check lets you enter a custom script to validate pattern matches.
To implement a custom validator, you use the Symantec Data Loss Prevention Scripting
Language.
You can implement a custom script validator in a system data identifier you modify or in a
custom data identifier.
 Detecting content using data identifiers 681
Best practices for using data identifiers

Note: Refer to the Symantec Data Loss Prevention Detection Customziation Guide for details
on using the Symantec Data Loss Prevention Scripting Language.

To implement a custom script validator

1 Modify an existing data identifier or create a custom data identifier.
See “Workflow for creating custom data identifiers” on page 666.
2 Select the Custom Script validator from the list of Validation Checks.
3 Enter your custom script in the Description and Data Entry field.
4 Click Add Validator to add the custom validator to the Active Validators list.
5 Click Save to save the configuration of the data identifier.

Best practices for using data identifiers

Data identifiers are algorithms that combine pattern matching with data validators to detect
content. Symantec Data Loss Prevention provides a number of system-defined data identifiers
for common data patterns, including SSNs, Tax IDs, and more. In addition, you can define
your own custom data identifiers to match any data you can describe using the data identifier
pattern language. Data identifiers are commonly used to detect personally identifiable
information (PII).
This section provides best practices for implementing data identifier policies.
Table 26-32 summarizes the best practices in this section.

Table 26-32 Summary of data identifier best practices

Best practice Description

Use data identifiers instead of regular expressions when See “Use data identifiers instead of regular expressions
possible. to improve accuracy” on page 682.

Modify data identifier definitions when you want tuning to See “Modify data identifier definitions when you want tuning
apply globally. to apply globally” on page 683.

Close system-defined data identifiers before modifying See “Clone system-defined data identifiers before
them. modifying to preserve original state” on page 682.

Consider using multiple data identifier breadth in parallel See “Consider using multiple breadths in parallel to detect
different severities of confidential data” on page 683.

Avoid matching on the Envelope over HTTP See “Avoid matching on the Envelope over HTTP to reduce
false positives” on page 684.
 Detecting content using data identifiers 682
Best practices for using data identifiers

Table 26-32 Summary of data identifier best practices (continued)

Best practice Description

Use the Randomized US SSN data identifier to detect See “Use the Randomized US SSN data identifier to detect
traditional and randomized SSNs SSNs” on page 684.

Use unique match counting to improve accuracy and ease See “Use unique match counting to improve accuracy and
remediation ease remediation” on page 685.

Use data identifiers instead of regular expressions to improve

accuracy
Data identifiers are designed to protect personally identifiable information (PII) with very good
accuracy (<10% false positive rate). If a data identifier is available for the type of content you
want to protect, you should use the data identifier instead of a regular expression because
data identifiers are more efficient than regular expressions. Out-of-the-box data identifier
patterns are tuned for accuracy, including region, industry, and country nuances. In addition,
data identifiers include validation checks to verify the data matched by the pattern. This
additional layer of intelligence screens out test data and other triggers of false positive incidents.
Regular expressions, on the other hand, can be computationally expensive and can lead to
increased false positives.
For example, if you want to detect social security numbers (SSN), you would use the
Randomized US SSN data identifier instead of a regular expression pattern. The Randomized
US SSN data identifier is more accurate than any regular expression you could write and much
easier and quicker to implement.

Note: The data identifier pattern language is a limited subset of the regular expression language.
Not all regular expression constructs or characters are supported for data identifier patterns.
See “Using the data identifier pattern language” on page 669.

Clone system-defined data identifiers before modifying to preserve

original state
Before you modify a system data identifier or create a custom data identifier, consider the
following:
■ If you want to modify a system data identifier, manually clone it as a custom data identifier
and then modify the cloned copy. In this fashion you preserve the state of the original
system-defined data identifier.
■ Data identifiers do not export as part of a policy template. As such, you should add the
data identifier to a policy and export the policy as a template before modifying the data
identifier.
 Detecting content using data identifiers 683
Best practices for using data identifiers

An exported template contains a reference to each data identifier implemented in that

policy. On import to a target system, the template uses a reference to select the local data
identifier. If the system data identifier is modified, on import it cannot be recognized by the
target system.
See “Cloning a system data identifier before modifying it” on page 649.

Modify data identifier definitions when you want tuning to apply

globally
Data identifiers offer two levels of configuration:
■ Definitions
■ Instances
Data identifier definitions are configured at the system-level of the Enforce Server. At the
definition level you can tune the data supplied by any required validator that the definition
declares at this level, as well as what validators are used.
Data identifier instances can only configured at the policy rule level. Any configurations made
at the rule level are local in scope and applicable only to that policy. At the rule level you use
optional validators, such as require or exclude beginning or ending characters, to tune the
instance of the data identifier rule.
The general recommendation is to configure data identifier definitions so that the changes
apply globally to any instance of that data identifier definition. Such configurations are reusable
across policies. Rule-level optional validators, such as, should be used for unique policies.

Consider using multiple breadths in parallel to detect different

severities of confidential data
Matching data identifiers against content often requires fine-tuning as you adjust the
configuration to keep both false positives and false negatives to a minimum. After you configure
an instance of the Content Matches Data Identifier condition, study the matches and adjust
the configuration to ensure optimum data matching success.
Consider adjusting the data identifier breadth you are using if the data identifier is producing
too many false positive or negatives. For example, if you are using a wide breadth and receiving
many false positives, consider using a medium or narrow breadth.
See “About data identifier breadths” on page 622.
As an alternative approach, consider using multiple data identifier breadths in parallel in the
same rule with different severity levels for each rule. For example, in a single policy designed
to detect credit card numbers, you could add three rules to the policy, each using a different
breadth (one wide, one medium, one narrow). You would then set the severity for the narrow
to be high severity incidents, and the wide to be low severity incidents. Using this layered
 Detecting content using data identifiers 684
Best practices for using data identifiers

approach lets you survey the data flowing through the enterprise using a policy that covers
both ends of spectrum. You can use this sampling-based approach to focus your remediation
efforts on the highest-priority incidents while still detecting and being able to review low-severity
incidents.

Avoid matching on the Envelope over HTTP to reduce false positives

Sometimes HTTP transmissions contain session IDs in the header that can trigger false
positives for numeric data identifiers. For example, some social media sites such as Facebook
and LinkedIn contain a session ID that may at times match the CCN and SSN data identifiers
exactly, causing false positives.
To reduce false positives in connection with HTTP session IDs in the message header, the
best practice is not to match on the “Envelope” message component when implementing
numeric data identifiers, specifically the CCN or SSN data identifiers.

Use the Randomized US SSN data identifier to detect SSNs

In 2011, the United States Social Security Administration (SSA) began issuing randomized
SSNs. Under this scheme, the high group number (second part of the SSN) no longer
corresponds to the area number (first part of the SSN). Also, the range of the area number
can go up to 899 instead of 773. Randomization applies to SSNs issued on or after June 25,
2011. It does not apply to SSNs issued before that date.
To support the new randomized SSN scheme, Symantec Data Loss Prevention provides the
system-defined Randomized US Social Security Number (SSN) data identifier.
See “Randomized US Social Security Number (SSN)” on page 1015.
The Randomized US SSN data identifier detects both traditional and randomized SSNs. The
Randomized US SSN data identifier replaces the US SSN data identifier, which only detects
traditional SSNs. In addition, the patterns for the Randomized US SSN data identifier are
updated for version 14.0.
Symantec recommends that you use the Randomized US SSN data identifier for all new
policies that you want to use to detect SSNs, and that you update your existing SSN policies
to use the Randomized US SSN data identifier. For your existing policies that already implement
the traditional US SSN data identifier, you can add the Randomized US SSN data identifier
as an OR'd rule so that both run in parallel as you test the policy to ensure it accurately detects
both styles of SSNs.
See “Updating policies to use the Randomized US SSN data identifier” on page 665.
 Detecting content using data identifiers 685
Best practices for using data identifiers

Use unique match counting to improve accuracy and ease

remediation
The data identifier rule configuration contains an option to count only unique matches. With
this option selected (as opposed to the default setting which counts all matches), only unique
matches will be reported as the first match found in the message or message component.
Only unique matches are counted and highlighted.
The best practice is to use unique match counting when you only care about unique matches,
not duplicate matches. For example, if you are using the Credit Card Numbers data identifier
to protect credit card numbers, and you only care if a document contains 25 or more unique
numbers, you would use the count all unique matches option instead of the count all matches
option. If you counted all matches, a document containing 25 of the same CCNs would trigger
the policy, which is not the objective of your policy.
See “About unique match counting” on page 625.
 Chapter 27
Detecting content using
keyword matching
This chapter includes the following topics:

■ Introducing keyword matching

■ Configuring keyword matching

■ Best practices for using keyword matching

Introducing keyword matching

Symantec Data Loss Prevention provides the Content Matches Keyword policy condition for
keyword detection.
To detect data loss using keyword matching, the detection engine compares inbound messages
or message components against each keyword in a list of one or more keywords or keyword
phrases. Keyword matching supports both whole word and partial word matching, as well as
word proximity. Keyword matching is supported on the server and on the endpoint. Unique
match counting is supported for keywords.
See “Using unique match counting” on page 647.
Table 27-1 lists typical keyword matching use cases.
 Detecting content using keyword matching 687
Introducing keyword matching

Table 27-1 Keyword matching use cases

Configuration Typical use

Whole word matching Languages based on the Latin alphabet

UTF-8 characters

Chinese, Japanese, and Korean (CJK) languages with token verification enabled for the
server

CJK keywords on the endpoint

See “About keyword matching for Chinese, Japanese, and Korean (CJK) languages”
on page 687.

Partial word matching Languages based on the Latin alphabet

Mixed languages

See “Keyword matching examples” on page 689.

About keyword matching for Chinese, Japanese, and Korean (CJK)

languages
Symantec Data Loss Prevention version 14.0 and later detection servers support natural
language processing for Chinese, Japanese, and Korean (CJK) keywords. When natural
language processing for CJK languages is enabled, the detection server validates CJK tokens
before reporting a match. For CJK languages, a token is a single character which constitutes
a word. Thus, partial word matching does not apply to CJK languages.
Token validation for CJK keywords is only supported for detection servers and is disabled by
default. You must enable token validation for each detection server. In addition you must match
on whole words for token validation to apply.
On the endpoint you can use whole word matching for CJK keywords.
Table 27-2 summarizes keyword matching use cases for CJK languages.

Table 27-2 Keyword matching use cases for CJK languages

Detection component Use case

Server Enable token verification on the detection server and use whole word matching

See “Enabling and using CJK token verification for server keyword matching” on page 695.

Endpoint Use whole word matching

See “Keyword matching examples for CJK languages” on page 690.

 Detecting content using keyword matching 688
Introducing keyword matching

About keyword proximity

Using keyword proximity, a policy author can define a pair of keywords and specify a word
range between them. If the words occur within that range, a match is triggered. For example,
an instance of the Content Matches Keyword condition might require that any instance of
the words “confidential” and “information” occurring within 10 words of each other triggers a
match.
Alternatively, you can use keyword proximity to exclude matching words within a specified
distance by using the Content Matches Keyword condition as a detection exception. In this
case any occurrence of the words “confidential” and “information” within 10 words of each is
excepted from matching.
For Chinese, Japanese, and Korean (CJK) languages, a single CJK character is counted as
one word.
See “Keyword matching syntax” on page 688.
See “Keyword matching examples” on page 689.
See “Configuring the Content Matches Keyword condition” on page 692.

Keyword matching syntax

When you define a keyword rule, the system evaluates every keyword in the condition list
against each message component (header, subject, body, attachment).
Consider the following syntactical guidelines when creating keyword lists.

Table 27-3 Keyword matching syntax

Behavior Description

Whole word matching With whole word matching, keywords match at word boundaries only (\W in the regular
expression lexicon). Any characters other than A-Z, a-z, and 0-9 are interpreted as word
boundaries.

With whole word matching, keywords must have at least one alphanumeric character (a letter
or a number). A keyword consisting of only white-space characters, such as "..", is ignored.

Quotation marks Do not use quotation marks when you enter keywords or phrases because quotes are interpreted
literally and will be required in the match.

White space The systems strips out the white space before and after keywords or key phrases. Each
whitespace within a keyword phrase is counted. In addition to actual spaces, all characters
other than A-Z, a-z, and 0-9 are interpreted as white spaces.

Case sensitivity The case sensitivity option that you choose applies to all keywords in the list for that condition.
 Detecting content using keyword matching 689
Introducing keyword matching

Table 27-3 Keyword matching syntax (continued)

Behavior Description

Plurals and verb All plurals and verb inflections must be specifically listed. If the number of enumerations
inflections becomes complicated use the wildcard character (asterisk [*]) to detect a keyword suffix (in
whole word mode only).

Keyword phrases You can enter keyword phrases, such as social security number (without quotes). The system
looks for the entire phrase without returning matches on individual constituent words (such as
social or security).

Keyword variants The system only detects the exact keyword or key phrase, not variants. For example, if you
specify the key phrase social security number, detection does not match a phrase that
contains two spaces between the words.

Matching multiple The system implies an OR between keywords. That is, a message component matches if it
keywords contains any of the keywords, not necessarily all of them. To perform an ALL (or AND) keyword
match, combine multiple keyword conditions in a compound rule or exception.

Alpha-numeric During keyword matching, only a letter or a digit is considered a valid keyword start position.
characters Special characters (non-alphanumeric) are treated as delimiters (ignored). For example, the
ampersand character ("&") and the underscore character ("_") are special characters and are
not considered for keyword start position.

For example, consider the following:

____keyword__

Keyword

&&akeyword&&

123Keyword__

For these examples, the valid keyword start positions are as follows: k, K, a, and 1.
Note: This same behavior applies to keyword validators implemented in data identifiers.

Proximity The word distance (proximity value) is exclusive of detected keywords. Thus, a word distance
of 10 allows for a proximity window of 12 words.

Keyword matching examples

To implement keyword matching, you can enter one or more keywords or phrases, each
separated by a comma or newline character. You can match on whole or partial words, and
specify case sensitivity. You can use the asterisk (*) wildcard character to detect a keyword
suffix (in whole word mode only).
See “Keyword matching syntax” on page 688.
 Detecting content using keyword matching 690
Introducing keyword matching

Table 27-4 Keyword matching examples

Keyword type Keyword(s) Matches Does Not Match

keyword confidential confidential confidentially (in

whole word mode
-confidential;
only, otherwise it
®"confidential" would match)
®Confidential

®CONFIDENTIAL

key phrase internal use only internal use only internal use

internal use ONLY (if case

insensitive is selected)

keyword list Newline delimited: Comma delimited: hacks hackers

hack hack, hacker, hacks hack shack

hacker hacker

hacks

keyword with wildcard priv* private prize

privilege prevent

privy

privity

privs

priv

keyword dictionary account number, account ps, american If any keyword or phrase is amx
express, americanexpress, amex, bank present, the data is matched:
creditcard
card, bankcard, card num, card number,
cc #, cc#, ccn, check card, checkcard, amex master card
credit card, credit card #, credit card credit card car
number, credit card#, debit card,
debitcard, diners club, dinersclub, mastercard
discover, enroute, japanese card bureau,
jcb, mastercard, mc, visa, (etc....)

Keyword matching examples for CJK languages

Table 27-5 provides keyword matching examples for Chinese, Japanese, and Korean
languages. All examples assume that the keyword condition is configured to match on whole
words only.
 Detecting content using keyword matching 691
Introducing keyword matching

If token verification is enabled, the message size must be sufficient for the token validator to
recognize the language. For example: the message “東京都市部の人口” is too small fo a
message for the token validation process to recognize the language of the message. The
following message is a sufficient size for token validation processing:
今朝のニュースによると東京都市部の人口は増加傾向にあるとのことでした。 全国的な人口
減少の傾向の中、東京への一極集中を表しています。
See “About keyword matching for Chinese, Japanese, and Korean (CJK) languages”
on page 687.
Token validation for CJK language keywords is not available on the endpoint. To match CJK
on the endpoint, you configure the condition to match on whole words only.

Table 27-5 Keyword matching examples for CJK

Language Keyword Matches on server with Matches on server Matches on endpoint

token validation ON with token validation
OFF

Chinese 通信 数字无线通信 数字无线通信 交通信息 数字无线通信 交通信息网

网站 站

Japanese 京都市 京都府京都市左京区 京都府京都市左京区 東 京都府京都市左京区 東京

京都市部の人口 都市部の人

Korean 정부 정부의 방침 정부의 방침 의정부 경전 정부의 방침 의정부 경전

철 철

About updates to the Drug, Disease, and Treatment keyword lists

The Drug, Disease, and Treatment keyword lists are updated with current terminology based
on information from the U.S. Federal Drug Administration (FDA) and other sources. The Drug,
and Disease, and Treatment keyword lists are used by the HIPAA and HITECH (including
PHI) and Caldicott Report policy templates.
When you upgrade your Data Loss Prevention system, the generic, system-defined HIPAA
and Caldicott policy templates are updated with the recent Drug, Disease, and Treatment
keyword lists. However, policies you have created based on the HIPAA or Caldicott policy
templates are not automatically updated. This behavior is expected so that any changes or
customizations you have made to your HIPAA or Caldicott policy templates are not overwritten
by updates to the system-defined templates. Updating the Drug, Disease, and Treatment
keyword lists for your HIPAA and Caldicott policy templates is a manual process that you
should perform to ensure your HIPAA or Caldicott policies are up to date.
See “Updating the Drug, Disease, and Treatment keyword lists for your HIPAA and Caldicott
policies” on page 696.
 Detecting content using keyword matching 692
Configuring keyword matching

See “Keep the keyword lists for your HIPAA and Caldicott policies up to date” on page 698.
See “HIPAA and HITECH (including PHI) policy template” on page 1152.
See “Caldicott Report policy template” on page 1085.

Configuring keyword matching

Table 27-6 describes the components for implementing keyword matching.

Table 27-6 Implementing keyword matching

Keyword matching feature Description

Match on whole or partial keywords Separate each keyword or phrase by a newline or comma.
and key phrases
See “Keyword matching examples” on page 689.

Match on the wildcard asterisk (*) Match the wildcard at the end of a keyword, in whole word mode only.
character
See “Keyword matching examples” on page 689.

Keyword proximity matching Match across a range of keywords.

See “About keyword proximity” on page 688.

Find keywords Implement one or more keywords in data identifiers to refine the scope of
detection.

See “Introducing data identifiers” on page 612.

Policy rules and exceptions You can implement keyword matching conditions in policy rules and exceptions.

See “Configuring the Content Matches Keyword condition” on page 692.

Cross-component matching Keyword matching detects on one or more message components.

See “Detection messages and message components” on page 354.

Keyword dictionary If you have a large dictionary of keywords, you can index the keyword list.

See “Use VML to generate and maintain large keyword dictionaries” on page 699.

CJK token verification Enable on the detection server for CJK languages and match on whole words
only.

See Table 27-2 on page 687.

Configuring the Content Matches Keyword condition

The Content Matches Keyword condition lets you match content using keywords and key
phrases.
 Detecting content using keyword matching 693
Configuring keyword matching

See “Introducing keyword matching” on page 686.

You can implement keyword matching conditions in policy rules and exceptions.
See “Configuring policies” on page 376.
To configure the Content Matches Keyword condition
1 Add a new keyword condition to a policy rule or exception, or modify an existing one.
See “Configuring policy rules” on page 380.
See “Configuring policy exceptions” on page 389.
2 Configure the keyword matching parameters.
See Table 27-7 on page 693.
See “Keyword matching syntax” on page 688.
3 Save the policy.

Table 27-7 Configure the Content Matches Keyword condition

Action Description

Enter the match type. Select if you want the keyword match to be:

Case Sensitive or Case Insensitive

Case insensitive is the default.

Choose the keyword Select the keyword separator you to delimit multiple keywords:
separator.
Newline or Comma.

Newline is the default.

Match any keyword. Enter the keyword(s) or key phrase(s) you want to match. Use the separator you have selected
(newline or comma) to delimit multiple keyword or key phrase entries.

You can use the asterisk (*) wildcard character at the end of any keyword to match one or more
suffix characters in that keyword. If you use the asterisk wildcard character, you must match
on whole words only. For example, a keyword entry of confid* would match on "confidential"
and "confide," but not "confine." As long as the keyword prefix matches, the detection engine
matches on the remaining characters using the wildcard.

See “Keyword matching syntax” on page 688.

See “Keyword matching examples” on page 689.

 Detecting content using keyword matching 694
Configuring keyword matching

Table 27-7 Configure the Content Matches Keyword condition (continued)

Action Description

Configure keyword Keyword proximity matching lets you specify a range of detection among keyword pairs.
proximity matching
See “About keyword proximity” on page 688.
(optional).
To implement keyword proximity matching:

■ Select (check) the Keyword Proximity matching option in the "Conditions" section of the
rule builder interface.
■ Click Add Pair of Keywords.
■ Enter a pair of keywords.
■ Specify the Word distance.
The maximum distance between keywords is 999, as limited by the three-digit length of the
“Word distance” field. The word distance is exclusive of detected keywords. For example,
a word distance of 10 allows for a range of 12 words, including the two words comprising
the keyword pair.
■ Repeat the process to add additional keyword pairs.
The system connects multiple keyword pair entries the OR Boolean operator, meaning that
the detection engine evaluates each keyword pair independently.

Match on whole or Select the option On whole words only to match on whole keywords only (by default this
partial keywords. option is selected).

You must match on whole words only if you use the asterisk (*) wildcard character in any
keyword you enter in the list.

See “Keyword matching examples” on page 689.

You must match on whole words only if you have enabled token validation for the server.

See “Keyword matching examples for CJK languages” on page 690.

Configure match Keyword matching lets you specify how you want to count condition matches.
conditions. Select one of the following options:

■ Check for existence

The system reports one incident for all matches.
■ Count all matches and only report incidents with at least 1 matches (default)
With the default setting the system reports one incident for each match. Alternatively, you
can configure the match threshold by changing the default value from 1 to another value.

See “Configuring match counting” on page 384.

 Detecting content using keyword matching 695
Configuring keyword matching

Table 27-7 Configure the Content Matches Keyword condition (continued)

Action Description

Select components Keyword matching detection supports matching across message components.
to match on.
See “Selecting components to match on” on page 386.
Select one or more message components to match on:

■ Envelope – Header metadata used to transport the message

■ Subject – Email subject of the message (only applies to SMTP)
■ Body – The content of the message
■ Attachments – Any files attached to or transferred by the message

Note: On the endpoint the DLP Agent matches on the entire message, not individual
components.

See “Detection messages and message components” on page 354.

Also match one or Select this option to create a compound condition. All conditions must be met to report a match.
more additional
You can Add any available condition from the list.
conditions.
See “Configuring compound match conditions” on page 392.

Enabling and using CJK token verification for server keyword

matching
To use token verification for Chinese, Japanese, and Korean (CJK) languages you must enable
it on the server and you must use whole word matching for the keyword condition. In addition,
there must be a sufficient amount of message text for the system to recognize the language.
See “Keyword matching examples for CJK languages” on page 690.
Table 27-8 lists and describes the detection server parameter that lets you enable token
verification for CJK languages.

Table 27-8 Keyword token verification parameter

Setting Default Description

Keyword.TokenVerifierEnabled false Default is disabled ("false").

If enabled ("true"), the server validates tokens for Chinese,

Japanese, and Korean language keywords.

Enable keyword token verification for CJK describes how to enable and use token verification
for CJK keywords.
 Detecting content using keyword matching 696
Configuring keyword matching

Enable keyword token verification for CJK

1 Log on to the Enforce Server as an administrative user.
2 Navigate to the System > Servers and Detectors > Overview > Server/Detector Detail
- Advanced Settings screen for the detection server or detector you want to configure.
See “Advanced server settings” on page 245.
3 Locate the parameter Keyword.TokenVerifierEnabled.
4 Change the value to true from false (default).
Setting the server parameter Keyword.TokenVerifierEnabled = true enables token
validation for CJK keyword detection.
5 Save the detection server configuration.
6 Recycle the detection server.
7 Configure a keyword condition using whole word matching.
In the condition the option Match On whole word only is checked.
See “Configuring the Content Matches Keyword condition” on page 692.

Updating the Drug, Disease, and Treatment keyword lists for your
HIPAA and Caldicott policies
If you have created a policy derived from the HIPAA or Caldicott template and have not made
any changes or customizations to the derived policy, after upgrade you can create a new policy
from the appropriate template and remove the old policy from production. If you have made
changes to a policy derived from either the HIPAA or Caldicott policy template and you want
to preserve these changes, you can copy the updated keyword lists from either the HIPAA or
Caldicott policy template and use the copied keyword lists to update your HIPAA or Caldicott
policies.
See “About updates to the Drug, Disease, and Treatment keyword lists” on page 691.
See “Keep the keyword lists for your HIPAA and Caldicott policies up to date” on page 698.
To update the Drug, Disease, and Treatment keyword lists for HIPAA and Caldicott policies
provides instructions for updating the keyword lists for your HIPAA and Caldicot policies.
To update the Drug, Disease, and Treatment keyword lists for HIPAA and Caldicott policies
1 Create a new policy from a template and choose either the HIPAA or Caldicott template.
See “Creating a policy from a template” on page 360.
2 Edit the detection rules for the policy.
See “Configuring policy rules” on page 380.
 Detecting content using keyword matching 697
Best practices for using keyword matching

3 Select the Patient Data and Drug Keywords (Keyword Match) rule.
4 Select the Content Matches Keyword condition.
5 Select all the keywords in the Match any Keyword data field and copy them to the
Clipboard.
6 Paste the copied keywords to a text file named Drug Keywords.txt.
7 Cancel the rule edit operation to return to the policy Detection tab.
8 Repeat the same process for the Patient Data and Treatment Keywords (Keyword
Match) rule.
9 Copy and paste the keywords from the condition to a text file named Treatment
Keywords.txt.

10 Repeat the same process for the Patient Data and Disease Keywords (Keyword Match)
rule.
11 Copy and paste the keywords from the condition to a text file named Disease
Keywords.txt.

12 Update your HIPAA and Caldicott policies derived from the HIPAA or Caldicott templates
using the keyword *.txt files you created.
13 Test your updated HIPAA and Caldicott policies.

Best practices for using keyword matching

The Content Matches Keyword condition lets you match content using keywords, key phrases,
and keyword lists or dictionaries. On the server, the keyword rule matches on the header,
subject, body and attachment message components, and it supports cross-component matching.
On the endpoint the keyword condition matches on the entire message.
Table 27-9 summarizes the keyword matching best practices in this section.

Table 27-9 Summary of keyword matching best practices

Best practice More information

Enable linguistic validation for CJK keyword See “Enable token verification on the server to reduce false
detection on the server. positives for CJK keyword detection” on page 698.

Update keyword lists for your Caldicott and HIPAA See “Keep the keyword lists for your HIPAA and Caldicott policies
policies. up to date” on page 698.

Tune keyword validators to improve data identifier See “Tune keywords lists for data identifiers to improve match
accuracy. accuracy” on page 699.
 Detecting content using keyword matching 698
Best practices for using keyword matching

Table 27-9 Summary of keyword matching best practices (continued)

Best practice More information

Use VML to profile long keyword lists and See “Use VML to generate and maintain large keyword
dictionaries dictionaries” on page 699.

Use keyword matching for metadata detection. See “Use keyword matching to detect document metadata”
on page 699.

Enable token verification on the server to reduce false positives for

CJK keyword detection
Symantec Data Loss Prevention provides token validation for Chinese, Japanese, and Korean
(CJK) languages. Token validation is supported for detection servers and must be enabled.
See “About keyword matching for Chinese, Japanese, and Korean (CJK) languages”
on page 687.
Token validation lets you match CJK keywords using whole word matching, and improves
overall match accuracy for CJK languages. Although there may be a slight performance hit,
you should enable token verification for each detection server where CJK keyword conditions
are deployed. Once enabled you can use whole word matching for CJK keywords.
See “Enabling and using CJK token verification for server keyword matching” on page 695.

Keep the keyword lists for your HIPAA and Caldicott policies up to
date
For each Symantec Data Loss Prevention relese, the Drug, Disease, and Treatment keyword
lists are updated based on information from the U.S. Federal Drug Administration (FDA) and
other sources. These keyword lists are used in the HIPAA and HITECH (including PHI) and
Caldicott Report policy templates.
See “About updates to the Drug, Disease, and Treatment keyword lists” on page 691.
If you have upgraded to the latest Data Loss Prevention version and you have existing policies
derived from either the HIPAA or Caldicott policy template, consider updating your HIPAA and
Caldicott policies to use the Drug, Disease, and Treatment keyword lists provided with this
Data Loss Prevention version.
See “Updating the Drug, Disease, and Treatment keyword lists for your HIPAA and Caldicott
policies” on page 696.
 Detecting content using keyword matching 699
Best practices for using keyword matching

Tune keywords lists for data identifiers to improve match accuracy

Many data identifier definitions contain required keyword validators with pre-populated keyword
lists. In addition, you can add your own list of keywords to a data identifier rule. The best
practice is tune the keyword list using a keyword matching condition before you add the keyword
list to the data identifier condition as a required or optional validator
See “Using pattern validators” on page 672.
To tune the keyword list, take the keywords you want to use for the validator and put them into
a separate keyword matching rule condition and policy. Then test the policy using data that
should and should not match the keywords. The keyword rule will let you see match highlighting
and tune the keyword list. Once tested, you can add the keywords to the data identifier and
then test the data identifier policy to ensure accuracy.

Use keyword matching to detect document metadata

Symantec Data Loss Prevention supports metadata detection for certain document formats,
such as DOCX and PDF. Detection servers and DLP Agents support metadata detection.
If you want to detect document metadata, the recommendation is to enable it for the server or
endpoint and use the Content Matches Keyword condition to match metadata tags.
See “Detecting Symantec Information Centric Tagging (ICT) classifications ” on page 342.

Use VML to generate and maintain large keyword dictionaries

Sometimes you may want to protect a long list or dictionary of keywords. An example might
be a list of project code names. You can use Vector Machine Learning (VML) to automate the
detection of long keyword lists that are difficult to generate, tune, and maintain. For example,
you could generate a VML profile based on a collection of documents containing the keywords
you want to detect. If you want to detect common words, remove them from the VML stopword
file.
See “Best practices for using VML” on page 587.
 Chapter 28
Detecting content using
regular expressions
This chapter includes the following topics:

■ Introducing regular expression matching

■ About the updated regular expression engine

■ About writing regular expressions

■ Configuring the Content Matches Regular Expression condition

■ Best practices for using regular expression matching

Introducing regular expression matching

Data Loss Prevention provides the Content Matches Regular Expression policy match
condition to match message content using the regular expression pattern language.
Regular expressions provide a mechanism for identifying strings of text, such as particular
characters, words, or patterns of characters. You can use the regular expression condition to
match (or exclude from matching) characters, patterns, and strings. Unique match counting
is supported for regular expressions.
See “Using unique match counting” on page 647.
See “Configuring the Content Matches Regular Expression condition” on page 702.
See “Best practices for using regular expression matching” on page 703.
 Detecting content using regular expressions 701
About the updated regular expression engine

About the updated regular expression engine

Detection servers and endpoint agents use a common regular expression engine. This common
engine performs regular expression evaluation at a faster rate than previous engines. You will
also notice performance improvements when you have DLP policy sets with many regex rules,
since adding more rules doesnt incur much of a performance cost.

About writing regular expressions

Symantec Data Loss Prevention implements the PCRE-compatible regular exp'ression syntax
for policy condition matching. Table 28-1 provides some reference constructs for writing regular
expressions to match or exclude characters in messages or message components.
See “Introducing regular expression matching” on page 700.

Note: Data Identifier pattern matching is based on the regular expression syntax. However,
not all regular expression constructs listed in the table below are supported by Data Identifier
patterns. See “About data identifier patterns” on page 623.

Table 28-1 Regular expression constructs

Regular expression Description

construct

. Any single character (except for newline characters)

Note: The use of the dot (.) character is not supported for data identifier patterns.

\d Any digit (0-9)

\s Any white space

\w Any word character (a-z, A-Z, 0-9, _)

Note: The use of the \w construct does not match the underscore (_) character when
implemented in a data identifier pattern.

\D Anything other than a digit

\S Anything other than white space

[] Elements inside brackets are a character class (For example, [abc] matches 1 character:
a, b, or c.)

^ At the beginning of a character class, negates it (For example, [^abc] matches anything
except a, b, or c.)
 Detecting content using regular expressions 702
Configuring the Content Matches Regular Expression condition

Table 28-1 Regular expression constructs (continued)

Regular expression Description

construct

+ Following a regular expression means 1 or more (For example, \d+ means 1 or more digit.)

? Following a regular expression means 0 or 1 (For example, \d? means 1 or no digits.)

* Following a regular expression means any number (For example, \d* means 0, 1, or more
digits.)

(?i) At the beginning of a regular expression makes the expression case-insensitive (Regular
expressions are case-sensitive by default.)

(?: ) Groups regular expressions together (The ?: is a slight performance enhancement.)

(?u) Makes a period (.) match even newline characters

| Means OR (For example, A|B means regular expression A or regular expression B.)

Configuring the Content Matches Regular Expression

condition
You use the Content Matches Regular Expression condition to match (or exclude from
matching) characters, patterns, and strings using regular expressions.
See “Introducing regular expression matching” on page 700.
To configure the Content Matches Regular Expression condition
1 Add a Content Matches Regular Expression condition to a policy, or edit an existing
one.
See “Configuring policies” on page 376.
See “Configuring policy rules” on page 380.
See “Configuring policy exceptions” on page 389.
2 Configure the Content Matches Regular Expression condition parameters.
See Table 28-2 on page 703.
3 Save the policy configuration.
 Detecting content using regular expressions 703
Best practices for using regular expression matching

Table 28-2 Content Matches Regular Expression parameters

Action Description

Match regex. Specify a regular expression to be matched.

See “About writing regular expressions” on page 701.

Configure match Configure how you want to count matches.

counting.
See “Configuring match counting” on page 384.

Check for existence reports a match count of 1 if there are one or more matches. For
compound rules or exceptions, all conditions must be configured this way.

Count all matches reports the sum of all matches; applies if any condition uses this
parameter.

Match on one or more Configure cross-component matching by selecting one or more message components to
message components. match on.

■ Envelope – The header of the message, transport metadata.

■ Subject – The email subject (only applies to email messages).
■ Body – The content of the message.
■ Attachments – The content of any files that are attached to or transported by the
message.

See “Selecting components to match on” on page 386.

Also match one or more Select this option to create a compound condition. All conditions must match to trigger or
additional conditions. except an incident.

You can Add any available condition from the list.

See “Configuring compound match conditions” on page 392.

Best practices for using regular expression matching

This section provides considerations for implementing the Content Matches Regular
Expression match condition in your Data Loss Prevention policies.
See “Introducing regular expression matching” on page 700.
Table 28-3 summarizes the regular expression matching best practices in this section.

Table 28-3 Regular expressions best practices

Best practice Description

Use Data Identifiers instead of regular expressions where See “Use regular expressions sparingly to support efficient
possible. performance” on page 705.
 Detecting content using regular expressions 704
Best practices for using regular expression matching

Table 28-3 Regular expressions best practices (continued)

Best practice Description

Use regular expressions sparingly to support efficient policy See “Test regular expressions before deployment to
performance. improve accuracy” on page 705.

Use look ahead and behind characters to improve regular See “Use look ahead and look behind characters to
expression performance. improve regular expression accuracy” on page 704.

Test regular expressions for accuracy and performance. See “Test regular expressions before deployment to
improve accuracy” on page 705.

When to use regular expression matching

Data Identifiers are more efficient than regular expressions because the Data Identifier patterns
are tuned for accuracy and the data is validated. For example, if you want to search for social
security numbers, use the US Social Security Number (SSN) Data Identifier instead of a regular
expression.
The regular expression condition is useful for matching or excepting unique data types for
which there are no system-provided Data Identifiers. Examples of these include internal account
numbers and data types that can vary greatly in length, such as email addresses.

Use look ahead and look behind characters to improve regular

expression accuracy
Symantec Data Loss Prevention implements a significant enhancement to improve the
performance of regular expressions. To achieve improved regular expression performance,
the look ahead and look behind sections must exactly match one of the supported standard
sections.
Table 28-4 lists the standard look ahead and look behinds sections that this performance
improvement supports. If either section differs even slightly, that section is executed as part
of the regular expression without the performance improvement.
See “About writing regular expressions” on page 701.

Table 28-4 Look ahead and look behind standard sections

Operation Construct

Look ahead (?=(?:[^-\w])|$)

 Detecting content using regular expressions 705
Best practices for using regular expression matching

Table 28-4 Look ahead and look behind standard sections (continued)

Operation Construct

Look behind (?<=(^|(?:[^)+\d][^-\w+])))

and

(?<=(^|(?:[^)+\d][^-\w+])|\t))

Use regular expressions sparingly to support efficient performance

Regular expressions can be computationally expensive. If you add a regular expression
condition, observe the system for one hour. Make sure that the system does not slow down
and that there are no false positives.

Test regular expressions before deployment to improve accuracy

If you implement regular expression matching, consider using a third-party tool to test the
regular expressions before you deploy the policy rules to production. The recommended tool
is RegexBuddy. Another good tool for testing your regular expressions is RegExr.
 Chapter 29
Detecting international
language content
This chapter includes the following topics:

■ Detecting non-English language content

■ Best practices for detecting non-English language content

Detecting non-English language content

Symantec Data Loss Prevention detection features support many localized versions of Microsoft
Windows operating systems. To use international character sets, the Windows system on
which you view the Enforce Server administration console must have the appropriate
capabilities.
See “About support for character sets, languages, and locales” on page 74.
See “Working with international characters” on page 77.
You can create policies and detect violations using any supported language. You can use
localized keywords, regular expressions, and Data Profiles to detect data loss. In addition,
Symantec Data Loss Prevention offers several international data identifiers and policy templates
for protecting confidential data.
See “Supported languages for detection” on page 75.
See “Use international policy templates for policy creation” on page 707.
See “Use custom keywords for system data identifiers” on page 708.
 Detecting international language content 707
Best practices for detecting non-English language content

Best practices for detecting non-English language

content
This section provides some best practices for implementing non-English language conent
detection.

Upgrade to the latest version of Data Loss Prevention

Symantec Data Loss Prevention version 14.0 includes several enhancements for Asian
language detection, including multi-token EDM and linguistic validation for Chinese, Japanese,
and Korean (CJK) keywords. To take advantage of these enhancements, upgrade your servers
to the latest version and update your Exact Data profiles.
See “Updating EDM indexes to the latest version” on page 470.
See “Enable token validation to match Chinese, Japanese, and Korean keywords on the server”
on page 710.

Use international policy templates for policy creation

Symantec Data Loss Prevention provides several international policy templates that you can
quickly deploy in your enterprise.
See “Creating a policy from a template” on page 360.

Table 29-1 International policy templates

Policy template Description

Canadian Social Insurance Numbers This policy detects patterns indicating Canadian social insurance numbers.

See “Canadian Social Insurance Numbers policy template” on page 1086.

Caldicott Report This policy protects UK patient information.

See “Caldicott Report policy template” on page 1085.

UK Data Protection Act 1998 This policy protects personal identifiable information.

See “Data Protection Act 1998 policy template” on page 1092.

EU Data Protection Directives This policy detects personal data specific to the EU directives.

See “Data Protection Directives (EU) policy template” on page 1094.

UK Human Rights Act 1998 This policy enforces Article 8 of the act for UK citizens.

See “Human Rights Act 1998 policy template” on page 1156.

 Detecting international language content 708
Best practices for detecting non-English language content

Table 29-1 International policy templates (continued)

Policy template Description

PIPEDA (Canada) This policy detects Canadian citizen customer data.

See “PIPEDA policy template” on page 1172.

SWIFT Codes (International banking) This policy detects codes that banks use to transfer money across
international borders.

See “SWIFT Codes policy template” on page 1187.

UK Drivers License Numbers This policy detects UK Drivers License Numbers.

See “UK Drivers License Numbers policy template” on page 1188.

UK Electoral Roll Numbers This policy detects UK Electoral Roll Numbers.

See “UK Electoral Roll Numbers policy template” on page 1188.

UK National Insurance Numbers This policy detects UK National Insurance Numbers.

See “UK National Insurance Numbers policy template” on page 1189.

UK National Health Service Number This policy detects personal identification numbers issued by the NHS.

See “UK National Health Service (NHS) Number policy template” on page 1189.

UK Passport Numbers This policy detects valid UK passports.

See “UK Passport Numbers policy template” on page 1189.

UK Tax ID Numbers This policy detects UK Tax ID Numbers.

See “UK Tax ID Numbers policy template” on page 1190.

Use custom keywords for system data identifiers

Data identifiers offer broad support for detecting international content.
See “Introducing data identifiers” on page 612.
Some international data identifiers offer a wide breadth of detection only. In this case you can
implement the Find Keywords optional validator to narrow the scope of detection. Implementing
this optional validator may help you eliminate any false positives that your policy matches.
See “Selecting a data identifier breadth” on page 629.
The following table provides keywords for several international data identifiers.
 Detecting international language content 709
Best practices for detecting non-English language content

To use international keywords for system data identifiers

1 Create a policy using one of the system-provided international data identifiers that is listed
in the table.
Table 29-2
2 Select the Find Keywords optional validator.
See “Configuring the Content Matches data identifier condition” on page 628.
3 Copy and past the appropriate comma-separated keywords from the list to the Find
Keywords optional validator field.
See “Configuring optional validators” on page 644.

Table 29-2 International data identifiers and keyword lists

Data Identifier Language Keywords English Translation

Burgerservicenummer Dutch Persoonsnummer, sofinummer, person number, social-fiscal

(BSN) sociaal-fiscaal nummer, number (abbreviation),
persoonsgebonden social-fiscal number,
person-related number

Codice Fiscale Italian codice fiscal, dati anagrafici, partita tax code, personal data, VAT
I.V.A., p. iva number, VAT number

French INSEE Code French INSEE, numéro de sécu, code sécu INSEE, social security number,
social security code

Hong Kong ID Chinese 身份證 , 三顆星 Identity card, Hong Kong

(Traditional) permanent resident ID Card

International Bank French Code IBAN, numéro IBAN IBAN Code, IBAN number
Account Number (IBAN)
Central

International Bank French Code IBAN, numéro IBAN IBAN Code, IBAN number
Account Number (IBAN)
East

International Bank French Code IBAN, numéro IBAN IBAN Code, IBAN number
Account Number (IBAN)
West

People's Republic of Chinese 身份证,居民信息,居民身份信息 Identity Card, Information of

China ID (Simplified) resident, Information of resident
identification

South Korea Resident Korean 주민등록번호, 주민번호 Resident Registration Number,

Registration Number Resident Number
 Detecting international language content 710
Best practices for detecting non-English language content

Table 29-2 International data identifiers and keyword lists (continued)

Data Identifier Language Keywords English Translation

Spanish DNI ID Spanish DNI DNI

Swiss AHV Number French Numéro AVS, numéro d'assuré, AVS number, insurance number,
identifiant national, numéro national identifier, national
d'assurance vieillesse, numéro de insurance number, social security
sécurité soclale, Numéro AVH number, AVH number

German AHV-Nummer, Matrikelnumme, AHV number, Swiss Registration

Personenidentifikationsnummer number, PIN

Italian AVS, AVH AVS, AVH

Taiwan ID Chinese 中華民國國民身分證 Taiwan ID

(Traditional)

Enable token validation to match Chinese, Japanese, and Korean

keywords on the server
The Content Matches Keyword condition supports both whole word and partial word matching.
Symantec Data Loss Prevention detection servers support natural language processing for
Chinese, Japanese, and Korean (CJK) language keywords. If you want to detect CJK keywords,
the recommendation is to enable token validation on the detection server and to use whole
word matching for the keyword condition.
The DLP Agent does not support token validation for CJK. On the endpoint, for CJK and
mixed-language keyword matching, consider using partial word matching.
With whole word matching, keywords match at word boundaries only (\W in the regular
expression lexicon). Any characters other than A-Z, a-z, and 0-9 are interpreted as word
boundaries. With whole word matching, keywords must have at least one alphanumeric
character (a letter or a number). A keyword consisting of only white-space characters, such
as "..", is ignored.
See “About keyword matching for Chinese, Japanese, and Korean (CJK) languages”
on page 687.
 Chapter 30
Detecting file properties
This chapter includes the following topics:

■ Introducing file property detection

■ Configuring file property matching

■ Best practices for using file property matching

Introducing file property detection

Symantec Data Loss Prevention provides various methods for detecting the context of
messages, files, and attachments. You can detect the type, size, and name of files and
attachments. You can also use these conditions to except files and attachments from matching.
See “About file type matching” on page 711.
See “About file size matching” on page 713.
See “About file name matching” on page 714.
See “Configuring file property matching” on page 714.

About file type matching

You use the Message Attachment or File Type Match condition to match the file type of a
message attachment. Symantec Data Loss Prevention supports the identification of over 300
file types.
See “Supported formats for file type identification” on page 761.
Example uses of message attachment and file type matching are as follows:
■ A certain type of document should never leave the organization (such as a PGP document
or AutoCAD file).
 Detecting file properties 712
Introducing file property detection

■ A certain type of match is likely to occur only in a document of a certain type, such as a
Word document.
The detection engine does not rely on the file name extension to match file format type. For
example, if a user changes the .mp3 file name extension to .doc and emails the file, the
detection engine can still register a match because it checks the binary signature of the file to
detect it as an MP3 file.

Note: File type matching does not detect the content of the file; it only detects the file type
based on its binary signature. To detect content, use a content matching condition.

See “Configuring the Message Attachment or File Type Match condition” on page 715.
See “About custom file type identification” on page 712.

About file format support for file type matching

Symantec Data Loss Prevention supports over 300 file formats for file type identification using
the Message Attachment or File Type Match policy condition.
Refer to the following link for a complete list of file formats that can be recognized by this policy
condition.
See “Supported formats for file type identification” on page 761.

About custom file type identification

If the type of file you want to detect is not supported as a system default file type, Symantec
Data Loss Prevention provides you with the ability to identify custom file types using scripts.
To detect a custom file type, you use the Symantec Data Loss Prevention Scripting Language
to write a custom script that detects the binary signature of the file format that you want to
protect. To implement this match condition you need to enable it on the Enforce Server.
See “Enabling the Custom File Type Signature condition in the policy console” on page 719.
See “Configuring the Custom File Type Signature condition” on page 719.
Refer to the Symantec Data Loss Prevention Detection Customization Guide for the language
syntax and examples.

Note: The Symantec Data Loss Prevention Scripting Language only identifies custom file
formats; it does not extract content from custom file types.
 Detecting file properties 713
Introducing file property detection

About file size matching

Use Message Attachment or File Size Match to detect content based on the size of particular
email message components.
See “Detection messages and message components” on page 354.
You can also detect matches for the number of files attached to email for SMTP.
The condition you choose when you configure this rule determines how a match is detected.
You choose from these options:
■ Single – This condition detects a match when the body of an email message or an email
attachment meets or exceeds the file size you specify. Detection is based on the each
component individually.
For example, you could specify a condition where the single file size is more than 50 KB
(kilobytes). An email message with a 20 KB body, and a single 51 KB email attachment
matches because the detected attachment exceeds 50 KB. However, an email message
with a 20 KB body, and a two 20 KB email attachments does not match. Even though the
entire message is more than 50 KB, each component is less than 50 KB. This rule does
not combine the total size of the body or the attached email files.
■ Total Attachment File Size – This condition, for SMTP only, detects a match when the
size of a single or combined email attachments meets or exceeds the file size criteria you
specify. Detection is based solely on the email attachments and does not factor in the body
of the email message.
For example, you could specify a condition where the total file size is more than 50 KB
(kilobytes). An email message with a 20 KB body, and a single 40 KB email attachment
does not match because while the total email exceeds 50 KB, the condition does not factor
in the body of the email message. However, an email message with a 20 KB body, and a
two 30 KB email attachments does match, because the two file attachments exceed 50
KB. In addition, an email with a 40 KB ZIP archive file attached would not match, even if
the extracted size of the files in that archive exceeded 50 KB.
The default value for the Total Attachment File Size condition is zero. This condition has
a character limit of four digits. You will encounter validation errors if you include decimal
points or other characters when specifying this value.
■ Total Attachment File Count – This condition, for SMTP only, detects a match when the
number of combined email attachments meets or exceeds the file count criteria you specify.
Detection is based solely on the combined number of direct email attachments. For example,
you could specify a condition where the total file count is more than five files. An email with
six files attached would match this condition, but an email with a single ZIP archive file
attachment would not match, even if the ZIP archive contained 20 files.
The default value for the Total Attachment File Count condition is zero. This condition
has a character limit of seven digits. You will encounter validation errors if you include
decimal points or other characters when specifying this value.
 Detecting file properties 714
Configuring file property matching

Note: If the Total Attachment File Size and Total Attachment File Count conditions are
ANDed together with a content matching rule, the rules will be applied to all message
components. Components will only match one condition in an incident, even if they violate
more than one of the conditions.

The Total Attachment File Size and Total Attachment File Count rules are available on
both Windows and Mac endpoints. On Windows, they apply to Microsoft Outlook and IBM
(Lotus) Notes events. On Mac, they apply to Outlook for Mac events.
See “Configuring the Message Attachment or File Size Match condition” on page 716.

About file name matching

You use the Message Attachment or File Name Match condition to detect the names of files
and attachments.
See “File name matching syntax” on page 718.
See “File name matching examples” on page 718.
See “Configuring the Message Attachment or File Name Match condition” on page 717.

Configuring file property matching

Table 30-1 lists the conditions available for implementing file property matching.

Table 30-1 File Properties match conditions

Match condition Description

Message Attachment or File Detect or except specific files and attachments by type.
Type Match
See “About file type matching” on page 711.

See “Configuring the Message Attachment or File Type Match condition” on page 715.

Message Attachment or File Detect or except specific files and attachments by size.
Size Match
See “About file size matching” on page 713.

See “Configuring the Message Attachment or File Size Match condition” on page 716.

Message Attachment or File Detect or except specific files and attachments by name.
Name Match
See “About file name matching” on page 714.

See “Configuring the Message Attachment or File Name Match condition” on page 717.

Custom File Type Signature Detect or except custom file types.

 Detecting file properties 715
Configuring file property matching

Configuring the Message Attachment or File Type Match condition

The Message Attachment or File Type Match condition matches the file type of an attachment
message component. You can configure an instance of this condition in policy rules and
exceptions.
See “About file type matching” on page 711.
To configure the Message Attachment or File Type Match condition
1 Add a Message Attachment or File Type Match condition to a policy rule or exception,
or edit an existing one.
See “Configuring policies” on page 376.
See “Configuring policy rules” on page 380.
See “Configuring policy exceptions” on page 389.
2 Configure the Message Attachment or File Type Match condition parameters.
See Table 30-2 on page 715.
3 Click Save to save the policy.

Table 30-2 Message Attachment or File Type Match condition parameters

Action Description

Select the file type or types Select all of the formats you want to match.
to match.
See “Supported formats for file type identification” on page 761.

Click select all or deselect all to select or deselect all formats.

To select all formats within a certain category (for example, all word-processing formats),
click the section heading.

The system implies an OR operator among all file types you select. For example, if you
select Microsoft Word and Microsoft Excel file type attachments, the system detects all
messages with Word or Excel documents attached, not messages with both attachment
types

Match on attachments only. This condition only matches on the Message Attachments component.

See “Detection messages and message components” on page 354.

Also match on one or more Select this option to create a compound condition. All conditions must match to trigger
additional conditions. or except an incident.

You can Add any condition available from the list.

See “Configuring compound match conditions” on page 392.

 Detecting file properties 716
Configuring file property matching

Configuring the Message Attachment or File Size Match condition

The Message Attachment or File Size Match condition matches or excludes from matching
files of a specified size. You can configure an instance of this condition in policy rules and
exceptions.
See “About file size matching” on page 713.
To configure the Message Attachment or File Size Match condition
1 Add Message Attachment or File Size Match to a policy, or edit a policy that already
contains this rule.
See “Configuring policies” on page 376.
See “Configuring policy rules” on page 380.
See “Configuring policy exceptions” on page 389.
2 Select the Message Attachment or File Type Match condition:
See Table 30-3 on page 716.
3 Click Save to save the policy.

Table 30-3 Message Attachment or File Size Match parameters

Action Description

Single File Size Select More Than to specify the minimum file size of the file to match or Less Than to
specify the maximum file size to qualify a match.

Enter a number, and select the unit of measure: bytes, kilobytes (KB), megabytes (MB),
or gigabytes (GB).

Total Attachment File Size Enter a number, and select the unit of measure: bytes, kilobytes (KB), megabytes (MB),
or gigabytes (GB) to qualify a match.

Total Attachment File Enter a number to specify the number of files to qualify a match
Count

Match on the. Select one or both of the following message components on which to base the match:

■ Envelope – The option is not applicable for these options.

■ Subject – The option is not applicable for these options.
■ Body – The content of the message (This option applies only to Single File Size).
■ Attachments – Any files that are attached to or transferred by the message.

See “Selecting components to match on” on page 386.

 Detecting file properties 717
Configuring file property matching

Table 30-3 Message Attachment or File Size Match parameters (continued)

Action Description

Also match one or more Select this option to create a compound condition. All conditions must match to trigger or
additional conditions. except an incident.

You can Add any condition available from the list.

See “Configuring compound match conditions” on page 392.

Configuring the Message Attachment or File Name Match condition

The Message Attachment or File Name Match condition matches based on the name of a
file attached to the message. You can configure an instance of this condition in policy rules
and exceptions.
See “About file name matching” on page 714.
To configure the Message Attachment or File Name Match condition
1 Add a Message Attachment or File Name Match condition to a policy, or edit an existing
one.
See “Configuring policies” on page 376.
See “Configuring policy rules” on page 380.
See “Configuring policy exceptions” on page 389.
2 Configure the Message Attachment or File Type Match condition parameters.
See Table 30-4 on page 717.
3 Click Save to save the policy.

Table 30-4 Message Attachment or File Name Match parameters

Action Description

Specify the File Name. Specify the file name to match using the DOS pattern matching language to represent
patterns in the file name.

Separate multiple matching patterns with commas or by placing them on separate lines.

See “File name matching syntax” on page 718.

See “File name matching examples” on page 718.

Match on attachments. This condition only matches on the Message Attachments component.

See “Detection messages and message components” on page 354.

 Detecting file properties 718
Configuring file property matching

Table 30-4 Message Attachment or File Name Match parameters (continued)

Action Description

Also match one or more Select this option to create a compound condition. All conditions must match to trigger or
additional conditions. except an incident.

You can Add any condition available from the list.

See “Configuring compound match conditions” on page 392.

File name matching syntax

For file name matching, the system supports the DOS pattern matching syntax to detect file
names, including wildcards.
See “About file name matching” on page 714.
Any characters you enter (other than the DOS operators) match exactly. To enter multiple file
names, enter them as comma-separated values or by line space.
Table 30-5 describes the syntax for the Message Attachment or File Name Match condition.

Table 30-5 DOS Operators for file name detection

Operator Description

. Use a dot to separate the file name and the extension.

* Use an asterisk as a wild card to match any number of characters (including none).

? Use a question mark to match a single character.

File name matching examples

Table 30-6 lists some examples for matching file names using the Message Attachment or
File Name condition.
See “About file name matching” on page 714.

Table 30-6 File name matching examples

Match objective Example

To match a Word file name that begins with ENG- followed ENG-????????.doc
by any eight characters:

If you are not sure that it is a Word document: ENG-????????.*

If you are not sure how many characters are in the name: ENG-*.*
 Detecting file properties 719
Configuring file property matching

Table 30-6 File name matching examples (continued)

Match objective Example

To match all file names that begin with ENG- and all file Enter as comma separated values:
names that begin with ITA-:
ENG-*.*,ITA-*

Or separate the file names by line space:

ENG-*.*

ITA-*

Enabling the Custom File Type Signature condition in the policy

console
By default the Custom File Type Signature policy condition is not enabled. To implement the
Custom File Type Signature condition, you must first enable it.
See “About custom file type identification” on page 712.
To enable the Custom File Type Signature rule
1 Using a text editor, open the file \SymantecDLP\Protect\config\Manager.properties
2 Set the value of the following parameter to "true":
com.vontu.manager.policy.showcustomscriptrule=true

3 Stop and then restart the Vontu Manager service.

4 Log back on to the Enforce Server Administration Console and add a new blank policy.
5 Add a new detection rule or exception and beneath the File Properties heading you should
see the Custom File Type Signature condition.
6 Configure the condition with your custom script.
See “Configuring the Custom File Type Signature condition” on page 719.

Configuring the Custom File Type Signature condition

The Custom File Type Signature condition matches custom file types that you have scripted.
You can implement the Custom File Type Signature condition in policy rules and exceptions.
See “About custom file type identification” on page 712.
See “Enabling the Custom File Type Signature condition in the policy console” on page 719.
 Detecting file properties 720
Best practices for using file property matching

To configure a Custom File Type Signature condition

1 Add a Custom File Type Signature condition to a policy rule or exception, or edit an
existing one.
See “Configuring policy rules” on page 380.
See “Configuring policy exceptions” on page 389.
2 Configure the Custom File Type Signature condition parameters.
See Table 30-7 on page 720.
3 Click Save to save the policy.

Table 30-7 Custom File Type Signature parameters

Action Description

Enter the Script Name. Specify the name of the script. The name must be unique across policies.

Enter the custom file Enter the File Type Matches Signature script for detecting the binary signature of the custom
type script. file type.

See the Symantec Data Loss Prevention Detection Customization Guide for details on
writing custom scripts.

Match only on This condition only matches on the Message Attachments component.
attachments.
See “Detection messages and message components” on page 354.

Also match one or more Select this option to create a compound condition. All conditions must match to trigger or
additional conditions. except an incident.
You can Add any condition available from the list.

See “Configuring compound match conditions” on page 392.

Best practices for using file property matching

This section provides best practices for using file property matching conditions to match file
formats, file size, and file name.

Use compound file property rules to protect design and multimedia

files
You can use IDM to protect files, or you can use file property rules. Unless you must protect
an exact file, the general recommendation is to use the file property rules because there is
less overhead in setting up the rules.
 Detecting file properties 721
Best practices for using file property matching

For example, if you want to detect CAD files that contain IP diagrams, you could index these
files and apply IDM rules to detect them. Alternatively, you could create a policy that contains
a file type rule that detects on the CAD file format plus a file size rule that specifies a threshold
size. The file property approach is preferred because in this scenario all you really care about
is protecting large CAD files potentially leaving the company. There is no need to gather and
index these files for IDM if you can simply create rules that will detect on the file type and the
size.

Do not use file type matching to detect content

File type recognition does not crack the file and detect content; it only detects the file type
based on the file's binary signature. To detect content, use a content detection rule such as
EDM, IDM, Data Identifiers, or Keyword matching.
For custom file type detection, use the DLP Scripting Language. Refer to the Symantec Data
Loss Prevention Detection Customization Guide.

Calculate file size properly to improve match accuracy

The file size method counts both the body and any attachments in the file size you specify.

Use expression patterns to match file names

The following DOS pattern matching expressions are provided as examples for configuring
the Message Attachment or File Name condition.

Table 30-8 File name detection examples

Example

Any characters you enter (other than the DOS operators) match exactly.

For example, to match a Word file name that begins with ENG- followed by any eight characters, enter:
ENG-????????.doc

If you are not sure that it is a Word document, enter: ENG-????????.*

If you are not sure how many characters follow ENG-, enter: ENG-*.*

To match all file names that begin with ENG- and all file names that begin with ITA-, enter: ENG-*.*,ITA-* (comma
separated), or you can separate the file names by line space.

Use scripts and plugins to detect custom file types

Symantec Data Loss Prevention provides two mechanisms for detecting custom file types: the
DLP Scripting Language and the Content Extraction SPI. If the only requirement is file type
 Detecting file properties 722
Best practices for using file property matching

recognition, it may be easier to write a script than an SPI plugin. But, there may be occasions
where using a script is inadequate.
The scripting language does not support loops; you cannot iterate over the file type bytes and
do some processing. The scripting language is designed to detect a known signature at a
relatively known offset. You cannot use the scripting language detect subtypes of the same
document type. For example, , if you wanted to detect password protected PDF files, you could
not use the scripting language. Or, if you wanted to detect only Word documents with track
changes enabled, you would have to write a plugin. On the other hand, you can deploy a script
to the endpoint; currently plugins are server-based only.
For more information, refer to the Symantec Data Loss Prevention Content Extraction
Plugin Developers Guide and the Symantec Data Loss Prevention Detection
Customization Guide on writing custom plugins and scripts, respectively.
 Chapter 31
Detecting network incidents
This chapter includes the following topics:

■ Introducing protocol monitoring for network

■ Configuring the Protocol Monitoring condition for network detection

■ Best practices for using network protocol matching

Introducing protocol monitoring for network

Symantec Data Loss Prevention provides the Protocol Monitoring condition which lets you
detect network messages based on the communications transport method.
Table 31-1 lists the protocols that Data Loss Prevention supports for network detection.

Table 31-1 Supported protocols for network monitoring

Protocol Description

Email/SMTP Simple Mail Transfer Protocol (SMTP) is a protocol for sending email messages between servers.

FTP The file transfer protocol (FTP) is used on the Internet for transferring files from one computer
to another.

HTTP The hypertext transfer protocol (HTTP) is the underlying protocol that supports the World Wide
Web. HTTP defines how messages are formatted and transmitted, and what actions Web servers
and browsers should take in response to various commands.

HTTP/SSL Hypertext transfer protocol over Secure Sockets Layer (HTTPS) is a protocol for sending data
securely between a client and server.
 Detecting network incidents 724
Configuring the Protocol Monitoring condition for network detection

Table 31-1 Supported protocols for network monitoring (continued)

Protocol Description

IM:MSN Instant messaging is a type of communications service that enables you to create a private chat
room with another individual.
IM:AIM
Data Loss Prevention supports detection on the following IM channels.:
IM:AIM
■ AIM instant messaging
■ MSN instant messaging
■ Yahoo! Instant messaging

NNTP Network News Transport Protocol (NNTP), which is used to send, distribute, and retrieve USENET
messages.

TCP:custom_protocol The Transmission Control Protocol (TCP) is used to reliably exchange data between computers
across the Internet. This option is only available if you have defined a custom TCP port.

See “Configuring the Protocol Monitoring condition for network detection” on page 724.

Configuring the Protocol Monitoring condition for

network detection
You use the Protocol Monitoring condition to detect network incidents. You can implement an
instance of the Protocol Monitoring condition in one or more policy detection rules and
exceptions.

Table 31-2 Protocol Monitoring condition parameters for Network

Action Description

Add or modify the Protocol Add a new Protocol or Endpoint Monitoring condition to a policy rule or exception, or
or Endpoint Monitoring modify an existing rule or exception condition.
condition.
See “Configuring policies” on page 376.

See “Configuring policy rules” on page 380.

See “Configuring policy exceptions” on page 389.

 Detecting network incidents 725
Best practices for using network protocol matching

Table 31-2 Protocol Monitoring condition parameters for Network (continued)

Action Description

Select one or more To detect Network incidents, select one or more Protocols.
protocols to match.
■ Email/SMTP
■ FTP
■ HTTP
■ HTTPS/SSL
■ IM:AIM
■ IM:MSN
■ IM:Yahoo
■ NNTP

Configure a custom Select one or more custom protocols: TCP:custom_protocol.

network protocol.

Configure endpoint See “Configuring the Endpoint Monitoring condition” on page 730.
monitoring.

Match on the entire The Protocol Monitoring condition matches on the entire message, not individual message
message. components.

The Envelope option is selected by default. You cannot select individual message
components.

See “Detection messages and message components” on page 354.

Also match one or more Select this option to create a compound condition. All conditions must match to trigger or
additional conditions. except an incident.

You can Add any condition available from the list.

See “Configuring compound match conditions” on page 392.

Best practices for using network protocol matching

This section provides best practices for using file property matching conditions to match file
formats, file size, and file name.

Use separate policies for specific protocols

You can use protocol matching detection to detect network traffic, such as Web mail, social
networking, and specific protocols. For protocol monitoring, consider implementing different
policies for each type of protocol, such as SMTP, TCP, HTTP, FTP, etc. Creating separate
policies for specific protocols may ease remediation and help you tune the policies.
 Detecting network incidents 726
Best practices for using network protocol matching

Consider detection server network placement to support IP address

matching
You can detect senders/users and recipients based one or more IP addresses. However, to
do so you must carefully consider the placement of the detection server on your network.
If the detection server is installed between the Web proxy and the Internet, the IP address of
all Web traffic from individuals in your organization appears to come from the Web proxy. If
the detection server is installed between the Web proxy and the internal corporate network,
the IP address of all Web traffic from outside your organization appears to go to the Web proxy.
The best practice is to match on domain names instead of IP addresses.
 Chapter 32
Detecting endpoint events
This chapter includes the following topics:

■ Introducing endpoint event detection

■ Configuring endpoint event detection conditions

■ Best practices for using endpoint detection

Introducing endpoint event detection

Endpoint detection matches events on endpoints where the Symantec DLP Agent is installed.
See “About Endpoint Prevent monitoring” on page 1736.
Symantec Data Loss Prevention provides several methods for detecting and excepting endpoint
events, and a collection of response rules for responding to them.
See “Response rule actions for endpoint detection” on page 1201.

About endpoint protocol monitoring

On the endpoint you can detect data loss based on the transport protocol, such as email
(SMTP), Web (HTTP), and file transfer (FTP).
See “Configuring the Endpoint Monitoring condition” on page 730.

Table 32-1 Supported protocols for endpoint monitoring

Protocol Description

Email/SMTP Simple Mail Transfer Protocol (SMTP) is a protocol for sending email messages between servers.

FTP The file transfer protocol (FTP) is used on the Internet for transferring files from one computer
to another.
 Detecting endpoint events 728
Introducing endpoint event detection

Table 32-1 Supported protocols for endpoint monitoring (continued)

Protocol Description

HTTP The hypertext transfer protocol (HTTP) is the underlying protocol that supports the World Wide
Web. HTTP defines how messages are formatted and transmitted, and what actions Web servers
and browsers should take in response to various commands.

HTTP/SSL Hypertext transfer protocol over Secure Sockets Layer (HTTPS) is a protocol for sending data
securely between a client and server.

About endpoint destination monitoring

You can also detect endpoint data loss on the destination where data is copied or moved,
such as CD/DVD drive, USB device, or the clipboard.
See “Configuring the Endpoint Monitoring condition” on page 730.

Table 32-2 Supported destinations for endpoint monitoring

Destination Description

Local Drive Monitor the local disk.

CD/DVD The CD/DVD burner on the endpoint computer. This destination can be any type of
third-party CD/DVD burning software.

Removable Storage Device Detect data that is transferred to any eSATA, FireWire, or USB connected storage
device.

Copy to Network Share Detect data that is transferred to any network share or remote file access.

Printer/Fax Detect data that is transferred to a printer or to a fax that is connected to the endpoint
computer. This destination can also be print-to-file documents.

Clipboard The Windows Clipboard used to copy and paste data between Windows applications.

About endpoint application monitoring

You can create exceptions for allowable use scenarios.
The DLP Agent monitors any third-party application you add and configure at the System >
Agents > Application Monitoring screen.
The DLP Agent monitors applications when they access sensitive files.
See “Adding a Windows application” on page 1902.
See “Configuring the Endpoint Monitoring condition” on page 730.
 Detecting endpoint events 729
Configuring endpoint event detection conditions

About endpoint location detection

You can detect or except events based on the location of the endpoint.
Using the Endpoint Location detection method, you can choose to detect incidents only when
the endpoint is on or off the network.
For example, you might configure this condition to match only when users are off the corporate
network because you have other rules in place for detecting network incidents. In this case
implementing the Endpoint Location detection method would achieve this result.
See “Configuring the Endpoint Location condition” on page 732.

About endpoint device detection

Symantec Data Loss Prevention lets you detect or except specific endpoint devices based on
described device metadata. You can configure a condition to allow endpoint users to copy
files to a specific device class, such as USB drives from a single manufacturer.
For example, a policy author has a set of USB flash drives with serial numbers that range from
001-010. These are the only flash drives that should be allowed to access the company’s
endpoints. The policy administrator adds the serial number metadata into an exception of a
policy so that the policy applies to all USB flash drives except for the drives with the serial
number that falls into the 001-010 metadata. In this fashion the device metadata allows for
only “trusted devices” to be allowed to carry company data.
See “Creating and modifying endpoint device configurations” on page 734.
The Endpoint Device Class or ID condition detects specific removable storage devices based
on their definitions. Endpoint Destination parameters in the Endpoint Monitoring condition
detect any removable storage device on the endpoint,
See “Configuring the Endpoint Device Class or ID condition” on page 733.

Configuring endpoint event detection conditions

Table 32-3 describes the various methods for implementing endpoint event monitoring.

Table 32-3 Detecting endpoint events

Endpoint match conditions Details

Endpoint Protocol Monitoring Detect endpoint data based on the protocol.

See “About endpoint protocol monitoring” on page 727.

See “Configuring the Endpoint Monitoring condition” on page 730.

 Detecting endpoint events 730
Configuring endpoint event detection conditions

Table 32-3 Detecting endpoint events (continued)

Endpoint match conditions Details

Endpoint Destination Detect endpoint data based on the destination.

Monitoring
See “About endpoint protocol monitoring” on page 727.

See “Configuring the Endpoint Monitoring condition” on page 730.

Endpoint Application Detect endpoint data based on the application.

Monitoring
See “About endpoint protocol monitoring” on page 727.

See “Configuring the Endpoint Monitoring condition” on page 730.

Endpoint Device or Class ID Detect when users move endpoint data to a specific device.

See “About endpoint device detection” on page 729.

See “Configuring the Endpoint Device Class or ID condition” on page 733.

Endpoint Location Detect when the endpoint is on or off the corporate network.

See “About endpoint location detection” on page 729.

See “Configuring the Endpoint Location condition” on page 732.

Configuring the Endpoint Monitoring condition

The Endpoint Monitoring condition matches on endpoint message protocols, destinations, and
applications.
You can implement an instance of the Endpoint Monitoring condition in one or more policy
detection rules and exceptions.

Note: This topic does not address network protocol monitoring configuration.
See “Configuring the Protocol Monitoring condition for network detection” on page 724.

Table 32-4 Configure the Endpoint Monitoring condition

Action Description

Add or modify the Add a new Protocol or Endpoint Monitoring condition to a policy rule or
Endpoint Monitoring exception, or modify an existing rule or exception condition.
condition.
See “Configuring policy rules” on page 380.

See “Configuring policy exceptions” on page 389.

See “Configuring policies” on page 376.

 Detecting endpoint events 731
Configuring endpoint event detection conditions

Table 32-4 Configure the Endpoint Monitoring condition (continued)

Action Description

Select one or more To detect Endpoint incidents, select one or more Endpoint Protocols:
endpoint protocols to
■ Email/SMTP
match.
■ HTTP
■ HTTPS/SSL
■ IM:MSN
■ IM:AIM
■ IM:Yahoo
■ FTP

See “About endpoint protocol monitoring” on page 727.

Select one or more To detect when users move data on the endpoint, select one or more Endpoint
endpoint destinations. Destinations:

■ Local Drive
■ CD/DVD
■ Removable Storage Device
■ Copy to Network Share
■ Printer/Fax
■ Clipboard

See “About endpoint protocol monitoring” on page 727.

Monitor endpoint To detect when endpoint applications access files, select the Application File
applications. Access option.
See “About monitoring applications” on page 1896.

Match on the entire The DLP Agent evaluates the entire message, not individual message
message. components.

The Envelope option is selected by default. You cannot select the other
message components.

See “Detection messages and message components” on page 354.

Also match one or more Select this option to create a compound condition. All conditions must match
additional conditions. to trigger or except an incident.

You can Add any condition available from the list.

See “Configuring compound match conditions” on page 392.

 Detecting endpoint events 732
Configuring endpoint event detection conditions

Configuring the Endpoint Location condition

The Endpoint Location condition matches endpoint events based on the location of the endpoint
computer where the DLP Agent is installed.
You can implement an instance of the Endpoint Location condition in one or more policy
detection rules and exceptions.
See “Configuring policies” on page 376.

Table 32-5 Configure the Endpoint Location detection condition

Action Description

Add or modify the Add a new Endpoint Location detection condition to a policy rule or exception,
Endpoint Location or modify an existing policy rule or exception.
condition.
See “Configuring policy rules” on page 380.

See “Configuring policy exceptions” on page 389.

Select the location to Select one of the following endpoint locations to monitor:
monitor.
■ Off the corporate network
Select this option to detect or except events when the endpoint computer is
off of the corporate network.
■ On the corporate network
Select this option to detect or except events when the endpoint computer is
on the corporate network.
This option is the default selection.

See “About endpoint location detection” on page 729.

Match on the entire The DLP Agent evaluates the entire message, not individual message
message. components.

The Envelope option is selected by default. The other message components

are not selectable.

See “Detection messages and message components” on page 354.

Also match one or Select this option to create a compound condition. All conditions must match to
more additional trigger or except an incident.
conditions.
You can Add any condition available from the list.

See “Configuring compound match conditions” on page 392.

See “About endpoint location detection” on page 729.

See “Configuring the Endpoint Location condition” on page 732.
 Detecting endpoint events 733
Configuring endpoint event detection conditions

Configuring the Endpoint Device Class or ID condition

The Endpoint Device Class or ID condition lets you detect when users move endpoint data to
specific devices.
You can implement the Endpoint Device Class or ID condition in one or more policy detection
rules or exceptions.
See “Configuring policies” on page 376.

Table 32-6 Configuring the Endpoint Device Class or ID condition

Action Description

Add or modify an Add a new Endpoint Device Class or ID condition to a policy rule or exception,
Endpoint Device or modify an existing one.
condition.
See “Configuring policy rules” on page 380.

See “Configuring policy exceptions” on page 389.

Select one or more The condition matches when users move data from an endpoint computer to the
devices. selected device(s).

Click Create an endpoint device to define one or more devices.

See “Creating and modifying endpoint device configurations” on page 734.

Match on the entire The DLP Agent matches on the entire message, not individual message
message. components.

The Envelope option is selected by default. You cannot select other components.

See “Detection messages and message components” on page 354.

Also match one or Select this option to create a compound condition. All conditions must match to
more additional trigger or except an incident.
conditions.
You can Add any condition available from the drop-down menu.

See “Configuring compound match conditions” on page 392.

See “About endpoint device detection” on page 729.

Gathering endpoint device IDs for removable devices

You add device metadata information to the Enforce Server and create one or more policy
detection methods that detect or except the specific device instance or class of device. The
system supports the regular expression syntax for defining the metadata. The system displays
the device metadata at the Incident Snapshot screen during remediation.
See “Creating and modifying endpoint device configurations” on page 734.
 Detecting endpoint events 734
Configuring endpoint event detection conditions

The metadata the system requires to define the device instance or device class is the Device
Instance ID. On Windows you can obtain the "Device Instance Id" from the Device Manager.
In addition, Symantec Data Loss Prevention provides DeviceID.exe for devices attached to
Windows endpoints and DeviceID for devices attached to Mac endpoints. You can use these
utilities to extract Device Instance ID strings and device regex information. These utilities also
report what devices the system can recognize for detection. These utilities are available with
the Enforce Server installation files.
See “About the Device ID utilities” on page 1930.

Note: The Device Instance ID is also used by Symantec Endpoint Protection.

To obtain the Device Instance ID (on Windows)

1 Right-click My Computer.
2 Select Manage.
3 Select the Device Manager.
4 Click the plus sign beside any device to expand its list of device instances.
5 Double-click the device instance. Or, right-click the device instance and select Properties.
6 Look in the Details tab for the Device Instance Id.
7 Use the ID to create device metadata expressions.
See “Creating and modifying endpoint device configurations” on page 734.
See “About endpoint device detection” on page 729.

Creating and modifying endpoint device configurations

You can configure one or more devices for specific endpoint detection. Once the device
expressions are configured, you implement the Endpoint Device Class or ID condition in one
or more policy rules or exceptions to deny or allow the use of the specific devices.
You might deny or allow the use of devices if endpoint users must copy sensitive information
to company-provided USB drives or SD cards.
See “Gathering endpoint device IDs for removable devices” on page 733.

Note: You can use the DeviceID utility for Windows and Mac endpoints to generate removable
storage device information. See “About the Device ID utilities” on page 1930.
 Detecting endpoint events 735
Configuring endpoint event detection conditions

To create and modify endpoint device ID expressions

1 Go to the System > Agent > Endpoint Devices screen.
2 Click Add Device.
3 Enter the Device Name.
4 Enter a Device Description.
5 Enter the Device Definition expression.
The device definition must conform to the regular expression syntax.
See Table 32-7 on page 735.
See “About writing regular expressions” on page 701.
6 Click Save to save the device configuration.
7 Implement the Endpoint Device Class or ID condition in a detection rule or exception.
See “Configuring the Endpoint Device Class or ID condition” on page 733.

Table 32-7 Example Windows endpoint regular device expressions

Example device class Expression example

Generic USB Device USBSTOR\\DISK&VEN_SANDISK&PROD_ULTRA_BACKUP&REV_8\.32\\3485731392112B52

iPod generic USBSTOR\\DISK&VEN_APPLE&PROD_IPOD&.*

Lexar generic USBSTOR\\DISK&VEN_LEXAR.*

CD Drive IDE\\DISKST9160412ASG__________________0002SDM1\\4&F4ACADA&0&0\.0\.0

Hard drive USBSTOR\\DISK&VEN_MAXTOR&PROD_ONETOUCH_II&REV_023D\\B60899082H____&0

Blackberry generic USBSTOR\\DISK&VEN_RIM&PROD_BLACKBERRY...&REV.*

Cell phone USBSTOR\\DISK&VEN_PALM&PROD_PRE&REV_000\\FBB4B8FF4CAEFEC11

24DED689&0

Table 32-8 Example Mac endpoint regex information

Example device Regex information example

class

SanDisk USB SanDisk&Cruzer Blade&20051535820CF1302C2E

SD Card SDC&346128262

External hard drive External&RAID&0000000000702293

 Detecting endpoint events 736
Best practices for using endpoint detection

See “About endpoint device detection” on page 729.

Best practices for using endpoint detection

When implementing endpoint match conditions, keep in mind the following considerations:
■ Any detection method that executes on the endpoint matches on the entire message, not
individual message components.
See “Detection messages and message components” on page 354.
■ The Endpoint Destination and Endpoint Location methods are specific to the endpoint
computer and are not user-based.
See “Distinguish synchronized DGM from other types endpoint detection” on page 753.
■ You might often combine group and detection methods on the endpoint. Keep in mind that
the policy language ANDs detection and group methods, whereas methods of the same
type, two rules for example, are ORed.
See “Policy detection execution” on page 357.
 Chapter 33
Detecting described
identities
This chapter includes the following topics:

■ Introducing described identity matching

■ Described identity matching examples

■ Configuring described identity matching policy conditions

■ Best practices for using described identity matching

Introducing described identity matching

Described identity detection matches patterns in messages from email senders and recipients,
Windows users, IM users, URL domains, and IP addresses.
See “Configuring described identity matching policy conditions” on page 738.
See “Configuring the Sender/User Matches Pattern condition” on page 739.
See “Configuring the Recipient Matches Pattern condition” on page 742.

Described identity matching examples

Table 33-1 lists and describes some example described content matching examples.
 Detecting described identities 738
Configuring described identity matching policy conditions

Table 33-1 Pattern identity matching examples

Example Pattern Matches Does Not Match

fr, cu All SMTP email that is addressed Any email that is addressed to
to a .fr (France) or .cu (Cuba) French company with the .com
addresses. extension instead of .fr.

Any HTTP post to a .fr address

through a Web-based mail
application, such as Yahoo mail.

company.com All SMTP email that is addressed Any SMTP email that is not
to the specific domain URL, such addressed to the specific domain
as symantec.com. URL.

3rdlevel.company.com All SMTP email that is addressed Any SMTP email that is not
to the specific 3rd level domain, addressed to the specific 3rd level
such as dlp.symantec.com. domain.

bob@company.com All SMTP email that is addressed Any email not specifically
to bob@company.com. addressed to bob@company.com,
such as:
All SMTP email that is addressed
to BOB@COMPANY.COM (the ■ sally@company.com
pattern is not case-sensitive). ■ robert.bob@company.com
■ bob@3rdlevel.company.com

192.168.0.* All email, Web, or URL traffic

Note: If the IP address does not
specifically addressed to
match, use one or more domain
192.168.0.[0-255].
URLs instead.
This result assumes that the IP
address maps to the desired
domain, such as
web.company.com.

*/local/dom1/dom/dom2/Sym These are Lotus Notes example

email addresses.
*/Sym*

*/dlp/qa/test/local/Sym*

Configuring described identity matching policy

conditions
Table 33-2 lists and describes the two conditions that Symantec Data Loss Prevention provides
for matching described identities.
 Detecting described identities 739
Configuring described identity matching policy conditions

See “Described identity matching examples” on page 737.

Table 33-2 Implementing described identity matching

Match condition Description

Sender/User Matches Pattern Matches on an email address, domain address, IP address, Windows user
name, or IM screen name/handle.

See “Configuring the Sender/User Matches Pattern condition” on page 739.

Recipient Matches Pattern Matches on an email address, domain address, IP address, or newsgroup.

See “Configuring the Recipient Matches Pattern condition” on page 742.

About Reusable Sender/Recipient Patterns

You can create Reusable Sender/User and Recipient Patterns for use in your policies. Reusable
Sender/Recipient Patterns make policy creation and management easier for policies using
such patterns. For details about creating and using Reusable Sender/Recipient Patterns, refer
to the following topics.
See “Configuring a Reusable Sender Pattern” on page 741.
See “Configuring a Reusable Recipient Pattern” on page 743.

Configuring the Sender/User Matches Pattern condition

The Sender/User Matches Pattern condition matches described user and message sender
identities. You can use this condition in a policy detection rule or exception.
See “Introducing described identity matching” on page 737.
See “Best practices for using described identity matching” on page 744.
Configuring the Sender/User Matches Pattern condition describes the process for configuring
the Sender/User Matches Pattern condition.

Table 33-3
Action
Enter one or more Sender
Patterns to match one or
more message senders.
Note: The Pattern field
allows unlimited data (only
limited by the browser).
Select a Reusable Sender
Pattern
Detecting described identities 740
Configuring described identity matching policy conditions
Configuring the Sender/User Matches Pattern condition
Description
Email Address Pattern:
■ To match a specific email address, enter the full email address:
sales@symantec.com
■ To match multiple exact email addresses, enter a comma-separated list:
john.smith@company.com, johnsmith@company.com,
jsmith@company.com
■ To match partial email addresses, enter one or more domain patterns:
■ Enter one or more top-level domain extensions, for example:
.fr, .cu, .in, .jp
■ Enter one or more domain names, for example:
company.com, symantec.com
■ Enter one or more third-level (or lower) domain names:
web.company.com, mail.yahoo.com, smtp.gmail.com,
dlp.security.symantec.com
Windows User Names
Enter the names of one or more Windows users, for example:
john.smith, jsmith
IM Screen Name
Enter one or more IM screen names that are used in instant messaging systems, for
example:
john_smith, jsmith
IP Address
Enter one or more IP addresses that map to the domain you want to match, for example:
■ Exact IP address match, for example:
192.168.1.1 or for IPv6 fdda:c450:e808:3020:abcd:abcd:0000:5000
■ Wildcard match – The asterisk (*) character can substitute for one or more fields,
for example:
192.168.1.* or 192.*.168.* or for IPv6 fdda:c450:e808:3:*:*:*:*
Note: For IPv6, use only long format addresses.
You can select a Sender Pattern that you have saved for reuse in your policies. Select
Reusable Sender Pattern, then choose the pattern you want from the dropdown list.
 Detecting described identities 741
Configuring described identity matching policy conditions

Table 33-3 Configuring the Sender/User Matches Pattern condition (continued)

Action Description

Match on the entire message. This condition matches on the entire message. The Envelope option is selected by
default. You cannot select any other message component.

See “Detection messages and message components” on page 354.

Also match additional Select this option to create a compound condition. All conditions must match to trigger
conditions. an incident.

You can Add any available condition from the list.

See “Configuring compound match conditions” on page 392.

Configuring a Reusable Sender Pattern

If you want to use a Sender Pattern in multiple policies, configure a Reusable Sender Pattern.
Reusable Sender Patterns can be selected for use in your policies from the Configure Policy
- Edit Rule page. You can create, edit, and manage your Reusable Sender Patterns from the
Sender/Recipient Patterns page. For example, if you use a Sender Pattern in 50 policies,
using a Reusable Sender Pattern lets you enter the Sender Pattern a single time, then select
it for each policy. In addition, if you need to update the Sender Pattern for those 50 policies,
you can edit it from the Configure Reusable Sender Pattern page and your changes will be
applied automatically to each policy using that pattern.
To configure a Reusable Sender Pattern
1 Take one of the following actions:
■ If you are configuring a policy with a Sender/User Matches Pattern rule, from the
Manage > Policies > Policy List > Configure Policy - Edit Rule page, click Create
Reusable Sender Pattern.
■ In the Enforce Server administration console, navigate to Manage > Policies >
Sender/Recipient Patterns, then click Add > Sender Pattern.

2 In the General section on the Configure Reusable Sender Pattern page, enter a Name
and Description for your Reusable Sender Pattern.
3 In the Sender Pattern section, enter the User Patterns and IP Addresses as described
in the "Configuring the Sender/User Matches Pattern condition table".
See Table 33-3 on page 740.
4 Click Save.
 Detecting described identities 742
Configuring described identity matching policy conditions

5 To edit a saved Reusable Sender Pattern, on the Manage > Policies > Sender/Recipient
Patterns page, click the dropdown arrow next to the name of the pattern you want to edit,
then select Edit.
6 To delete a saved Reusable Sender Pattern, on the Manage > Policies >
Sender/Recipient Patterns page, click the dropdown arrow next to the name of the
pattern you want to delete, then select Delete.

Note: You cannot delete a Reusable Sender Pattern that is currently in use in any policy.

Configuring the Recipient Matches Pattern condition

The Recipient Matches Pattern condition matches the described identity of message recipients.
You can use this condition in a policy detection rule or exception.
See “Introducing described identity matching” on page 737.
See “Define precise identity patterns to match users” on page 744.
Configuring the Recipient Matches Pattern condition defines the process for configuring the
Recipient Matches Pattern condition.

Table 33-4 Recipient Matches Pattern condition parameters

Action Description

Enter one or more Recipient Email Address/Newsgroup Pattern

Patterns to match one or more
Enter one or more email or newsgroup addresses to match the desired recipients.
message recipients. Separate
multiple entries with commas. To match specific email addresses, enter the full address, such as
sales@symantec.com. To match email addresses from a specific domain, enter
Note: The Pattern field allows
the domain name only, such as symantec.com.
unlimited data (only limited by
the browser). IP Address

Enter one or more IP address patterns that resolve to the domain that you want to
match. You can use the asterisk (*) wildcard character for one or more fields. You can
enter both IPv4 and IPv6 addresses separated by commas.

URL Domain

Enter one or more URL Domains to match Web-based traffic, including Web-based
email and postings to a Web site. For example, if you want to prohibit the receipt of
certain types of data using Hotmail, enter hotmail.com.
 Detecting described identities 743
Configuring described identity matching policy conditions

Table 33-4 Recipient Matches Pattern condition parameters (continued)

Action Description

Select a Reusable Recipient You can select a Recipient Pattern that you have saved for reuse in your policies.
Pattern Select Reusable Recipient Pattern, then choose the pattern you want from the
dropdown list.

Configure match counting. Select one of the following options to specify the number of email recipients that must
match:

■ All recipients must match (Email Only) does not count a match unless ALL email
message recipients match the specified pattern.
■ At least _ recipients must match (Email Only) lets you specify the minimum
number of email message recipients that must match to be counted.
Select one of the following options to specify how you want to count the matches:

■ Check for existence

Reports a match count of 1 if there are one or more matches.
■ Count all matches
Reports the sum of all matches.

See “Configuring match counting” on page 384.

Match on the entire message. This condition matches on the entire message. The Envelope option is selected by
default. You cannot select any other message component.

See “Detection messages and message components” on page 354.

Also match additional Select this option to create a compound condition. All conditions in a rule or exception
conditions. must match to trigger an incident.
You can Add any available condition from the list.

See “Configuring compound match conditions” on page 392.

Configuring a Reusable Recipient Pattern

If you want to use a Recipient Pattern in multiple policies, configure a Reusable Recipient
Pattern. Reusable Recipient Patterns can be selected for use in your policies from the
Configure Policy - Edit Rule page. You can create, edit, and manage your Reusable Recipient
Patterns from the Sender/Recipient Patterns page. For example, if you use a Recipient
Pattern in 50 policies, using a Reusable Recipient Pattern lets you enter the Recipient Pattern
a single time, then select it for each policy. In addition, if you need to update the Recipient
Pattern for those 50 policies, you can edit it from the Configure Reusable Recipient Pattern
page and your changes will be applied automatically to each policy using that pattern.
To configure a Reusable Recipient Pattern
1 Take one of the following actions:
 Detecting described identities 744
Best practices for using described identity matching

■ If you are configuring a policy with a Recipient Matches Pattern rule, from the Manage
> Policies > Policy List > Configure Policy - Edit Rule page, click Create Reusable
Recipient Pattern.
■ In the Enforce Server administration console, navigate to Manage > Policies >
Sender/Recipient Patterns, then click Add > Recipient Pattern.

2 In the General section on the Configure Reusable Recipient Pattern page, enter a
Name and Description for your Reusable Recipient Pattern.
3 In the Recipient Pattern section, enter the Email Addresses, IP Addresses, and URL
Domains as described in the "Recipient Matches Pattern condition table".
See Table 33-4 on page 742.
4 Click Save.
5 To edit a saved Reusable Recipient Pattern, on the Manage > Policies >
Sender/Recipient Patterns page, click the dropdown arrow next to the name of the
pattern you want to edit, then select Edit.
6 To delete a saved Reusable Recipient Pattern, on the Manage > Policies >
Sender/Recipient Patterns page, click the dropdown arrow next to the name of the
pattern you want to delete, then select Delete.

Note: You cannot delete a Reusable Recipient Pattern that is currently in use in any policy.

Best practices for using described identity matching

This section provides considerations for implementing the Sender/User or Recipient Matches
Pattern conditions in policy detection rules or exceptions. Keep in mind these considerations
when you implement these conditions.

Define precise identity patterns to match users

Both the Sender/User and Recipient conditions match on the entire message, not individual
message components. If either condition is used as an exception, a match excludes the entire
message, not only the header.
See “Policy detection execution” on page 357.
For both described identity matching rules, the system implies an OR between all
comma-separated list items and between all fields. For example, if any single email address
among a list of email addresses matches, the condition reports (or excepts) an incident. Or,
if either an email address, a domain name, or an IP address matches, the condition reports
(or excepts) an incident.
 Detecting described identities 745
Best practices for using described identity matching

See “Detection messages and message components” on page 354.

Table 33-5 describes the types of patterns you can use for described identity matching.

Table 33-5 Patterns for identity matching

Pattern Sender/User Matches Pattern Recipient Matches Pattern

Email address: full and partial matches matches

Domain address: top-level and matches matches

subdomains

IP address matches matches

Windows user name matches does not match

IM screen name / handle matches does not match

Newsgroup patterns does not match matches

Specify email addresses exactly to improve accuracy

An email address must match exactly. For example, bob@company.com does not match
bob@something.company.com. But, a domain name pattern such as company.com or
something.company.com matches bob@something.company.com.

The email address field does not match the sender or recipient of a Web post. For example,
the email address bob@yahoo.com does not match if Bob uses a Web browser to send or
receive email. In this case, you must use the domain pattern mail.yahoo.com to match
bob@yahoo.com.

Match domains instead of IP addresses to improve accuracy

The URL Domain pattern matches HTTP traffic to particular URL domains. You do not enter
the entire URL. For example, you enter mail.yahoo.com not http://www.mail.yahoo.com.
The system does not resolve URL domains to IP addresses. For example, you specify an IP
address of 192.168.1.1 for a specific domain. If users access the domain URL using a Web
browser, the system does not match emails that are transmitted by the IP address. In this
case, use a domain pattern instead of an IP address, such as internalmemos.com.
You can detect senders/users and recipients based one or more IP addresses . However, to
do so you must carefully consider the placement of the detection server on your network. If
the detection server is installed between the Web proxy and the Internet, the IP address of all
Web traffic from individuals in your organization appears to come from the Web proxy. If the
detection server is installed between the Web proxy and the internal corporate network, the
 Detecting described identities 746
Best practices for using described identity matching

IP address of all Web traffic from outside your organization appears to go to the Web proxy.
The best practice is to match on domain names instead of IP addresses.
 Chapter 34
Detecting synchronized
identities
This chapter includes the following topics:

■ Introducing synchronized Directory Group Matching (DGM)

■ About two-tier detection for synchronized DGM

■ Configuring User Groups

■ Configuring synchronized DGM policy conditions

■ Best practices for using synchronized DGM

Introducing synchronized Directory Group Matching

(DGM)
Symantec Data Loss Prevention provides synchronized Directory Group Matching (DGM) to
detect data based on the exact identities of users, senders, and recipients of that data. Using
synchronized DGM, you can connect the Enforce Server to a group directory server such as
Microsoft Active Directory and detect users based on their directory group affiliation. For
example, you may want to apply policies to staff only in the engineering department of your
company, but not to staff in the human resources department. Synchronized DGM enables
you to do this.
Synchronized DGM is based on a User Group configuration that you populate with users
synchronized from your directory server. When you create a synchronized DGM policy, you
reference the User Group in the policy. At runtime the synchronized DGM policy only applies
to identities in the User Group reference by the policy. Or, consider an example where you
you want to create a policy that applies to your everyone in your organization except the CEO.
In this case you can create a User Group that contains the CEO's identity as a sole group
 Detecting synchronized identities 748
About two-tier detection for synchronized DGM

member. You then define a policy exception that references the CEO User Group. At runtime
the policy will ignore messages sent or received by the CEO.
See “User Groups” on page 335.

About two-tier detection for synchronized DGM

On the endpoint, the Recipient based on a Directory Server Group condition requires two-tier
detection for DLP Agents. The corresponding Sender/User based on a Directory Server
Group condition does not require two-tier detection.
Be sure understand the implications of two-tier detection before you deploy the synchronized
DGM Recipient rule to one or more endpoints.
See “Two-tier detection for DLP Agents” on page 358.
To check if two-tier detection is being used, check the
\SymantecDLP\Protect\logs\debug\FileReader.log on the Endpoint Server.

See “Troubleshooting policies” on page 408.

Configuring User Groups

The Manage > Policies > User Groups screen displays configured User Groups and is the
starting point for creating a new User Group. User Groups are used for implementing
synchronized DGM.
See “Introducing synchronized Directory Group Matching (DGM)” on page 747.

Note: DLP Agents installed on Mac endpoints support User Groups that use Active Directory
(AD) group conditions in policies.

To create or modify a User Group

1 Establish a connection to the Active Directory server you want to synchronize with.
See “Configuring directory server connections” on page 141.
2 At the Manage > Policies > User Groups screen, click Create New Group.
Or, to edit an existing user group, select the group in the User Groups screen.
 Detecting synchronized identities 749
Configuring User Groups

3 Configure the User Group parameters as required.

See Table 34-1 on page 749.

Note: If this is the first time you are configuring the User Group, you must select the option
Refresh the group directory index on Save to populate the User Group.

4 After you locate the users you want, use the Add and Remove options to include or
exclude them in the User Group.
5 Click Save.

Table 34-1 Configure a User Group

Action Description

Enter the group The Group Name is the name that you want to use to identify this group.
name.
Use a descriptive name so that you can easily identify it later on.

Enter the group Enter a short Description of the group.

description

View which policies Initially, when you create a new User Group, the Used in Policy field displays None.
use the group.
If the User Group already exists and you modify it, the system displays a list of the policies that
implement the User Group, assuming one or more group-based policies is created for this User
Group.

Refresh the group Select (check) the Refresh the group directory index on Save option to synchronize the user
directory index on group profile with the most recent directory server index immediately on Save of the profile. If
Save. you leave this box unselected (unchecked), the profile is synchronized with the directory server
index based on the Directory Connection setting.

See “Scheduling directory server indexing” on page 143.

If this is the first time you are configuring the User Group profile, you must select the Refresh
the group directory index on Save option to populate the profile with the latest directory server
index replication.

Select the directory Select the directory server you want to use from the Directory Server list.
server.
You must establish a connection to the directory server before you create the User Group profile.

See “Configuring directory server connections” on page 141.

 Detecting synchronized identities 750
Configuring synchronized DGM policy conditions

Table 34-1 Configure a User Group (continued)

Action Description

Search the directory Enter the search string in the search field and click Search to search the directory for specific
for specific users. users. You can search using literal text or wildcard characters (*).

The search results display the Common Name (CN) and the Distinguished Name (DN) of the
directory server that contains the user. These names give you the specific user identity. Results
are limited to 1000 entries.

Click Clear to clear the results and begin a new search of the directory.
Literal text search criteria options:

■ Name of individual node, such as "engineering" or "accounting"

■ Email address, such as "goakham@symantec-dlp.com"
Wildcard character search criteria options:

■ The supported wildcard character is an asterisk (*)

■ Proper wildcard search examples:
■ Gabriel *akha* returns "Gabriel Oakham"
■ j* jop* returns "Janice Joplin"
■ Improper wildcard search:
■ Do not begin the search string with a wildcard; this will hinder directory server search
performance.
■ For example, the following search is not recommended: *Gabriel Oakham.

Browse the directory You can browse the directory tree for groups and users by clicking on the individual nodes and
for user groups. expanding them until you see the group or node that you want.

The browse results display the name of each node. These names give you the specific user
identity.

The results are limited to 20 entries by default. Click See More to view up to 1000 results.

Add a user group to To add a group or user to the User Group profile, select it from the tree and click Add.
the profile.
After you select and add the node to the Added Groups column, the system displays the
Common Name (CN) and the Distinguished Name (DN).

Save the user group. Click Save to save the User Group profile you have configured.

Configuring synchronized DGM policy conditions

To implement synchronized DGM policies, you define a Directory Connection using the
Enforce Server administration console. The Directory Connection specifies the directory
server you want to use as source information for defining exact identity User Groups. You
then define one or more User Groups in the Enforce Server administration console and
populate the group by synchronizing the User Group with the directory server. You then
 Detecting synchronized identities 751
Configuring synchronized DGM policy conditions

associate the User Groups with the Sender/User based on a Directory Server Group group
rule or the Recipient matches User Group based on a Directory Server group rule.
See “Introducing synchronized Directory Group Matching (DGM)” on page 747.
Table 34-2 describes the process for implementing synchronized DGM.

Table 34-2 Workflow for implementing synchronized DGM

Step Action Description

1 Create the connection to the Establish the connection from the Enforce Server to a directory server such
directory server. as Microsoft Active Directory.

See “Configuring directory server connections” on page 141.

2 Create the User Group. Create one or more User Groups on the Enforce Server and populate the
User Groups with the exact identities from the users, groups, and business
units that are defined in the directory server

See “Configuring User Groups” on page 748.

3 Configure a new policy or edit See “Configuring policies” on page 376.

an existing one.

4 Configure one or more group Choose the type of synchronized DGM rule you want to implement and
rules or exceptions. reference the User Group. After the policy and the group are linked, the
policy applies only to those identifies in the referenced User Group.

See “Configuring the Sender/User based on a Directory Server Group

condition” on page 751.
See “Configuring the Recipient based on a Directory Server Group
condition” on page 752.

Configuring the Sender/User based on a Directory Server Group

condition
The condition Sender/User based on a Directory Server Group matches policy violations
based on message senders and endpoint users synchronized from a directory group server.
You can implement this condition in a policy group (identity) rule or exception.
See “Configuring policies” on page 376.

Note: If the identity being detected is a user, the user must be actively logged on to a DLP
Agent-enabled system for the policy to match.
 Detecting synchronized identities 752
Configuring synchronized DGM policy conditions

Table 34-3 Sender/User matches User Group condition parameters

Parameter Description

Select User Groups to Select one or more User Groups that you want this policy to detect.
include in this policy
If you have not created a User Group, click Create a new User Group.

See “Configuring User Groups” on page 748.

Match On This condition matches on the entire message. The Envelope option is selected by default.
You cannot select any other message component.

See “Detection messages and message components” on page 354.

Also Match Select this option to create a compound condition. All conditions in a rule or exception
must match to trigger an incident.

You can Add any available condition from the list.

See “Configuring compound match conditions” on page 392.

See “Introducing synchronized Directory Group Matching (DGM)” on page 747.

Configuring the Recipient based on a Directory Server Group

condition
The Recipient based on a Directory Server Group condition matches policy violations based
on specific message recipients synchronized from a directory server. You can implement this
condition in a policy group rule or exception.
See “Introducing synchronized Directory Group Matching (DGM)” on page 747.

Note: The Recipient based on a Directory Server Group condition requires two-tier detection.
See “About two-tier detection for synchronized DGM” on page 748.

Table 34-4 Configuring the Recipient based on a Directory Server Group condition

Step Action Description

1 Select User Groups to Select the User Group(s) that you want this policy to match on.
include in this policy
If you have not created a User Group, click Create a new Endpoint User
Group option.

See “Configuring User Groups” on page 748.

2 Match On This rule detects the entire message, not individual components. The Envelope
option is selected by default. You cannot select any other message component.

See “Detection messages and message components” on page 354.

 Detecting synchronized identities 753
Best practices for using synchronized DGM

Table 34-4 Configuring the Recipient based on a Directory Server Group condition
(continued)

Step Action Description

3 Also Match Select this option to create a compound condition. All conditions in a rule or
exception must match to trigger an incident.

You can Add any available condition from the list.

See “Configuring compound match conditions” on page 392.

Best practices for using synchronized DGM

This section contains a few considerations to keep in mind when implementing synchronized
DGM conditions in your policies.

Refresh the directory on initial save of the User Group

To execute a policy rule based on an Active Directory group, the index that you define on the
Enforce Server must first be populated. When you first define the User Group, the
recommendation is to select the option "Refresh the group directory index on Save." This
ensures proper synchronization of Active Directory with the Enforce Server. Once the User
Group is populated, you can then set up scheduling to keep the user group on Enforce in sync
with the Active Directory server.
One use case for not indexing immediately is where you are creating multiple User Groups
and you want to index after you have defined all the groups. In this case you can use scheduling,
but keep in mind that any policies based on these indices will not execute until they are
populated.
See “Introducing synchronized Directory Group Matching (DGM)” on page 747.
See “Configuring User Groups” on page 748.

Distinguish synchronized DGM from other types endpoint detection

When synchronized DGM policies are deployed to endpoint servers, identity-based detection
applies to the users in a configured group of DLP Agent-based endpoints. With endpoint-based
user groups, many different users can log on to the same computer depending on business
practices. The response that each user sees on that endpoint varies depending on how the
users are grouped. Contrast this style of endpoint detection with the Endpoint Protocol
Destination or Endpinot Location methods, which are specific to the endpoint and are not
user-based.
See “Introducing synchronized Directory Group Matching (DGM)” on page 747.
 Chapter 35
Detecting profiled identities
This chapter includes the following topics:

■ Introducing profiled Directory Group Matching (DGM)

■ About two-tier detection for profiled DGM

■ Configuring Exact Data profiles for DGM

■ Configuring profiled DGM policy conditions

■ Best practices for using profiled DGM

Introducing profiled Directory Group Matching (DGM)

Profiled Directory Group Matching (DGM) leverages Exact Data Matching (EDM) technology
to detect identities that you have indexed from your database or directory server using an
Exact Data Profile. For example, you can use profiled DGM to identify network user activity
or to analyze content associated with particular users, senders, or recipients. Or, you can
exclude certain email addresses from analysis. Or, you might want to prevent certain people
from sending confidential information by email.
See “Configuring Exact Data profiles for DGM” on page 755.
Profiled DGM is distinguished from synchronized DGM, which uses a connection to a directory
server (such as Microsoft Active Directory) to match identities.
See “Introducing synchronized Directory Group Matching (DGM)” on page 747.

About two-tier detection for profiled DGM

Profiled DGM relies on an EDM index, which is server-based. Profiled DMG requires two-tier
detection for DLP Agents on the endpoint.
See “About two-tier detection for EDM on the endpoint” on page 431.
 Detecting profiled identities 755
Configuring Exact Data profiles for DGM

You cannot combine either type of profiled DGM condition with an Endpoint: Block or
Endpoint: Notify response rule in a policy. If you do, the system reports that the policy is
misconfigured.
See “Troubleshooting policies” on page 408.

Configuring Exact Data profiles for DGM

To implement profiled DGM, you export identity records from a directory server or database,
index the data, and create an Exact Data Profile. You then reference this profile in the
corresponding Sender/User or Recipient condition.
See “Introducing profiled Directory Group Matching (DGM)” on page 754.
Table 35-1 describes the procedure for configuring Exact Data profiles for DGM policies.

Table 35-1 Workflow for implementing profiled DGM

Step Action Description

1 Create the data source file. Create a data source file from the directory server or database you want to
profile. Make sure the data source file contains the appropriate fields.
The following fields are supported for profiled DGM:

■ Email address
■ IP address
■ Window user name (in the format domain\user)
■ IM screen name

See “Creating the exact data source file for profiled DGM” on page 434.

2 Prepare the data source See “Configuring Exact Data profiles” on page 431.
file for indexing.
See “Preparing the exact data source file for indexing” on page 435.

3 Create the Exact Data This includes uploading the data source file to the Enforce Server, mapping
Profile. the data fields, and indexing the data source.

See “Uploading exact data source files to the Enforce Server” on page 436.

See “Creating and modifying Exact Data Profiles” on page 438.

See “Mapping Exact Data Profile fields” on page 442.

See “Scheduling Exact Data Profile indexing” on page 445.

4 Define the profiled DGM See “Configuring the Sender/User based on a Profiled Directory condition”
condition. on page 756.

See “Configuring the Recipient based on a Profiled Directory condition”

on page 757.
 Detecting profiled identities 756
Configuring profiled DGM policy conditions

Table 35-1 Workflow for implementing profiled DGM (continued)

Step Action Description

5 Test the profiled DGM Use a test policy group and verify that the matches the policy generates are
policy. accurate.

See “Test and tune policies to improve match accuracy” on page 416.

Configuring profiled DGM policy conditions

Symantec Data Loss Prevention provides two match conditions for profiled DGM: sender/user
and recipient. Both conditions can be used as policy rules or exceptions. For example, consider
a scenario where you index a list of email addresses and author profiled DGM policies based
on this indexed data. You could write a rule that requires the message sender to be from the
indexed list to violate the policy. Or, you could write an exception that is not violated if the
recipient of an email is from the indexed list.
See “Creating the exact data source file for profiled DGM” on page 434.

Table 35-2 Profiled DGM conditions

Group rule Description

Sender/User based on a Directory If this condition is implemented as a policy rule, a match occurs only if the
from <EDM Profile> sender or user of the data is contained in the index profile. If this condition is
implemented as a policy exception, the data will be excepted from matching
if it is sent by a sender/user listed in the index profile

Recipient based on a Directory from If this condition is implemented as a policy rule, a match occurs only if the
<EDM Profile> recipient of the data is contained in the index profile. If this condition is
implemented as a policy exception, the data will be excepted from matching
if it is received by a recipient listed in the index profile.

Configuring the Sender/User based on a Profiled Directory condition

The Sender/User based on a Directory from detection rule lets you create detection rules
based on sender identity or (for endpoint incidents) user identity. This condition requires an
Exact Data Profile.
See “Creating the exact data source file for profiled DGM” on page 434.
After you select the Exact Data Profile, when you configure the rule, the directory you selected
and the sender identifier(s) appear at the top of the page.
Table 35-3 describes the parameters for configuring the Sender/User based on a Directory
an EDM Profile condition.
 Detecting profiled identities 757
Configuring profiled DGM policy conditions

Table 35-3 Configuring the Sender/User based on a Directory from an EDM Profile condition

Parameter Description

Where Select this option to have the system match on the specified field values. Specify the values by
selecting a field from the drop-down list and typing the values for that field in the adjacent text box.
If you enter more than one value, separate the values with commas.

For example, for an Employees directory group profile that includes a Department field, you would
select Where, select Department from the drop-down list, and enter Marketing,Sales in the text
box. If the condition is implemented as a rule, in this example a match occurs only if the sender or
user works in Marketing or Sales (as long as the other input content meets all other detection criteria).
If the condition is implemented as an exception, in this example the system ignores from matching
messages from a sender or user who works in Marketing or Sales.

Is Any Of Enter or modify the information you want to match. For example, if you want to match any sender
in the Sales department, select Department from the drop-down list, and then enter Sales in this
field (assuming that your data includes a Department column). Use a comma-separated list if you
want to specify more than one value.

Configuring the Recipient based on a Profiled Directory condition

The Recipient based on a Directory from condition lets you create detection methods based
on the identity of the recipient. This method requires an Exact Data Profile.
See “Creating the exact data source file for profiled DGM” on page 434.
After you select the Exact Data Profile, when you configure the rule, the directory you selected
and the recipient identifier(s) appear at the top of the page.
Table 35-3 describes the parameters for configuring Recipient based on a Directory from
an EDM profile condition.

Table 35-4 Configuring the Recipient based on a Directory from an EDM profile condition

Parameter Description

Where Select this option to have the system match on the specified field values. Specify the values by
selecting a field from the drop-down list and typing the values for that field in the adjacent text box.
If you enter more than one value, separate the values with commas.

For example, for an Employees directory group profile that includes a Department field, you would
select Where, select Department from the drop-down list, and enter Marketing, Sales in the text
box. For a detection rule, this example causes the system to capture an incident only if at least one
recipient works in Marketing or Sales (as long as the input content meets all other detection criteria).
For an exception, this example prevents the system from capturing an incident if at least one recipient
works in Marketing or Sales.
 Detecting profiled identities 758
Best practices for using profiled DGM

Table 35-4 Configuring the Recipient based on a Directory from an EDM profile condition
(continued)

Parameter Description

Is Any Of Enter or modify the information you want to match. For example, if you want to match any recipient
in the Sales department, select Department from the drop-down list, and then enter Sales in this
field (assuming that your data includes a Department column). Use a comma-separated list if you
want to specify more than one value.

Best practices for using profiled DGM

Keep in mind the considerations in this section when implementing profiled Directory Group
Matching (DGM)

Follow EDM best practices when implementing profiled DGM

Profiled DGM leverages EDM technology. Follow the EDM procedures and best practices
when implementing profiled DGM.
See “About two-tier detection for profiled DGM” on page 754.

Include an email address field in the Exact Data Profile for profiled
DGM
You must include the appropriate fields in the Exact Data Profile to implement profiled DGM.
See “Creating the exact data source file for profiled DGM” on page 434.
If you include the email address field in the Exact Data Profile for profiled DGM and map it to
the email data validator, email address will appear in the Directory EDM drop-down list (at
the remediation page).

Use profiled DGM for Network Prevent for Web identity detection
If you want to implement DGM for Network Prevent for Web, use one of the profiled DGM
conditions to implement identity matching. For example, you may want to use identity matching
to block all web traffic for a specific users. For Network Prevent for Web, you cannot use
synchronized DGM conditions for this use case.
See “Creating the exact data source file for profiled DGM” on page 434.
See “Configuring the Sender/User based on a Profiled Directory condition” on page 756.
 Chapter 36
Supported file formats for
detection
This chapter includes the following topics:

■ Overview of detection file format support

■ Supported formats for file type identification

■ Supported formats for content extraction

■ Supported encapsulation formats for subfile extraction

■ Supported file formats for metadata extraction

Overview of detection file format support

Symantec Data Loss Prevention detection supports various file formats for performing the
following operations:
■ File type identification
■ File contents extraction
■ Subfile extraction
■ Document metadata extraction
Table 36-1 summarizes the file formats that Symantec Data Loss Prevention supports for file
type identification and content, subfile and metadata extraction.
You configure the system to identify individual file formats using the Message Attachment
or File Type Match condition. This condition performs a context-based match that only identifies
the file format type; it does not extract file contents. In addition, you must explicitly select the
individual file format(s) you want to detect.
 Supported file formats for detection 760
Overview of detection file format support

See “About file type matching” on page 711.

When you use a content-based detection condition in a policy (such as Content Matches
Keyword), the system automatically extracts file contents for supported file formats (such as
DOCX, PPTX, XSLX, PDF). In addition, the system automatically extracts subfiles from
supported encapsulation file formats (such as ZIP, RAR, TAR).
See “Content matching conditions” on page 350.
Lastly, you can enable metadata extraction for a limited number of document formats (such
as DOCX), and use keyword matching to detect document metadata.
See “About document metadata detection” on page 786.

Note: While there is some overlap among file types supported for extraction and for identification
(because if the system can crack the file it must be able to identify its type), the supported
formats for each operation are distinct and implemented using different match conditions. The
number of file formats supported for type identification is much broader than those supported
for content extraction.

Table 36-1 File format support for detection operations

Operation Description Configuration Supported formats

type

File type Symantec Data Loss Prevention does Explicitly using the Message See “Supported formats for file
identification not rely on file extensions to identify the Attachment or File Type type identification”
format. File type is identified by the Match file property condition. on page 761.
unique binary signature of the file
format.

File contents File contents is any text-based content Implicitly using one or more See “Supported formats for
extraction that can be viewed through the native content match conditions, content extraction”
or source application. including EDM, IDM, VML, on page 777.
data identifiers, keyword,
regular expressions.

Subfile Subfiles are files encapsulated in a
extraction parent file. Subfiles are extracted and
(Subfile) processed individually for identification
and content extraction. If the subfile
format is not supported by default, a
custom method can be used to detect
and crack the file.
Implicitly using one or more
content match conditions,
including EDM, IDM, VML,
data identifiers, keyword,
regular expressions.
See “Supported encapsulation
formats for subfile extraction”
on page 784.
 Supported file formats for detection 761
Supported formats for file type identification

Table 36-1 File format support for detection operations (continued)

Operation Description Configuration Supported formats

type

Metadata Metadata is information about the file, Available for content-based See “Supported file formats
extraction such as author, version, or user-defined match conditions. Must be for metadata extraction”
(Metadata) tags. Generally limited to Microsoft enabled. on page 786.
Office documents (OLE-enabled) and
Adobe PDF files. Metadata support may
differ between agent and server.

Metadata includes data-security tags

that were created in Information Centric
Tagging (ICT).

Supported formats for file type identification

Table 36-2 lists the file types you can identify using the Message Attachment or File Type
Match policy condition.
See “About file type matching” on page 711.
The Unknown file format identifies any format that is unknown to Symantec Data Loss
Prevention. The Unknown file format is only supported for file type identification. This type
identifies files that are not known to Data Loss Prevention and blocks them using the file type
rule.
If the file format you want to identify is not supported, you can use the Symantec Data Loss
Prevention Scripting Language to identify custom file types.
See “About custom file type identification” on page 712.

Note: The Message Attachment or File Type Match condition is a context-based match
condition that only supports file type identification. This condition does not support file contents
extraction. To extract file contents for policy evaluation you must use a content-based detection
rule. See “Supported formats for content extraction” on page 777.

See “Overview of detection file format support” on page 759.

Table 36-2 Formats supported for file type identification

Message Attachment or File Type Match formats

7-Zip Compressed File (7Z)

Ability Office (SS)

 Supported file formats for detection 762
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

Ability Office (DB)

Ability Office (GR)

Ability Office (WP)

Ability Office (COM)

ACT

Adobe FrameMaker

Adobe Maker Interchange Format (FrameMaker)

Adobe FrameMaker Markup Language

Adobe PDF

AES Multiplus Comm

Aldus Freehand (Macintosh)

Aldus PageMaker (DOS)

Aldus PageMaker (Macintosh)

Amiga IFF-8SVX sound

Amiga MOD sound

ANSI

Apple Double

Apple Single

Applix Alis

Applix Asterix

Applix Graphics

Applix Presents

Applix Spreadsheets

Applix Words

ARC/PAK Archive
 Supported file formats for detection 763
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

ASCII

ASCII-armored PGP encoded

ASCII-armored PGP Public Keyring

ASCII-armored PGP signed

Audio Interchange File Format

AutoCAD Drawing

AutoCAD Drawing Exchange

AutoDesk Animator FLIC Animation

AutoDesk Animator Pro FLIC Animation

AutoDesk WHIP

AutoShade Rendering

BinHex

CADAM Drawing (CDD) (server only)

CADAM Drawing Overlay

CATIA Drawing (CAT) (server only)

CCITT Group 3 1-Dimensional (G31D)

COMET TOP Word

Comma Separated Values

Compactor/Compact Pro Archive

Computer Graphics Metafile

Convergent Tech DEF Comm.

Corel Draw CMX

Corel Presentations

Corel Quattro Pro (WB2)

Corel Quattro Pro (WB3)

 Supported file formats for detection 764
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

Corel WordPerfect Linux

Corel WordPerfect Macintosh

Corel WordPerfect Windows (WO)

Corel WordPerfect Windows (WPD)

CorelDRAW

cpio Archive (UNIX)

cpio Archive (VAX)

cpio Archive (SUN)

CPT Communication

Creative Voice (VOC) sound

Curses Screen Image (UNIX)

Curses Screen Image (VAX)

Curses Screen Image (SUN)

Data Interchange Format

Data Point VISTAWORD

dBase Database

DCX Fax

DCX Fax System

DEC WPS PLUS

DECdx

Desktop Color Separation (DCS)

Device Independent file (DVI)

DG CEOwrite

DG Common Data Stream (CDS)

DIF Spreadsheet
 Supported file formats for detection 765
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

Digital Document Interchange Format (DDIF)

Disk Doubler Compression

DisplayWrite

Domino XML Language

EMC EmailXtender Container File (EMX)

ENABLE

ENABLE Spreadsheet (SSF)

Encapsulated PostScript (raster)

Enhanced Metafile

Envoy (EVY)

Executable- Other

Executable- UNIX

Executable- VAX

Executable- SUN

FileMaker (Macintosh)

File Share Encryption

Folio Flat File

Framework

Framework II

FTP Session Data

Fujitsu Oasys

GEM Bit Image

GIF

Graphics Environment Manager (GEM VDI)

GZIP
 Supported file formats for detection 766
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

Haansoft Hangul (Hangul 2010 SE+)

Harvard Graphics

Hewlett-Packard

Honey Bull DSA101

HP Graphics Language (HPG) (server only)

HP Printer Control Language (PCL)

HTML

IBM 1403 Line Printer

IBM DCA/RFT(Revisable Form Text)

IBM DCA-FFT

IBM DCF Script

iCalendar

Informix SmartWare II

Informix SmartWare II Communication File

Informix SmartWare II Database

Informix SmartWare Spreadsheet

Interleaf

Java Archive

JPEG

JPEG File Interchange Format (JFIF)

JustSystems Ichitaro

KW ODA G31D (G31)

KW ODA G4 (G4)

KW ODA Internal G32D (G32)

KW ODA Internal Raw Bitmap (RBM)

 Supported file formats for detection 767
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

Lasergraphics Language

Legato Extender

Link Library- Other

Link Library UNIX

Link Library VAX

Link Library SUN

Lotus 1-2-3 (123)

Lotus 1-2-3 (WK4)

Lotus 1-2-3 Charts

Lotus AMI Pro

Lotus AMI Professional Write Plus

Lotus AMIDraw Graphics

Lotus Freelance Graphics

Lotus Freelance Graphics 2

Lotus Notes Bitmap

Lotus Notes CDF

Lotus Notes database

Lotus Pic

Lotus Screen Cam

Lotus SmartMaster

Lotus Word Pro

Lyrix MacBinary

MacBinary

Macintosh Raster

MacPaint
 Supported file formats for detection 768
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

Macromedia (Adobe) Director

Macromedia (Adobe) Flash

MacWrite

MacWrite II

MASS-11

Micrografx Designer

Microsoft Access

Microsoft Advanced Systems Format (ASF)

Microsoft Compressed Folder (LZH)

Microsoft Compressed Folder (LHA)

Microsoft Device Independent Bitmap

Microsoft Excel Charts

Microsoft Excel Macintosh

Microsoft Excel Windows

Microsoft Excel Windows XML

Microsoft Office Access (ACCDB)

Microsoft Office Drawing

Microsoft OneNote

Microsoft Outlook Personal Folder

Microsoft Outlook

Microsoft Outlook Express

Microsoft PowerPoint Macintosh

Microsoft PowerPoint PC

Microsoft PowerPoint Windows

Microsoft PowerPoint Windows XML

 Supported file formats for detection 769
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

Microsoft PowerPoint Windows Macro-Enabled XML

Microsoft PowerPoint Windows XML Template

Microsoft PowerPoint Windows Macro-Enabled XML Template

Microsoft PowerPoint Windows XML Show

Microsoft PowerPoint Windows Macro-Enabled Show

Microsoft Project

Microsoft Publisher

Microsoft RMS Encrypted Office Binary File

Microsoft RMS Encrypted Open Packaging Conventions File

Microsoft Visio

Microsoft Visio 2013

Microsoft Visio 2013_Macro Format

Microsoft Visio 2013_Stencil Format

Microsoft Visio 2013_Stencil_Macro Format

Microsoft Visio 2013_Template Format

Microsoft Visio _Template_Macro

Microsoft Visio XML

Microsoft Wave Sound

Microsoft Windows Cursor (CUR) Graphics

Microsoft Windows Group File

Microsoft Windows Help File

Microsoft Windows Icon (ICO)

Microsoft Windows OLE 2 Encapsulation

Microsoft Windows Write

Microsoft Word (UNIX)

 Supported file formats for detection 770
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

Microsoft Word Macintosh

Microsoft Word PC

Microsoft Word Windows

Microsoft Word Windows XML

Microsoft Word Windows Template XML

Microsoft Word Windows Macro-Enabled Template XML

Microsoft Works (Macintosh)

Microsoft Works

Microsoft Works Communication (Macintosh)

Microsoft Works Communication (Windows)

Microsoft Works Database (Macintosh)

Microsoft Works Database (PC)

Microsoft Works Database (Windows)

Microsoft Works Spreadsheet (S30)

Microsoft Works Spreadsheet (S40)

Microsoft Works Spreadsheet (Macintosh)

Microstation

MIDI

MORE Database Outliner (Macintosh)

MPEG-1 Audio layer 3

MPEG-1 Video

MPEG-2 Audio

MS DOS Batch File format

MS DOS Device Driver

MultiMate 4.0
 Supported file formats for detection 771
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

Multiplan Spreadsheet

Navy DIF

NBI Async Archive Format

NBI Net Archive Format

Netscape Bookmark file

NeWS font file (SUN)

NeXT/Sun Audio

NIOS TOP

Nota Bene

Nurestor Drawing (NUR) (server only)

Oasis Open Document Format (ODT)

Oasis Open Document Format (ODS)

Oasis Open Document Format (ODP)

Object Module UNIX

Object Module VAX

Object Module SUN

ODA/ODIF

ODA/ODIF (FOD 26)

Office Writer

OLE DIB object

OLIDIF

OmniOutliner (OO3)

OpenOffice Calc (SXC)

OpenOffice Calc (ODS)

OpenOffice Impress (SXI)

 Supported file formats for detection 772
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

OpenOffice Impress (SXP)

OpenOffice Impress (ODP)

OpenOffice Writer (SXW)

OpenOffice Writer (ODT)

Open PGP

OS/2 PM Metafile Graphics

Paradox (PC) Database

PC COM executable

PC Library Module

PC Object Module

PC PaintBrush

PC True Type Font

PCD Image

PeachCalc Spreadsheet

Persuasion Presentation

PEX Binary Archive (SUN)

PGP Compressed Data

PGP Encrypted Data

PGP Public Keyring

PGP Secret Keyring

PGP Signature Certificate

PGP Signed and Encrypted Data

PGP Signed Data

Philips Script

PKZIP
 Supported file formats for detection 773
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

Plan Perfect

Portable Bitmap Utilities (PBM)

Portable Greymap Utilities (PGM)

Portable Network Graphics

Portable Pixmap Utilities (PPM)

PostScript File

PRIMEWORD

Program Information File

Q & A for DOS

Q & A for Windows

Quadratron Q-One (V1.93J)

Quadratron Q-One (V2.0)

Quark Express (Macintosh)

QuickDraw 3D Metafile (3DMF)

QuickTime Movie

RAR archive

Real Audio

Reflex Database

Rich Text Format

RIFF Device Independent Bitmap

RIFF MIDI

RIFF Multimedia Movie

SAMNA Word IV

Serialized Object Format (SOF) Encapsulation

SGI RGB Image

 Supported file formats for detection 774
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

SGML

Simple Vector Format (SVF)

SMTP document

SolidWorks Drawing (SLDASM, SLDPRT, SLDDRW)

StarOffice Calc (SXC)

StarOffice Calc (ODS)

StarOffice Impress (SXI)

StarOffice Impress (SXP)

StarOffice Impress (ODP)

StarOffice Writer (SXW)

StarOffice Writer (ODT)

Stuff It Archive (Macintosh)

Sun Raster Image

SUN vfont definition

Supercalc Spreadsheet

SYLK Spreadsheet

Symphony Spreadsheet

Tagged Image File

Tape Archive

Targon Word (V 2.0)

Text Mail (MIME)

Transmission Neutral Encapsulation Format

Truevision Targa

Ultracalc Spreadsheet

Unicode Text
 Supported file formats for detection 775
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

Uniplex (V6.01)

Uniplex Ucalc Spreadsheet

UNIX Compress

UNIX SHAR Encapsulation

UNKNOWN

Usenet format

UUEncoding

Vcard

VCF

Volkswriter

VRML

Wang Office GDL Header Encapsulation

WANG PC

Wang WITA

WANG WPS Comm.

Windows Animated Cursor

Windows Bitmap

Windows C++ Object Storage

Windows Icon Cursor

Windows Metafile

Windows Micrografx Draw (DRW)

Windows Palette

Windows Media Video (WMV)

Windows Media Audio (WMA)

Windows Video (AVI)

 Supported file formats for detection 776
Supported formats for file type identification

Table 36-2 Formats supported for file type identification (continued)

Message Attachment or File Type Match formats

WinZip (unzip reader)

WinZip

Word Connection

WordERA (V 1.0)

WordMARC word processor

WordPad

WordPerfect General File

WordPerfect Graphics 1

WordPerfect Graphics 2

WordStar

WordStar 2000

WordStar 6.0

WriteNow

Writing Assistant word processor

X Bitmap (XBM)

X Image

X Pixmap (XPM)

Xerox 860 Comm.

Xerox Writer word processor

XHTML

XML (generic)

XML Paper Specification

XyWrite
 Supported file formats for detection 777
Supported formats for content extraction

Supported formats for content extraction

Symantec Data Loss Prevention cracks more than 100 file formats for performing content
extraction. You use content-based detection conditions to crack a file and extract its contents.
See “Content matching conditions” on page 350.
Table 36-3 lists the various file format categories whose content Symantec Data Loss Prevention
can extract. Refer to the associated link for the individual file formats supported for that category.
See “Overview of detection file format support” on page 759.

Table 36-3 Supported file format categories for content extraction

File format category Default support list

Word-processing file formats See “Supported word-processing formats for content extraction” on page 777.

Presentation file formats See “Supported presentation formats for content extraction” on page 779.

Spreadsheet file formats See “Supported spreadsheet formats for content extraction” on page 780.

Text and markup file formats See “Supported text and markup formats for content extraction” on page 781.

Email file formats See “Supported email formats for content extraction” on page 782.

CAD file formats See “Supported CAD formats for content extraction” on page 782.

Graphics file formats See “Supported graphics formats for content extraction” on page 783.

Database file formats See “Supported database formats for content extraction” on page 783.

Other file formats See “Other file formats supported for content extraction” on page 783.

Encapsulation file formats See “Supported encapsulation formats for subfile extraction” on page 784.

Supported word-processing formats for content extraction

Table 36-4 lists the word-processing file formats whose content Symantec Data Loss Prevention
can extract for policy evaluation.

Table 36-4 Supported word-processing file formats for content extraction

Format Name Format Extension

Adobe Maker Interchange Format (FrameMaker) MIF

Apple iWork Pages PAGES

ApplixWords AW
 Supported file formats for detection 778
Supported formats for content extraction

Table 36-4 Supported word-processing file formats for content extraction (continued)

Format Name Format Extension

Corel WordPerfect Linux WPS

Corel WordPerfect Macintosh WPS

Corel WordPerfect Windows WO

Corel WordPerfect Windows WPD

DisplayWrite IP

Folio Flat file FFF

Fujitsu Oasys OA2

Haansoft Hangul HWP

IBM DCA/RFT (Revisable Form Text) DC

JustSystems Ichitaro JTD

Lotus AMI Pro SAM

Lotus AMI ProfessionalWrite Plus AMI

LotusWord Pro LWP

Lotus SmartMaster MWP

Microsoft Word PC DOC

Microsoft Word Windows DOC

Microsoft Word Windows XML DOCX

Microsoft Word Windows Template XML DOTX

Microsoft Word Windows Macro-Enabled Template XML DOTM

Microsoft Word Macintosh DOC

Microsoft Works WPS

Microsoft Windows Write WRI

Microsoft OneNote ONE

OpenOfficeWriter SXW

OpenOfficeWriter ODT
 Supported file formats for detection 779
Supported formats for content extraction

Table 36-4 Supported word-processing file formats for content extraction (continued)

Format Name Format Extension

StarOfficeWriter SXW

StarOfficeWriter ODT

WordPad RTF

XML Paper Specification XPS

XyWrite XY4

Supported presentation formats for content extraction

Table 36-5 lists the presentation file formats whose content Symantec Data Loss Prevention
can extract for policy evaluation.

Table 36-5 Supported presentation formats for files content extraction

Format Name Format Extension

Apple iWork Keynote KEYNOTE

Applix Presents AG

Corel Presentations SHW

Lotus Freelance Graphics PRZ

Lotus Freelance Graphics 2 PRE

Macromedia Flash SWF

Microsoft PowerPoint Windows PPT

Microsoft PowerPoint PC PPT

Microsoft PowerPoint Windows XML PPTX

Microsoft PowerPoint Windows Macro-Enabled XML PPTM

Microsoft PowerPoint Windows XML Template POTX

Microsoft PowerPoint Windows Macro-Enabled XML Template POTM

Microsoft PowerPoint Windows XML Show PPSX

Microsoft PowerPoint Windows Macro-Enabled Show PPSM

 Supported file formats for detection 780
Supported formats for content extraction

Table 36-5 Supported presentation formats for files content extraction (continued)

Format Name Format Extension

Microsoft PowerPoint Macintosh PPT

OpenOffice Impress SXI

OpenOffice Impress SXP

OpenOffice Impress ODP

StarOffice Impress SXI

StarOffice Impress SXP

StarOffice Impress ODP

Supported spreadsheet formats for content extraction

Table 36-6 lists the spreadsheet file formats whose content Symantec Data Loss Prevention
can extract for policy evaluation.

Table 36-6 Supported spreadsheet formats for file contents extraction

Format Name Format Extension

Apple iWork Numbers NUMBERS

Applix Spreadsheets AS

Comma Separated Values CSV

Corel Quattro Pro WB2

Corel Quattro Pro WB3

Data Interchange Format DIF

Lotus 1-2-3 123

Lotus 1-2-3 WK4

Lotus 1-2-3 Charts 123

Microsoft Excel Windows XLS

Microsoft Excel Windows XML XLSX

Microsoft Excel Charts XLS

 Supported file formats for detection 781
Supported formats for content extraction

Table 36-6 Supported spreadsheet formats for file contents extraction (continued)

Format Name Format Extension

Microsoft Excel 2007 Binary XLSB

Microsoft Excel Macintosh XLS

Microsoft Works Spreadsheet S30

Microsoft Works Spreadsheet S40

OpenOffice Calc SXC

OpenOffice Calc ODS

StarOffice Calc SXC

StarOffice Calc ODS

Supported text and markup formats for content extraction

Table 36-7 lists the text and markup file formats whose content Symantec Data Loss Prevention
can extract for policy evaluation.

Table 36-7 Supported text and markup file formats for content extraction

Format Name Format Extension

ANSI TXT

ASCII TXT

HTML HTM

Microsoft Excel Windows XML XML

Microsoft Word Windows XML XML

Microsoft Visio XML VDX

Oasis Open Document Format ODT

Oasis Open Document Format ODS

Oasis Open Document Format ODP

Rich Text Format RTF

Unicode Text TXT

 Supported file formats for detection 782
Supported formats for content extraction

Table 36-7 Supported text and markup file formats for content extraction (continued)

Format Name Format Extension

XHTML HTM

XML (generic) XML

Supported email formats for content extraction

Table 36-8 lists the email file formats whose content Symantec Data Loss Prevention can
extract for evaluation.

Table 36-8 Supported email file formats for content extraction

Format Name Format Extension

Domino XML Language DXL

EMC EmailXtender Native Message ONM

Microsoft Outlook MSG

Microsoft Outlook Express EML

Text Mail (MIME) various

Transfer Neutral Encapsulation Format various

Supported CAD formats for content extraction

Table 36-9 lists the computer-aided design (CAD) file formats whose content Symantec Data
Loss Prevention can extract for evaluation.

Table 36-9 Supported CAD file formats

Format Name Format Extension

AutoCAD Drawing DWG

AutoCAD Drawing Exchange DFX

Microsoft Visio 2013 VSD

Microsoft Visio XML VSDX

Microsoft Visio 2013_Macro VSDM

Microsoft Visio 2013_Stencil VSSX

 Supported file formats for detection 783
Supported formats for content extraction

Table 36-9 Supported CAD file formats (continued)

Format Name Format Extension

Microsoft Visio 2013_Stencil_Macro VSSM

Microsoft Visio 2013_Template VSTX

Microsoft Visio 2013_Template_Macro VSTM

Microstation DGN

Supported graphics formats for content extraction

Table 36-10 lists the graphics file formats whose content Symantec Data Loss Prevention can
extract for evaluation.

Table 36-10 Supported graphics file formats for content extraction

Format Name Format Extension

Enhanced Metafile EMF

Lotus Pic PIC

Tagged Image File (metadata only) TIFF

Windows Metafile WMF

Supported database formats for content extraction

The following table lists the database file formats whose content Symantec Data Loss Prevention
can extract for policy evaluation.

Table 36-11 Crackable database file formats

Format Name Format Extension

Microsoft Access MDB

Microsoft Project MPP

Other file formats supported for content extraction

Table 36-12 lists other file formats whose content Symantec Data Loss Prevention can extract
for policy evaluation.
 Supported file formats for detection 784
Supported encapsulation formats for subfile extraction

Table 36-12 Other supported formats for content extraction

Format Name Format Extension

Adobe PDF PDF

iCalendar ICS

MPEG-1 Audio layer 3 (metadata MP3

only)

Microsoft Windows Backup Utility BKF

File

Microsoft Rights Management ■ PFILE

protected files ■ Microsoft Office 2003 and older
■ Files that use Open Packaging Conventions (OPC) file technology, including
Office Open XML (including Office 2007 and greater), and XML Paper
Specification (XPS)

Note: This type of content extraction is only supported on detection servers

running on Windows servers

File Share Encryption (PGP You can decrypt Symantec File Share encrypted files and extract file contents for
Netshare) policy evaluation using the File Share plugin. Refer to the Symantec Data Loss
Prevention Encryption Insight Implementation Guide.
Note: Encryption Insight is only available with Network Discover.

Custom You can write a plug-in to perform content, subfile, and metadata extraction
operations on custom file formats. Refer to the Symantec Data Loss Prevention
Content Extraction Plug-in Developers Guide.
Note: Content extraction plug-ins are limited to detection servers.

Virtual Card File VCF and VCARD electronic business card files

Supported encapsulation formats for subfile

extraction
Symantec Data Loss Prevention supports various encapsulation formats for subfile extraction,
such as ZIP, RAR, and TAR. The system automatically performs subfile extraction for supported
formats using content-based match conditions. Subfile extraction is a subset of content
extraction in that, if the system is successful in extracting a subfile from a supported
encapsulated file, the system automatically extracts the text-based subfile contents if the subfile
format is supported for content extraction.
See “Overview of detection file format support” on page 759.
 Supported file formats for detection 785
Supported encapsulation formats for subfile extraction

Table 36-13 lists the file formats whose content Symantec Data Loss Prevention can extract
for content evaluation.

Table 36-13 Supported encapsulation formats for subfile extraction

Format Name Format Extension

7-Zip 7Z

BinHex HQX

GZIP GZ

iCalendar ICS

Java Archive JAR

Microsoft Cabinet CAB

Microsoft Compressed Folder LZH

Microsoft Compressed Folder LHA

Microsoft Visio 2013 VSD

Microsoft Visio 2013 XML VSDX

Microsoft Visio 2013_Macro VSDM

Microsoft Visio 2013_Stencil VSSX

Microsoft Visio 2013_Stencil_Macro VSSM

Microsoft Visio 2013_Template VSTX

Microsoft Visio 2013_Template_Macro VSTM

PKZIP ZIP

WinZip ZIP

RAR archive RAR

Tape Archive TAR

UNIX Compress Z

UUEncoding UUE

Virtual Card File VCF and VCARD electronic business card files

YENC YENC (server only)

 Supported file formats for detection 786
Supported file formats for metadata extraction

Supported file formats for metadata extraction

Table 36-14 lists some of the file formats that Symantec Data Loss Prevention supports for
metadata detection, and provides some example metadata fields returned for those formats.
This list is not exhaustive and is provided for quick reference only. Other file formats may be
supported, and other custom fields may be returned. The best practice is to always use the
filter utility to verify metadata support for each file format you want to detect.
See “Always use the filter utility to verify file format metadata support” on page 788.

Table 36-14 Supported file formats for metadata detection

File formats Metadata Description

Example fields:
Microsoft Office documents, for
example: ■ Title
For Microsoft Office documents, the
■ Subject
■ Word (DOC, DOCX) system extracts Object Linking and
Embedding (OLE) metadata. ■ Author
■ Excel (XLS, XLSX)
■ Keywords
■ PowerPoint (PPT, PPTX)
■ Other custom fields

Example fields:
For Adobe PDF files, the system
extracts Document Information ■ Author
Dictionary (DID) metadata. The system ■ Title
Adobe PDF files
does not support Adobe Extensible ■ Subject
Metadata Platform (XMP) metadata ■ Creation
extraction.
■ Update dates

Microsoft Visio Supported format extensions

Use the filter utility to verify metadata See “Always use the filter utility to
Other file formats (including binary and
extraction for other file formats. verify file format metadata support”
text)
on page 788.

Content extraction plug-in that

Custom file formats Custom file type metadata supports the metadata extraction
operation.

About document metadata detection

In addition to file content and subfile extraction, Symantec Data Loss Prevention supports
metadata extraction for many file formats. File format metadata is data about a file that is
stored as file properties. By default metadata extraction is disabled because it can lead to false
positives. Used properly, metadata detection can enhance the accuracy of your content-based
policy rules.
 Supported file formats for detection 787
Supported file formats for metadata extraction

For example, consider a business that uses Microsoft Office templates for their Word, Excel,
and PowerPoint documents. The business applies Microsoft OLE metadata properties in the
form of keywords to each template. The business has enabled metadata extraction and
deployed keyword policies to match on metadata keywords. These policies can detect keywords
in documents that are derived from the templates. The business also has the flexibility to use
policy exceptions to avoid generating incidents if certain metadata keywords are present.

Enabling server metadata detection

By default metadata extraction is disabled for detection servers.
To enable server metadata extraction
1 Log on to the Enforce Server administration console as a system administrator.
2 Navigate to the System > Servers and Detectors > Overview > Server/Detector Detail
- Advanced Settings screen for the detection server or cloud detector you want to enable
metadata extraction.
3 Click the Server Settings button.
4 Locate property ContentExtraction.EnableMetaData in the list.
5 Enter the value on for this property to enable metadata extraction.
6 Click Save to save the configuration.
7 Click Recycle the server at the Server Detail screen to restart the server.
8 Click Done at the Server Detail screen to complete the process.

Enabling endpoint metadata detection

By default metadata extraction is disabled for endpoints.
To enable endpoint metadata extraction
1 Log on to the Enforce Server administration console as a system administrator.
2 Navigate to the System > Agents > Agent Configuration screen for the endpoint server
you want to enable metadata extraction.
3 Create a new endpoint configuration for metadata detection, or select the default
configuration.
See “Create a separate endpoint configuration for metadata detection” on page 792.
4 Select the Advanced Agent Settings tab.
5 Locate property Detection.ENABLE_METADATA.str in the list.
 Supported file formats for detection 788
Supported file formats for metadata extraction

6 Enter the value on for this property to enable metadata extraction.

7 Click Save and Apply to save the configuration change.

Best practices for using metadata detection

Best practices for using metadata detection lists best practices for implementing metadata
detection with links to corresponding topics for detailed considerations.

Table 36-15 Considerations for implementing metadata detection

Consideration Topic

Always use filter to verify file format metadata support. See “Always use the filter utility to verify file format
metadata support” on page 788.

Enable metadata detection only if it is necessary. See “Distinguish metadata from file content and application
data” on page 790.

Avoid generating false positives by selecting keywords See “Use and tune keyword lists to avoid false positives
carefully. on metadata” on page 792.

Understand resource implications of endpoint metadata See “Understand performance implications of enabling
extraction. endpoint metadata detection” on page 792.

Create a separate endpoint configuration for metadata See “Create a separate endpoint configuration for
detection. metadata detection” on page 792.

Use response rules to add metadata tags to incidents. See “Use response rules to tag incidents with metadata”
on page 792.

Always use the filter utility to verify file format metadata support
To help you create policies that detect file format metadata, use the filter utility that is available
with any Symantec Data Loss Prevention detection or Endpoint Server installation. This utility
provides an easy way to determine which metadata fields the system returns for a given file
format. The utility generates output that contains the metadata the system will extract at runtime
for each file format you test using filter.
To verify file format metadata extraction support using filter describes how to use the filter
utility. It is recommended that you always follow this process so that you can create and tune
policies that accurately detect file format metadata.

Note: The data output by the filter utility is in ASCII format. Symantec Data Loss Prevention
processes data in Unicode format. Therefore, you may rely on the existence of the fields
returned by the filter utility, but the metadata detected by Symantec Data Loss Prevention may
not look identical to the filter output.
 Supported file formats for detection 789
Supported file formats for metadata extraction

To verify file format metadata extraction support using filter

1 On the file system where a detection server is installed, start a command prompt session.
2 Change directory to where the filter utility is located.
For example, on a default 64-bit Windows installation you would issue the following
command:
cd \SymantecDLP\Protect\plugins\contentextraction\Verity\x64

3 Issue the following command to run the filter program and display its syntax and optional
parameters.
filter -help

As indicated by the help, you use the following syntax to execute the filter utility:
filter [options] inputfile outputfile

The inputfile is an instance of the file format you want to verify. The outputfile is a
file the filter utility writes the extracted data to.
Note the following extraction options:
■ To verify metadata extraction, use the "get doc summary info" option:-i
■ To verify content extraction, use no options: filter inputfile outputfile

4 Execute filter against an instance of the file format to verify metadata extraction.
For example, on Windows you would issue the following command:
filter -i \temp\myfile.doc \temp\metadata_output.txt

Where myfile.doc is a file containing metadata you want to verify and have copied to the
\temp directory, and metadata_output.txt is the name of the file you want the system to
generate and write the extracted data to.
5 Review the filter output. The output data should be similar to the following:

1 2 1252 CodePage 1 1 "S" Title 0 0 (null) 1 1 "P" Author 0 0 (null)

0 0 (null) 0 1 "" (null) 1 1 "m" LastAuthor 1 1 "1" RevNumber
1 3 6300 Minutes EditTime 1 3 Mon Aug 27 11:53:07 2007 LastPrinted

6 Refer to the following tables for an explanation of each metadata extraction field output
by the filter utility.
Table 36-16 repeats the output from Step 5, formatted for readability.
Table 36-17 explains each column field.
 Supported file formats for detection 790
Supported file formats for metadata extraction

Table 36-16 Example filter metadata output

Column 1 Column 2 Column 3 Column 4

1 2 1252 CodePage

1 1 "S" Title

0 0 (null)

1 1 "P" Author

0 0 (null)

0 0 (null)

0 1 "" (null)

1 1 "m" LastAuthor

1 1 "1" RevNumber

1 3 6300 Minutes EditTime

1 3 Mon Aug 27 11:53:07 2007 LastPrinted

Table 36-17 Metadata fields generated by the filter utility

Column 1 Column 2 Column 3 Column 4

1 = valid field The type of data: The data payload for the The name of the field (empty
field. or null if the field is invalid).
0 = invalid field 1 = String
Note: You may ignore rows 2 = Integer
where the first column is 0.
3 = Date/Time

5 = Boolean

Distinguish metadata from file content and application data

Do not confuse metadata extraction with content extraction or application data. Some text that
may appear to be metadata is extracted as content or application data. Table 36-18 describes
some types of data that is not extracted as file format metadata to help you determine if and
when you need to enable metadata detection.
 Supported file formats for detection 791
Supported file formats for metadata extraction

Note: This list is not exhaustive and is provided for quick reference only. There may be other
types of data that are not extracted as metadata. The best practice is to use the filter utility to
verify file format metadata support. See “Always use the filter utility to verify file format metadata
support” on page 788.

Table 36-18 Data not extracted as metadata

Content type Extraction method

Application data
Application data including message transport information is extracted separately from
file format extraction. For all inbound messages, the system extracts message envelope
(header) and subject information as text at the application layer. The type of application
data that is extracted depends on the channels supported by the detection server or
endpoint.

Headers and footers Document header and footer text is extracted as content, not metadata. To avoid false
positives, it is recommended that you remove or whitelist headers and footers from
documents.

See “Use white listing to exclude non-sensitive content from partial matching”
on page 550.

See the Indexed Document Matching (IDM) chapter in the Symantec Data Loss
Prevention Administration Guide for details.

Markup text Markup text is extracted as content, not metadata. Markup text extraction is supported
for HTML, XML, SGML, and more. Markup text extraction is disabled by default.

See “Advanced server settings” on page 245.

See “Advanced agent settings” on page 1804.

See the "Advanced Server Settings" topic in the Symantec Data Loss Prevention
Administration Guide to enable it.

Hidden text Hidden text is extracted as content, not metadata. Hidden text extraction in the form
of tracked changes is supported for some Microsoft Office file formats. Hidden text
extraction is disabled by default.

See “Advanced server settings” on page 245.

See “Advanced agent settings” on page 1804.

See the "Advanced Server Settings" topic in the Symantec Data Loss Prevention
Administration Guide to enable it.

Watermarks Text-based watermarks are extracted as content, not metadata. Text-based watermark
detection is supported for Microsoft Word documents (versions 2003 and 2007). It is
not supported for other file formats.
 Supported file formats for detection 792
Supported file formats for metadata extraction

Use and tune keyword lists to avoid false positives on metadata

Enabling metadata extraction can cause false positives because more text is checked for a
match. For example, if you have a policy that detects keywords and metadata extraction is
enabled, the policy reports a match if a keyword is present in the content or in the metadata.
Once the system has extracted the content and the metadata, the text is normalized and
streamed to the detection component for matching. The detection component has no knowledge
of the source of the text, whether it is application data, content, or metadata.
To detect file format metadata, you define keyword conditions for rules or exceptions that
contain keywords that are specific to one or more file formats. To avoid generating false
positives, clearly define the keyword lists in your policies. The keywords you use to detect
metadata should be unique and distinct from keywords or phrases you use to detect content.
Test and tune keyword lists to improve metadata detection accuracy.

Understand performance implications of enabling endpoint metadata

detection
On the endpoint, enabling metadata extraction does not add overhead if no content rules are
deployed. If content rules are deployed to the endpoint, enabling metadata extraction may
introduce minor overhead because there is extra data to inspect. Test and tune your endpoint
policy keyword lists to ensure that metadata detection is efficient.

Create a separate endpoint configuration for metadata detection

When you enable endpoint metadata detection, consider creating a custom endpoint
configuration specifically for metadata detection. By doing so you can easily revert to the
default configuration if necessary.

Use response rules to tag incidents with metadata

You cannot use metadata detection to apply tags to inbound files or documents that generate
incidents. If this is desired, consider using a FlexResponse plug-in.
See “About response rules” on page 1199.
See the Symantec Data Loss Prevention Administration Guide for details.
 Chapter 37
Library of system data
identifiers
This chapter includes the following topics:

■ Library of system data identifiers

■ ABA Routing Number

■ Argentina Tax Identification Number

■ Australian Business Number

■ Australian Company Number

■ Australian Medicare Number

■ Australian Passport Number

■ Australian Tax File Number

■ Austria Passport Number

■ Austria Tax Identification Number

■ Austrian Social Security Number

■ Belgian National Number

■ Belgium Driver's License Number

■ Belgium Passport Number

■ Belgium Tax Identification Number

■ Belgium Value Added Tax (VAT) Number

 Library of system data identifiers 794

■ Brazilian Bank Account Number

■ Brazilian Election Identification Number

■ Brazilian National Registry of Legal Entities Number

■ Brazilian Natural Person Registry Number (CPF)

■ British Columbia Personal Healthcare Number

■ Bulgarian Uniform Civil Number - EGN

■ Burgerservicenummer

■ Canadian Social Insurance Number

■ Chilean National Identification Number

■ China Passport Number

■ Codice Fiscale

■ Colombian Addresses

■ Colombian Cell Phone Number

■ Colombian Personal Identification Number

■ Colombian Tax Identification Number

■ Credit Card Magnetic Stripe Data

■ Credit Card Number

■ CUSIP Number

■ Czech Personal Identification Number

■ Denmark Personal Identification Number

■ Drivers License Number – CA State

■ Drivers License Number - FL, MI, MN States

■ Drivers License Number - IL State

■ Drivers License Number - NJ State

■ Drivers License Number - NY State

■ Driver's License Number - WA State

■ Driver's License Number - WI State

 Library of system data identifiers 795

■ Drug Enforcement Agency (DEA) Number

■ Finnish Personal Identification Number

■ France Driver's License Number

■ France Health Insurance Number

■ France Tax Identification Number

■ France Value Added Tax (VAT) Number

■ French INSEE Code

■ French Passport Number

■ French Social Security Number

■ German Passport Number

■ German Personal ID Number

■ Germany Driver's License Number

■ Germany Value Added Tax (VAT) Number

■ Greek Tax Identification Number

■ Hong Kong ID

■ Hungarian Social Security Number

■ Hungarian Tax Identification Number

■ Hungarian VAT Number

■ IBAN Central

■ IBAN East

■ IBAN West

■ Indian Aadhaar Card Number

■ Indian Permanent Account Number

■ Indonesian Identity Card Number

■ International Mobile Equipment Identity Number

■ International Securities Identification Number

■ IP Address
 Library of system data identifiers 796

■ IPv6 Address

■ Irish Personal Public Service Number

■ Israel Personal Identification Number

■ Italy Driver's License Number

■ Italy Health Insurance Number

■ Italy Passport Number

■ Italy Value Added Tax (VAT) Number

■ Japan Passport Number

■ Japanese Juki-Net Identification Number

■ Japanese My Number - Corporate

■ Japanese My Number - Personal

■ Korea Passport Number

■ Korea Residence Registration Number for Foreigners

■ Korea Residence Registration Number for Korean

■ Luxembourg National Register of Individuals Number

■ Malaysian MyKad Number (MyKad)

■ Mexican Personal Registration and Identification Number

■ Mexican Tax Identification Number

■ Mexican Unique Population Registry Code

■ Mexico CLABE Number

■ National Drug Code (NDC)

■ National Provider Identifier Number

■ Netherlands Driver's License Number

■ Netherlands Passport Number

■ Netherlands Tax Identification Number

■ Netherlands Value Added Tax (VAT) Number

■ New Zealand National Health Index Number

 Library of system data identifiers 797

■ Norwegian Birth Number

■ People's Republic of China ID

■ Polish Identification Number

■ Polish REGON Number

■ Polish Social Security Number (PESEL)

■ Polish Tax Identification Number

■ Randomized US Social Security Number (SSN)

■ Romanian Numerical Personal Code

■ Russian Passport Identification Number

■ Russian Taxpayer Identification Number

■ Singapore NRIC data identifier

■ South African Personal Identification Number

■ Spain Driver's License Number

■ Spanish Customer Account Number

■ Spanish DNI ID

■ Spanish Passport Number

■ Spanish Social Security Number

■ Spanish Tax Identification (CIF)

■ Swedish Passport Number

■ Swedish Personal Identification Number

■ SWIFT Code

■ Swiss AHV Number

■ Swiss Social Security Number (AHV)

■ Taiwan ROC ID

■ Thailand Personal Identification Number

■ Turkish Identification Number

■ UK Drivers Licence Number

 Library of system data identifiers 798
Library of system data identifiers

■ UK Electoral Roll Number

■ UK National Health Service (NHS) Number

■ UK National Insurance Number

■ UK Passport Number

■ UK Tax ID Number

■ Ukraine Passport (Domestic)

■ Ukraine Identity Card

■ Ukraine Passport (International)

■ United Arab Emirates Personal Number

■ US Individual Tax Identification Number (ITIN)

■ US Passport Number

■ US Social Security Number (SSN)

■ US ZIP+4 Postal Codes

■ Venezuela National Identification Number

Library of system data identifiers

This section lists all data identifiers provided by the Data Loss Prevention system.

ABA Routing Number

The American Banking Association (ABA) routing number, also known as a routing transit
number (RTN), is used to identify financial institutions and process transactions.
This data identifier provides the following breadths of detection:
■ The wide breadth validates the detected number using the final check digit.
See “ABA Routing Number wide breadth” on page 799.
■ The medium breadth validates the detected number using the final check digit and eliminates
common test numbers.
See “ABA Routing Number medium breadth” on page 799.
■ The narrow breadth validates the detected number using the final check digit, eliminates
common test numbers, and requires the presence of an ABA-related keyword.
See “ABA Routing Number narrow breadth” on page 800.
 Library of system data identifiers 799
ABA Routing Number

ABA Routing Number wide breadth

The wide breadth detects 9-digit numbers. It validates the number using the final check digit.

Table 37-1 ABA Routing Number wide-breadth patterns

Pattern

[0123678]\d{8}

[0123678]\d{3}-\d{4}-\d

Table 37-2 ABA Routing Number wide-breadth validators

Mandatory validator Description

ABA Checksum Every ABA routing number must start with the following
two digits: 00-15,21-32,61-72,80 and pass an ABA-specific,
position-weighted checksum.

ABA Routing Number medium breadth

The medium breadth detects 9-digit numbers. It validates the number using the final check
digit.

Table 37-3 ABA Routing Number medium-breadth patterns

Pattern

[0123678]\d{8}

[0123678]\d{3}-\d{4}-\d

Table 37-4 ABA Routing Number medium-breadth validators

Mandatory validator Description

ABA Checksum Every ABA routing number must start with the following
two digits: 00-15,21-32,61-72,80 and pass an ABA specific,
position-weighted check sum.

Exclude beginning characters At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Input: 123456789

Duplicate digits Ensures that a string of digits is not all the same.
 Library of system data identifiers 800
ABA Routing Number

Table 37-4 ABA Routing Number medium-breadth validators (continued)

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

ABA Routing Number narrow breadth

The narrow breadth detects 9-digit numbers and validates the number using the final check
digit. It eliminates common test numbers, such as 123456789, ranges reserved for future use,
and duplicate digits. It also requires the presence of an ABA-related keyword.

Table 37-5 ABA Routing Number narrow-breadth patterns

Pattern

[0123678]\d{8}

[0123678]\d{3}-\d{4}-\d

Table 37-6 ABA Routing Number narrow-breadth validators

Mandatory validator Description

ABA Checksum Every ABA routing number must start with the following
two digits: 00-15,21-32,61-72,80 and pass an ABA specific,
position-weighted checksum.

Exclude beginning characters With this option selected, data beginning with any of the
following list of values will not be matched.

Input: 123456789

Duplicate digits Ensures that a string of digits is not all the same.

Find keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

aba, aba #, aba routing #, aba routing number, aba#,

abarouting#, abaroutingnumber, american bank
association routing #, american bank association
routing number, americanbankassociationrouting#,
americanbankassociationroutingnumber, bank routing
#, bank routing number, bankrouting#,
bankroutingnumber

Number delimiter Validates a match by checking the surrounding numbers.

 Library of system data identifiers 801
Argentina Tax Identification Number

Argentina Tax Identification Number

Argentina issues a DNI (Documento Nacional de Identidad) as its national form of identification.
It is assigned at birth by the National Registry for People. For tax paying purposes, the CUIT
and the CUIL numbers are issued which are based on the DNI.
This data identifier provides the following breadths of detection:
■ The wide breadth detects an 11-digit number without checksum validation.
See “Argentina Tax Identification Number wide breadth” on page 801.
■ The medium breadth detects an 11-digit number with checksum validation. It also checks
for common test numbers and duplicate digits.
See “Argentina Tax Identification Number medium breadth” on page 802.
■ The narrow breadth detects an 11-digit number that passes checksum validation. It also
checks for common test numbers, duplicate digits, and requires the presence of Argentina
Tax Identification Number-related keywords.
See “Argentina Tax Identification Number narrow breadth” on page 802.

Argentina Tax Identification Number wide breadth

The wide breadth detects an 11-digit number without checksum validation.

Table 37-7 Argentina Tax Identification Number wide-breadth patterns

Pattern

20-\d{8}-\d

23-\d{8}-\d

27-\d{8}-\d

30-\d{8}-\d

33-\d{8}-\d

34-\d{8}-\d

Table 37-8 Argentina Tax Identification Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.
 Library of system data identifiers 802
Argentina Tax Identification Number

Argentina Tax Identification Number medium breadth

The medium breadth detects an 11-digit number with checksum validation. It also checks for
common test numbers and duplicate digits.

Table 37-9 Argentina Tax Identification Number medium-breadth patterns

Pattern

20-\d{8}-\d

23-\d{8}-\d

27-\d{8}-\d

30-\d{8}-\d

33-\d{8}-\d

34-\d{8}-\d

Table 37-10 Argentina Tax Identification Number medium breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Argentinian Tax Identity Number Validation Check Computes the checksum and validates the pattern against
it.

Argentina Tax Identification Number narrow breadth

The narrow breadth detects an 11-digit number that passes checksum validation. It also checks
for common test numbers, duplicate digits, and requires the presence of Argentina Tax
Identification Number-related keywords.

Table 37-11 Argentina Tax Identification Number narrow-breadth patterns

Pattern

20-\d{8}-\d

23-\d{8}-\d

27-\d{8}-\d

30-\d{8}-\d

33-\d{8}-\d
 Library of system data identifiers 803
Australian Business Number

Table 37-11 Argentina Tax Identification Number narrow-breadth patterns (continued)

Pattern

34-\d{8}-\d

Table 37-12 Argentina Tax Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Argentinian Tax Identity Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

Tax ID, tax number, Tax No., taxpayer ID, tax identity
number, tax identification no, tax identification number,
TaxID#, taxidnumber#, taxpayer number, Argentina
taxpayer ID

Número de Identificación Fiscal, número de

contribuyente

Australian Business Number

The Australian Business Number, or ABN, is a unique identifier issued by the Australian
Business Register (ABR), operated by the Australian Taxation Office (ATO).
This data identifier provides the following breadths of detection:
■ The wide breadth detects an 11-digit number without checksum validation.
See “Australian Business Number wide breadth” on page 804.
■ The medium breadth detects an 11-digit number with checksum validation. It also eliminates
common test numbers and ranges reserved for future use.
See “Australian Business Number medium breadth” on page 804.
■ The narrow breadth detects an 11-digit number that passes checksum validation. It also
eliminates common test numbers, ranges reserved for future use, duplicate digits, and
requires the presence of ABN-related keywords.
See “Australian Business Number narrow breadth” on page 804.
 Library of system data identifiers 804
Australian Business Number

Australian Business Number wide breadth

The wide breadth detects an 11-digit number without checksum validation.

Table 37-13 Australian Business Number wide-breadth patterns

Pattern

\d{11}

\d{2}[ -]\d{3}[ -]\d{3}[ -]\d{3}

Table 37-14 Australian Business Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Australian Business Number medium breadth

The medium breadth detects an 11-digit number with checksum validation. It also eliminates
common test numbers, such as 123456789, and ranges reserved for future use.

Table 37-15 Australian Business Number medium-breadth patterns

Pattern

\d{11}

\d{2}[ -]\d{3}[ -]\d{3}[ -]\d{3}

Table 37-16 Australian Business Number medium-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Australian Business Number Validation Check Computes the checksum and validates the pattern against
it.

Australian Business Number narrow breadth

The narrow breadth detects an 11-digit number that passes checksum validation. It also
eliminates common test numbers, such as 123456789, ranges reserved for future use, duplicate
digits, and requires the presence of ABN-related keywords.
 Library of system data identifiers 805
Australian Company Number

Table 37-17 Australian Business Number narrow-breadth patterns

Pattern

\d{11}

\d{2}[ -]\d{3}[ -]\d{3}[ -]\d{3}

Table 37-18 Australian Business Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Australian Business Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

Australia Business No, Business No, BusinessNo#,

Business Number, Australia Business No., ABN, abn#,
businessID#, business ID, abn, ABN#, business
number, businessno#

Australian Company Number

An Australian Company Number (ACN) is a unique 9-digit number issued by the Australian
Securities and Investments Commission to every company registered under the Commonwealth
Corporations Act 2001.
The Australia Company Number data identifier provides three breadths of detection:
■ The wide breadth detects a 9-digit number without checksum validation.
See “Australian Company Number wide breadth” on page 806.
■ The medium breadth detects a 9-digit number with checksum validation.
See “Australian Company Number medium breadth” on page 806.
■ The narrow breadth detects a 9-digit number with checksum validation. It also requires the
presence of ACN-related keywords.
See “Australian Company Number narrow breadth” on page 806.
 Library of system data identifiers 806
Australian Company Number

Australian Company Number wide breadth

The wide breadth detects a 9-digit number without checksum validation.

Table 37-19 Australian Company Number wide-breadth pattern

Pattern

\d{3} \d{3} \d{3}

Table 37-20 Australian Company Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Australian Company Number medium breadth

The wide breadth detects a 9-digit number without checksum validation.

Table 37-21 Australian Company Number medium-breadth pattern

Pattern

\d{3} \d{3} \d{3}

Table 37-22 Australian Company Number medium-breadth validators

Mandatory validator Description

Australian Company Number Validation Check Computes the checksum and validates the pattern against
it.

Australian Company Number narrow breadth

The wide breadth detects a 9-digit number without checksum validation.

Table 37-23 Australian Company Number narrow-breadth pattern

Pattern

\d{3} \d{3} \d{3}

 Library of system data identifiers 807
Australian Medicare Number

Table 37-24 Australian Company Number narrow-breadth validators

Mandatory validator Description

Australian Company Number Validation Check Computes the checksum and validates the pattern against
it.

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Australia Company Number, ACN, Australia Company

No., ACN No, ACN No#, Australia Company No#, ACN
Number

Australian Medicare Number

The Australian Medicare Number is a personal identifier allocated by the Australian Health
Insurance Commission to eligible persons under the Medicare scheme. This number appears
on the Australian Medicare card.
The Australian Medicare Number data identifier detects an 8- or 9-digit number that matches
the format of the Australian Medicare Number.
The Australian Medicare Number data identifier provides three breadths of detection:
■ The wide breadth detects an 8- or 9-digit number without checksum validation.
See “Australian Medicare Number wide breadth” on page 807.
■ The medium breadth detects an 8- or 9-digit number with checksum validation.
See “Australian Medicare Number medium breadth” on page 808.
■ The narrow breadth detects an 8- or 9-digit number with checksum validation. It also requires
the presence of Australian Medicare Number-related keywords.
See “Australian Medicare Number narrow breadth” on page 809.

Australian Medicare Number wide breadth

The wide breadth detects an 8- or 9-digit number without checksum validation.
 Library of system data identifiers 808
Australian Medicare Number

Table 37-25 Australian Medicare Number wide-breadth patterns

Pattern

[2-6]\d{10}

[2-6]\d{9}

[2-6]\d{3} \d{5} \d{1}

[2-6]\d{3}-\d{5}-\d{1}

[2-6]\d{9}[ -/]\d{1}

[2-6]\d{3} \d{5} \d{1}[ -/]\d{1}

[2-6]\d{3}-\d{5}-\d{1}[ -/]\d{1}

[2-6]\d{3} \d{5} \d \d

[2-6]\d{3}-\d{5}-\d-\d

Table 37-26 Australian Medicare Number wide-breadth validator

Validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Australian Medicare Number medium breadth

The medium breadth detects an 8- or 9-digit number with checksum validation.

Table 37-27 Australian Medicare Number medium breadth patterns

Pattern

[2-6]\d{10}

[2-6]\d{9}

[2-6]\d{3} \d{5} \d{1}

[2-6]\d{3}-\d{5}-\d{1}

[2-6]\d{9}[ -/]\d{1}

[2-6]\d{3} \d{5} \d{1}[ -/]\d{1}

[2-6]\d{3}-\d{5}-\d{1}[ -/]\d{1}
 Library of system data identifiers 809
Australian Medicare Number

Table 37-27 Australian Medicare Number medium breadth patterns (continued)

Pattern

[2-6]\d{3} \d{5} \d \d

[2-6]\d{3}-\d{5}-\d-\d

Table 37-28 Australian Medicare Number medium breadth validators

Validator Description

Australian Medicare Number Validation Check Computes the checksum and validates the pattern against
it.

Number Delimiter Validates a match by checking the surrounding characters.

Australian Medicare Number narrow breadth

The narrow breadth detects an 8- or 9-digit number with checksum validation. It also requires
the presence of Australian Medicare Number-related keywords.

Table 37-29 Australian Medicare Number narrow breadth patterns

Pattern

[2-6]\d{10}

[2-6]\d{9}

[2-6]\d{3} \d{5} \d{1}

[2-6]\d{3}-\d{5}-\d{1}

[2-6]\d{9}[ -/]\d{1}

[2-6]\d{3} \d{5} \d{1}[ -/]\d{1}

[2-6]\d{3}-\d{5}-\d{1}[ -/]\d{1}

[2-6]\d{3} \d{5} \d \d

[2-6]\d{3}-\d{5}-\d-\d

Table 37-30 Australian Medicare Number narrow breadth validators

Validator Description

Duplicate digits Ensures that a string of digits is not all the same.
 Library of system data identifiers 810
Australian Passport Number

Table 37-30 Australian Medicare Number narrow breadth validators (continued)

Validator Description

Australian Medicare Number Validation Check Computes the checksum and validates the pattern against
it.

Number Delimiter Validates a match by checking the surrounding characters.

Find Keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

Australian Medicare Number, Medicare Number,

Medicare No., Medicare No#, Australian Medicare No.,
Australian Medicare No#

Australian Passport Number

Australian passports are travel documents issued to Australian citizens by the Australian
Passport Office of the Department of Foreign Affairs and Trade.
The Australia Passport Number data identifier provides two breadths of detection:
■ The wide breadth detects an 8-character number without checksum validation.
See “ Australian Passport Number wide breadth” on page 810.
■ The narrow breadth detects an 8-character number without checksum validation. It requires
the presence of Australian Passport Number-related keywords.
See “Australian Passport Number narrow breadth” on page 811.

Australian Passport Number wide breadth

The wide breadth detects an 8-character number without checksum validation.

Table 37-31 Australian Passport Number wide-breadth patterns

Pattern

[XBCEGTHJLMNP]\d{7}

[XBCEGTHJLMNP] \d{7}
 Library of system data identifiers 811
Australian Passport Number

Table 37-32 Australian Passport Number wide-breadth validator

Mandatory validator Description

Exclude ending characters Any number ending with the following characters is
excluded from matching:

0000000, 1111111, 2222222, 3333333, 4444444,

5555555, 6666666, 7777777, 8888888, 9999999

Australian Passport Number narrow breadth

The narrow breadth detects an 8-character identifier with checksum validation. It also requires
the presence of Australian Passport Number-related keywords.

Table 37-33 Australian Passport Number narrow-breadth patterns

Pattern

[XBCEGTHJLMNP]\d{7}

[XBCEGTHJLMNP] \d{7}

Table 37-34 Australian Passport Number narrow-breadth validators

Mandatory validator Description

Exclude ending characters This validator excludes the following characters at the end
of the number:

0000000, 1111111, 2222222, 3333333, 4444444,

5555555, 6666666, 7777777, 8888888, 9999999

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Australian passport no., Australian Passport Number,

Australian passport number, Passport number,
passport number, passport#, passportno,
passportnumber#, australianpassportnumber,
passportno#
 Library of system data identifiers 812
Australian Tax File Number

Australian Tax File Number

The Australian Tax File Number (TFN) is an 8- or 9-digit number issued by the Australian
Taxation Office (ATO) to taxpayers (individual, company, superannuation fund, partnership,
or trust) to identify their Australian tax dealings.
This data identifier provides the following breadths of detection:
■ The wide breadth validates the detected number using the final check digit.
See Table 37-35 on page 812.
■ The narrow breadth validates the detected number using the final check digit. It also requires
the presence of a TFN-related keyword.
See “Australian Tax File Number narrow breadth” on page 812.

Australian Tax File Number wide breadth

The wide breadth validates the detected number using the final check digit.

Table 37-35 Australian Tax File Number wide-breadth patterns

Pattern

\d{8}

\d{9}

Table 37-36 Australian Tax File Number wide-breadth validators

Mandatory validator Description

Australian Tax File validation check Computes the checksum and validates the pattern against
it.

Australian Tax File Number narrow breadth

The narrow breadth validates the detected number using the final check digit. It also requires
the presence of a TFN-related keyword.

Table 37-37 Australian Tax File Number narrow-breadth patterns

Pattern

\d{8}

\d{9}
 Library of system data identifiers 813
Austria Passport Number

Table 37-38 Australian Tax File Number narrow-breadth validators

Mandatory validator Description

Australian Tax File validation check Computes the checksum and validates the pattern
against it.

Find Keywords At least one of the following keywords or key

phrases must be present for the data to be matched
when you use this option.

Inputs:

TFN, Tax File Number, Australia TFN, Australia

Tax File Number, ATO, ATO TFN, ATO tax file
number

Austria Passport Number

Austrian passports are travel documents issued to Austrian citizens by the Austrian Passport
Office of the Department of Foreign Affairs and Trade, both in Austria and overseas, and
enable the passport holder to travel internationally.
The Austria Passport Number data identifier provides two breadths of detection:
■ The wide breadth detects an eight-digit alphanumeric number without checksum validation.
See “Austria Passport Number wide breadth” on page 813.
■ The narrow breadth detects an eight-digit alphanumeric number. It also requires the
presence of passport-related keywords.
See “Austria Passport Number narrow breadth” on page 814.

Austria Passport Number wide breadth

The wide breadth detects an eight-digit alphanumeric number without checksum validation.

Table 37-39 Austria Passport Number wide-breadth patterns

Patterns

\l[ ]\d{7}

\l\d{7}
 Library of system data identifiers 814
Austria Tax Identification Number

Table 37-40 Austria Passport Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Austria Passport Number narrow breadth

The narrow breadth detects an eight-digit alphanumeric number. It also requires the presence
of passport-related keywords.

Table 37-41 Austria Passport Number narrow-breadth patterns

Pattern

\l[ ]\d{7}

\l\d{7}

Table 37-42 Austria Passport Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Find Keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

REISEPASS, passport, ÖSTERREICHISCH REISEPASS,

reisepass

Austria Tax Identification Number

Austria issues tax identification numbers to individuals based on their area of residence to
identify taxpayers and facilitate national taxes.
The Austria Tax Identification Number provides two breadths of detection:
■ The wide breadth detects a nine-digit number without checksum validation.
See “Austria Tax Identification Number wide breadth” on page 815.
■ The narrow breadth detects a nine-digit number. It also requires the presence of related
keywords.
See “Austria Tax Identification Number narrow breadth” on page 815.
 Library of system data identifiers 815
Austria Tax Identification Number

Austria Tax Identification Number wide breadth

The wide breadth detects a nine-digit number without checksum validation.

Table 37-43 Austria Tax Identification Number wide-breadth patterns

Pattern

\d{2}-\d{3}/\d{4}

\d{2} \d{3} \d{4}

\d{9}

Table 37-44 Austria Tax Identification Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Austria Tax Identification Number narrow breadth

The narrow breadth detects a nine-digit number. It also requires the presence of related
keywords.

Table 37-45 Austria Tax Identification Number narrow-breadth patterns

Patterns

\d{2}-\d{3}/\d{4}

\d{2} \d{3} \d{4}

\d{9}

Table 37-46 Austria Tax Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

 Library of system data identifiers 816
Austrian Social Security Number

Table 37-46 Austria Tax Identification Number narrow-breadth validators (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Austria, TIN, tax identification number, tax number,

Austrian Tax Number, Österreich, Steuernummer

Austrian Social Security Number

A social security number is allocated to Austrian citizens who receive available social security
benefits. It is allocated by the umbrella association of the Austrian social security authorities.
This data identifier provides the following breadths of detection:
■ The wide breadth detects a 10-digit number without checksum validation.
See “Austrian Social Security Number wide breadth” on page 816.
■ The medium breadth detects a 10-digit number that passes checksum validation. It also
eliminates common test numbers and ranges reserved for future use.
See “Austrian Social Security Number medium breadth” on page 817.
■ The narrow breadth detects a 10-digit number that passes checksum validation. It also
eliminates common test numbers, ranges reserved for future use, duplicate digits, and
requires the presence of Austrian Social Security Number-related keywords.
See “Austrian Social Security Number narrow breadth” on page 817.

Austrian Social Security Number wide breadth

The wide breadth detects a 10-digit number without checksum validation.

Table 37-47 Austrian Social Security Number wide-breadth patterns

Pattern

\d{10}

\d{4}-\d{6}

\d{4} \d{6}
 Library of system data identifiers 817
Austrian Social Security Number

Table 37-48 Austrian Social Security Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Austrian Social Security Number medium breadth

The narrow breadth detects a 10-digit number that passes checksum validation. It also
eliminates common test numbers, such as 123456789, and ranges reserved for future use.

Table 37-49 Austrian Social Security Number medium-breadth patterns

Pattern

\d{10}

\d{4}-\d{6}

\d{4} \d{6}

Table 37-50 Austrian Social Security Number medium-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Austrian Social Security Number Validation Check Computes the checksum and validates the pattern against
it.

Austrian Social Security Number narrow breadth

The narrow breadth detects a 10-digit number that passes checksum validation. It also
eliminates common test numbers, ranges reserved for future use, duplicate digits, and requires
the presence of Austrian Social Security Number-related keywords.

Table 37-51 Austrian Social Security Number narrow-breadth patterns

Pattern

\d{10}

\d{4}-\d{6}

\d{4} \d{6}
 Library of system data identifiers 818
Belgian National Number

Table 37-52 Austrian Social Security Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Austrian Social Security Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

social security no, social security number, social

security code, insurance number, Austrian SSN, SSN#,
ssn#, SSN, ssn, insurance code, insurancecode#,
socialsecurityno# sozialversicherungsnummer, soziale
sicherheit kein, Versicherungsnummer

Belgian National Number

All citizens of Belgium have a National Number. Belgians 12 years of age and older are issued
a Belgian identity card.
Belgian National Number is used also as a Belgian Social Security Number for citizens.
This data identifier provides the following breadths of detection:
■ The wide breadth detects an 11-digit number without checksum validation.
See “Belgian National Number wide breadth ” on page 818.
■ The medium breadth detects an 11-digit number with checksum validation.
See “Belgian National Number medium breadth” on page 819.
■ The narrow breadth detects an 11-digit number without checksum validation.
See “Belgian National Number narrow breadth” on page 819.

Belgian National Number wide breadth

The wide breadth detects an 11-digit number without checksum validation.
 Library of system data identifiers 819
Belgian National Number

Table 37-53 Belgian National Number wide-breadth patterns

Pattern

\d{11}

\d{6} \d{3} \d{2}

\d{2}.\d{2}.\d{2}-\d{3}.\d{2}

\d{2}[ .][012345]\d[ .][0123]\d[ -.]\d{3}[ .-]\d{2}

Table 37-54 Belgian National Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Belgian National Number medium breadth

The medium breadth detects an 11-digit number with checksum validation.

Table 37-55 Belgian National Number medium-breadth patterns

Pattern

\d{11}

\d{6} \d{3} \d{2}

\d{2}.\d{2}.\d{2}-\d{3}.\d{2}

\d{2}[ .][012345]\d[ .][0123]\d[ -.]\d{3}[ .-]\d{2}

Table 37-56 Belgian National Number medium-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Belgian National Number Validation Check Computes the checksum and validates the pattern against
it.

Belgian National Number narrow breadth

The narrow breadth detects an 11-digit number with checksum validation. It also requires the
presence of Belgian Nation Number-related keywords.
 Library of system data identifiers 820
Belgium Driver's License Number

Table 37-57 Belgian National Number narrow-breadth patterns

Pattern

\d{11}

\d{6} \d{3} \d{2}

\d{2}.\d{2}.\d{2}-\d{3}.\d{2}

\d{2}[ .][012345]\d[ .][0123]\d[ -.]\d{3}[ .-]\d{2}

Table 37-58 Belgian National Number narrow-breadth validators

Mandatory validator Description

Belgian National Number Validation Check Computes the checksum and validates the pattern against
it.

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Belgian national number, national number ,social

security number, nationalnumber#, ssn#, ssn,
nationalnumber, bnn#, bnn, personal ID number,
personalIDnumber#, Numéro national, numéro de
sécurité, numéro d'assuré, identifiant national,
identifiantnational#, Numéronational#

Belgium Driver's License Number

Identification number for an individual's driver's licence issued by the Driver and Vehicle
Licensing Agency of the Belgium.
The Belgium Driver's License Number data identifier provides two breadths of detection:
■ The wide breadth detects a 10-digit number without checksum validation.
See “Belgium Driver's License Number wide breadth” on page 821.
■ The narrow breadth detects a 10-digit number. It also requires the presence of driver's
license-related keywords.
See “Belgium Driver's License Number narrow breadth” on page 821.
 Library of system data identifiers 821
Belgium Driver's License Number

Belgium Driver's License Number wide breadth

The wide breadth detects a 10-digit number without checksum validation.

Table 37-59 Belgium Driver's License Number wide-breadth pattern

Pattern

\d{10}

Table 37-60 Belgium Driver's License Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Belgium Driver's License Number narrow breadth

The narrow breadth detects a 10-digit number. It also requires the presence of driver's
license-related keywords.

Table 37-61 Belgium Driver's License Number narrow-breadth pattern

Pattern

\d{10}

Table 37-62 Belgium Driver's License Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

 Library of system data identifiers 822
Belgium Passport Number

Table 37-62 Belgium Driver's License Number narrow-breadth validators (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Führerschein, Fuhrerschein, Fuehrerschein,

Führerscheinnummer, Fuhrerscheinnummer,
Fuehrerscheinnummer, Führerscheinnummer,
Fuhrerscheinnummer, Fuehrerscheinnummer,
Führerschein- Nr, Fuhrerschein- Nr, Fuehrerschein-
Nr, DL#, Driver License, Driver License Number, driver
license number, Driver Licence, Drivers Lic., Drivers
License, Drivers Licence, Driver's License, Driver's
License Number, driver's license number, Driver's
Licence Number, Driving License number, driving
license number, DLNo#, dlno#, permis de conduire,
rijbewijs, Rijbewijsnummer, Numéro permis conduire

Belgium Passport Number

Belgian passports are issued by the Belgian state to its citizens to facilitate international travel.
The Federal Public Service Foreign Affairs, formerly known as the Ministry of Foreign Affairs,
is responsible for issuing and renewing Belgian passports.
The Belgium Passport Number data identifier provides two breadths of detection:
■ The wide breadth detects an eight-digit pattern without checksum validation.
See “Belgium Passport Number wide breadth” on page 822.
■ The narrow breadth detects an eight-digit pattern. It also requires the presence of related
keywords.
See “Belgium Passport Number narrow breadth” on page 823.

Belgium Passport Number wide breadth

The wide breadth detects an eight-digit pattern without checksum validation.

Table 37-63 Belgium Passport Number wide-breadth pattern

Pattern

\l{2}\d{6}
 Library of system data identifiers 823
Belgium Tax Identification Number

Table 37-64 Belgium Passport Number wide-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Belgium Passport Number narrow breadth

The narrow breadth detects an eight-digit pattern. It also requires the presence of related
keywords.

Table 37-65 Belgium Passport Number narrow-breadth patterns

Patterns

\l{2}\d{6}

Table 37-66 Belgium Passport Number narrow-breadth patterns

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

passport number, Paspoort, paspoort,

paspoortnummer, Reisepass kein, Reisepass,
Passnummer, Passeport, Passeport livre, Passeport
carte, numéro passeport, Belgian Passport Number,
belgian passport number, passport no

Belgium Tax Identification Number

Belgium issues a tax identification number for persons who has obligations to declare taxes
in Belgium.
The Belgium Tax Identification Number data identifier provides two breadths of detection:
■ The wide breadth detects an 11-digit number without checksum validation. It also requires
the presence of related keywords.
See “Belgium Tax Identification Number wide breadth” on page 824.
■ The narrow breadth detects an 11-digit number that passes checksum validation. It also
requires the presence of tax number related keywords.
 Library of system data identifiers 824
Belgium Tax Identification Number

See “Belgium Tax Identification Number narrow breadth” on page 824.

Belgium Tax Identification Number wide breadth

The wide breadth detects an 11-digit number without checksum validation. It also requires the
presence of related keywords.

Table 37-67 Belgium Tax Identification Number wide-breadth patterns

Patterns

\d{2}[01]\d[0123]\d{6}

\d{2}[01]\d[0123]\d \d{3} \d{2}

\d{2}.[01]\d.[0123]\d-\d{3}.\d{2}

\d{2}[ .][01]\d[ .][0123]\d[ -.]\d{3}[ .-]\d{2}

Table 37-68 Belgium Tax Identification Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

tax number, national registration number, National

Registration Number, tax registration number, tax id,
Tax ID, TAX Number, Numéro de registre national,
numéro d'identification fiscale, belasting aantal,
Steuernummer, NIF, nif, NIF#, nif#

Belgium Tax Identification Number narrow breadth

The narrow breadth detects an 11-digit number that passes checksum validation. It also
requires the presence of tax number related keywords.

Table 37-69 Belgium Tax Identification Number narrow-breadth patterns

Patterns

\d{2}[01]\d[0123]\d{6}
 Library of system data identifiers 825
Belgium Value Added Tax (VAT) Number

Table 37-69 Belgium Tax Identification Number narrow-breadth patterns (continued)

Patterns

\d{2}[01]\d[0123]\d \d{3} \d{2}

\d{2}.[01]\d.[0123]\d-\d{3}.\d{2}

\d{2}[ .][01]\d[ .][0123]\d[ -.]\d{3}[ .-]\d{2}

Table 37-70 Belgium Tax Identification Number narrow-breadth validators

Mandatory validator Description

Belgian Tax Identification Number Validation Check Checksum validator for Belgium Tax Identification Number.

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

tax number, national registration number, National

Registration Number, tax registration number, tax id,
Tax ID, TAX Number, Numéro de registre national,
numéro d'identification fiscale, belasting aantal,
Steuernummer, NIF, nif, NIF#, nif#

Belgium Value Added Tax (VAT) Number

Value Added Tax (VAT) is a consumption tax that is borne by the end consumer. VAT is paid
for each transaction in the manufacturing and distribution process. For Belgium, the Value
Added Tax is issued by VAT office for the region in which the business is established.
The Belgium Value Added Tax (VAT) Number data identifier provides three breadths of
detection:
■ The wide breadth detects a 12-digit alphanumeric pattern beginning with BE without
checksum validation.
See “Belgium Value Added Tax (VAT) Number wide breadth” on page 826.
■ The medium breadth detects a 12-digit alphanumeric pattern beginning with BE with
checksum validation.
See “Belgium Value Added Tax (VAT) Number medium breadth” on page 826.
 Library of system data identifiers 826
Belgium Value Added Tax (VAT) Number

■ The narrow breadth detects a 12-digit alphanumeric pattern beginning with BE with checksum
validation. It also requires the presence of related keywords.
See “Belgium Value Added Tax (VAT) Number narrow breadth” on page 827.

Belgium Value Added Tax (VAT) Number wide breadth

The wide breadth detects a 12-digit alphanumeric pattern beginning with BE without checksum
validation.

Table 37-71 Belgium Value Added Tax (VAT) Number wide-breadth patterns

Patterns

[Bb][Ee][0][123456789]\d{8}

[Bb][Ee][0][123456789].\d{4}.\d{4}

[Bb][Ee][0][123456789]-\d{4}-\d{4}

[Bb][Ee][0][123456789] \d{4} \d{4}

Table 37-72 Belgium Value Added Tax (VAT) Number wide-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Belgium Value Added Tax (VAT) Number medium breadth

The medium breadth detects a 12-digit alphanumeric pattern beginning with BE with checksum
validation.

Table 37-73 Belgium Value Added Tax (VAT) Number medium breadth patterns

Patterns

[Bb][Ee][0][123456789]\d{8}

[Bb][Ee][0][123456789].\d{4}.\d{4}

[Bb][Ee][0][123456789]-\d{4}-\d{4}

[Bb][Ee][0][123456789] \d{4} \d{4}

 Library of system data identifiers 827
Brazilian Bank Account Number

Table 37-74 Belgium Value Added Tax (VAT) Number medium-breadth validators

Mandatory validator Description

Belgium VAT Number Validation Check Checksum validator for the Belgian Value Added Tax (VAT)
Number.

Belgium Value Added Tax (VAT) Number narrow breadth

The narrow breadth detects a 12-digit alphanumeric pattern beginning with BE with checksum
validation. It also requires the presence of related keywords.

Table 37-75 Belgium Value Added Tax (VAT) Number narrow-breadth patterns

Pattern

[Bb][Ee][0][123456789]\d{8}

[Bb][Ee][0][123456789].\d{4}.\d{4}

[Bb][Ee][0][123456789]-\d{4}-\d{4}

[Bb][Ee][0][123456789] \d{4} \d{4}

Table 37-76 Belgium Value Added Tax (VAT) Number narrow-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Belgium VAT Number Validation Check Checksum validator for the Belgian Value Added Tax (VAT)
Number.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Numéro T.V.A., BTW number, Nº TVA, BTW NR, VAT

Number, vat no, vat number, Numéro T.V.A,
Umsatzsteuer-Identifikationsnummer,
Umsatzsteuernummer, BTW, BTW#, VAT#, vat#

Brazilian Bank Account Number

The Brazilian Bank Account Number is the standard bank account number used across Brazil.
This data identifier provides the following breadths of detection:
 Library of system data identifiers 828
Brazilian Bank Account Number

■ The wide breadth detects a 9- or 10-digit number without checksum validation.

See “Brazilian Bank Account Number wide breadth” on page 828.
■ The medium breadth detects a 9- or 10-digit number with checksum validation.
See “Brazilian Bank Account Number medium breadth” on page 828.
■ The narrow breadth detects a 9- or 10-digit number that passes checksum validation. It
also requires the presence of Brazilian Bank Account Number-related keywords.
See “Brazilian Bank Account Number narrow breadth” on page 829.

Brazilian Bank Account Number wide breadth

The wide breadth detects a 9- or 10-digit number without checksum validation.

Table 37-77 Brazilian Bank Account Number wide-breadth patterns

Pattern

\d\d\d\d[;- ]\d\d\d\d\d[;- ]\d

\d\d\d[,;- ]\d\d\d\d\d[,;- ]\d

\d\d\d[,;-]\d\d\d\d\d[,;-]\d

Table 37-78 Brazilian Bank Account Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Brazilian Bank Account Number medium breadth

The medium breadth detects a 9- or 10-digit number with checksum validation.

Table 37-79 Brazilian Bank Account Number medium-breadth patterns

Pattern

\d\d\d\d[;- ]\d\d\d\d\d[;- ]\d

\d\d\d[,;- ]\d\d\d\d\d[,;- ]\d

\d\d\d[,;-]\d\d\d\d\d[,;-]\d
 Library of system data identifiers 829
Brazilian Bank Account Number

Table 37-80 Brazilian Bank Account Number medium-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Brazilian Bank Account Number Validation Check Validator computes Brazilian Bank Account Number
checksum every Brazilian Bank Account Number must
pass.

Brazilian Bank Account Number narrow breadth

The narrow breadth detects a 9- or 10-digit number that passes checksum validation. It also
requires the presence of Brazilian Bank Account Number-related keywords.

Table 37-81 Brazilian Bank Account Number narrow-breadth patterns

Pattern

\d\d\d\d[;- ]\d\d\d\d\d[;- ]\d

\d\d\d[,;- ]\d\d\d\d\d[,;- ]\d

\d\d\d[,;-]\d\d\d\d\d[,;-]\d

Table 37-82 Brazilian Bank Account Number narrow-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Brazilian Bank Account Number Validation Check. Validator computes Brazilian Bank Account Number
checksum every Brazilian Bank Account Number must
pass.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Bank Account Number, bank account no, account no,

Account Number, account no., Itau bank account no.,
accountno#, bankaccountnumber#, Itauaccountno.#

número conta bancária, número da conta, conta n,

Conta bancária Itaú Número, código de conta bancária,
Conta Sem
 Library of system data identifiers 830
Brazilian Election Identification Number

Brazilian Election Identification Number

Brazil voting is compulsory to all citizens between 18 and 70 years old. To vote, all citizens
must be registered to vote and should present an official identity document, usually the election
identification number card.
This data identifier provides the following breadths of detection:
■ The wide breadth detects a 9- to 14-digit number without checksum validation.
See “Brazilian Election Identification Number wide breadth” on page 830.
■ The medium breadth detects a 9- to 14-digit number that passes checksum validation.
See “Brazilian Election Identification Number medium breadth” on page 831.
■ The narrow breadth detects a 9- to 14-digit number that passes checksum validation, and
requires the presence of Brazilian Election ID number-related keywords.
See “Brazilian Election Identification Number narrow breadth ” on page 832.

Brazilian Election Identification Number wide breadth

The wide breadth detects a 9- to 14-digit number without checksum validation.

Table 37-83 Brazilian Election Identification Number wide-breadth patterns

Pattern

\d{5}[0]\d{3}

\d{5}[12]\d\d{2}

\d{6}[0]\d{3}

\d{6}[0]\d[/]\d{2}

\d{6}[12]\d\d{2}

\d{6}[12]\d[/]\d{2}

\d{7}[0]\d{3}

\d{7}[0]\d[/]\d{2}

\d{7}[12]\d[/]\d{2}

\d{7}[12]\d\d{2}

\d{8}[0]\d{3}

\d{8}[0]\d[/]\d{2}
 Library of system data identifiers 831
Brazilian Election Identification Number

Table 37-83 Brazilian Election Identification Number wide-breadth patterns (continued)

Pattern

\d{8}[0]\d{3}[/]\d{2}

\d{8}[12]\d[/]\d{2}

\d{8}[12]\d\d{2}

\d{8}[12]\d\d{2}[/]\d{2}

Table 37-84 Brazilian Election Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Brazilian Election Identification Number medium breadth

The medium breadth detects a 9- to 14-digit number that passes checksum validation.

Table 37-85 Brazilian Election Identification Number medium-breadth patterns

Pattern

\d{5}[0]\d{3}

\d{5}[12]\d\d{2}

\d{6}[0]\d{3}

\d{6}[0]\d[/]\d{2}

\d{6}[12]\d\d{2}

\d{6}[12]\d[/]\d{2}

\d{7}[0]\d{3}

\d{7}[0]\d[/]\d{2}

\d{7}[12]\d[/]\d{2}

\d{7}[12]\d\d{2}

\d{8}[0]\d{3}

\d{8}[0]\d[/]\d{2}
 Library of system data identifiers 832
Brazilian Election Identification Number

Table 37-85 Brazilian Election Identification Number medium-breadth patterns (continued)

Pattern

\d{8}[0]\d{3}[/]\d{2}

\d{8}[12]\d[/]\d{2}

\d{8}[12]\d\d{2}

\d{8}[12]\d\d{2}[/]\d{2}

Table 37-86 Brazilian Election Identification Number medium-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Brazil Election Identification Number Validation Check Computes Brazil Election Identification Number checksum
every Brazil Election Identification Number must pass.

Brazilian Election Identification Number narrow breadth

The narrow breadth detects a 9- to 14-digit number that passes checksum validation. It also
requires the presence of Brazilian Election ID number-related keywords.

Table 37-87 Brazilian Election Identification Number narrow-breadth patterns

Pattern

\d{5}[0]\d{3}

\d{5}[12]\d\d{2}

\d{6}[0]\d{3}

\d{6}[0]\d[/]\d{2}

\d{6}[12]\d\d{2}

\d{6}[12]\d[/]\d{2}

\d{7}[0]\d{3}

\d{7}[0]\d[/]\d{2}

\d{7}[12]\d[/]\d{2}

\d{7}[12]\d\d{2}
 Library of system data identifiers 833
Brazilian National Registry of Legal Entities Number

Table 37-87 Brazilian Election Identification Number narrow-breadth patterns (continued)

Pattern

\d{8}[0]\d{3}

\d{8}[0]\d[/]\d{2}

\d{8}[0]\d{3}[/]\d{2}

\d{8}[12]\d[/]\d{2}

\d{8}[12]\d\d{2}

\d{8}[12]\d\d{2}[/]\d{2}

Table 37-88 Brazilian Election Identification Number narrow-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Brazil Election Identification Number Validation Check Computes Brazil Election Identification Number checksum
every Brazil Election Identification Number must pass.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.
Inputs:

election ID, identification number, electrol no., voter

ID, electrol identification number, Voter ID, electrol
number, election voter ID, Electrol Number, Electrol
No., Identification Number, Election Identification No.

número de identificação, identificação do eleitor,

número de identificação eleitoral, ID eleitor eleição,
Número identificação eleitoral brasileira

Brazilian National Registry of Legal Entities Number

The Brazilian National Registry of Legal Entities (CNPJ) Number is a unique number that
identifies an entity or other legal arrangement without legal personality by the Brazilian IRS
(an agency of the Ministry of Finance).
This data identifier provides the following breadths of detection:
 Library of system data identifiers 834
Brazilian National Registry of Legal Entities Number

■ The wide breadth detects a 14-digit number without checksum validation.

See “Brazilian National Registry of Legal Entities Number wide breadth” on page 834.
■ The medium breadth detects a 14-digit number with checksum validation.
See “Brazilian National Registry of Legal Entities Number medium breadth” on page 834.
■ The narrow breadth detects a 14-digit number that passes checksum validation. It also
requires the presence of CNPJ-related keywords.
See “Brazilian National Registry of Legal Entities Number narrow breadth” on page 835.

Brazilian National Registry of Legal Entities Number wide breadth

The wide breadth detects a 14-digit number without checksum validation.

Table 37-89 Brazilian National Registry of Legal Entities Number wide-breadth patterns

Pattern

\d{14}

\d{8}[/]\d{6}

\d{8}[/]\d{4}-\d{2}

\d{2}.\d{3}.\d{3}[/]\d{4}-\d{2}

Table 37-90 Brazilian National Registry of Legal Entities Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Brazilian National Registry of Legal Entities Number medium breadth

The medium breadth detects a 14-digit number with checksum validation.

Table 37-91 Brazilian National Registry of Legal Entities Number medium-breadth patterns

Pattern

\d{14}

\d{8}[/]\d{6}

\d{8}[/]\d{4}-\d{2}

\d{2}.\d{3}.\d{3}[/]\d{4}-\d{2}
 Library of system data identifiers 835
Brazilian National Registry of Legal Entities Number

Table 37-92 Brazilian National Registry of Legal Entities Number medium-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Brazilian National Registry of Legal Entities Number Computes the checksum and validates the pattern against
Validation Check it.

Brazilian National Registry of Legal Entities Number narrow breadth

The narrow breadth detects a 14-digit number that passes checksum validation. It also requires
the presence of CNPJ-related keywords.

Table 37-93 Brazilian National Registry of Legal Entities Number narrow-breadth patterns

Pattern

\d{14}

\d{8}[/]\d{6}

\d{8}[/]\d{4}-\d{2}

\d{2}.\d{3}.\d{3}[/]\d{4}-\d{2}

Table 37-94 Brazilian National Registry of Legal Entities Number narrow-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Brazilian National Registry of Legal Entities Number Computes the checksum and validates the pattern against
Validation Check it.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Brazil legal entities number, legalnumber#,legal ID,

legal no., Brazilianlegalno#, legalnumber# ,legal no.,
legal entities number, CNPJ, CNPJ:, CNPJ#, cnpj#,
cnpj CNPJ n º, Registro Nacional de Pessoas Jurídicas
n º, entidades jurídicas ID
 Library of system data identifiers 836
Brazilian Natural Person Registry Number (CPF)

Brazilian Natural Person Registry Number (CPF)

The Cadastro de Pessoas Fisicas (CPF, "Natural Person Register") is a number assigned by
the Brazilian Federal Revenue to both Brazilians and resident aliens who pay taxes or take
part, directly or indirectly, in activities that provide revenue for any of the dozens of different
types of taxes existing in Brazil.
This data identifier provides the following breadths of detection:
■ The wide breadth detects an 11-digit number without checksum validation.
See “Brazilian Natural Person Registry Number wide breadth” on page 836.
■ The medium breadth detects an 11-digit number with checksum validation.
See “Brazilian Natural Person Registry Number medium breadth” on page 836.
■ The narrow breadth detects an 11-digit number that passes checksum validation. It also
requires the presence of CPF Number-related keywords.
See “Brazilian Natural Person Registry Number narrow breadth ” on page 837.

Brazilian Natural Person Registry Number wide breadth

The wide breadth detects an 11-digit number without checksum validation.

Table 37-95 Brazilian Natural Person Registry Number wide-breadth patterns

Pattern

\d{11}

\d{9}[-]\d{2}

\d{3}[.]\d{3}[.]\d{3}[-]\d{2}

Table 37-96 Brazilian Natural Person Registry Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Brazilian Natural Person Registry Number medium breadth

The medium breadth detects an 11-digit number with checksum validation.

Table 37-97 Brazilian Natural Person Registry Number medium-breadth patterns Pattern

Pattern

\d{11}
 Library of system data identifiers 837
Brazilian Natural Person Registry Number (CPF)

Table 37-97 Brazilian Natural Person Registry Number medium-breadth patterns Pattern
(continued)

Pattern

\d{9}[-]\d{2}

\d{3}[.]\d{3}[.]\d{3}[-]\d{2}

Table 37-98 Brazilian Natural Person Registry Number medium breadth-validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Brazilian Natural Person Registry Number Validation Check Computes Brazilian Natural Person Registry Number
checksum every Brazilian Natural Person Registry Number
must pass.

Brazilian Natural Person Registry Number narrow breadth

The narrow breadth detects an 11-digit number that passes checksum validation. It also
requires the presence of CPF Number-related keywords.

Table 37-99 Brazilian Natural Person Registry Number narrow-breadth patterns

Pattern

\d{11}

\d{9}[-]\d{2}

\d{3}[.]\d{3}[.]\d{3}[-]\d{2}

Table 37-100 Brazilian Natural Person Registry Number narrow-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Brazilian Natural Person Registry Number Validation Check Computes Brazilian Natural Person Registry Number
checksum every Brazilian Natural Person Registry Number
must pass.
 Library of system data identifiers 838
British Columbia Personal Healthcare Number

Table 37-100 Brazilian Natural Person Registry Number narrow-breadth validator (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

registry of individuals, CPF#, cpf no, CPF no,

Registration number, natural persons registry no, cpf
no, natural persons record no, cpfno#, CPFno#

Cadastro de Pessoas Físicas, pessoas singulares

registro NO pessoa natural número de registro

British Columbia Personal Healthcare Number

British Columbia (BC) residents are required by law to enroll in a Medical Service Plan (MSP)
to access basic medical care facilities.
The MSP membership card is called a Care Card and the MSP number is called a Personal
Healthcare Number.
This data identifier provides the following breadths of detection:
■ The wide breadth detects a 10-digit number without checksum validation.
See “British Columbia Personal Healthcare Number wide breadth ” on page 838.
■ The medium breadth detects a 10-digit number that passes checksum validation.
See “ British Columbia Personal Healthcare Number medium breadth” on page 839.
■ The narrow breadth detects a 10-digit number that passes checksum validation. It also
requires the presence of MSP-related keywords.
See “British Columbia Personal Healthcare Number narrow breadth” on page 839.

British Columbia Personal Healthcare Number wide breadth

The wide breadth detects a 10-digit number without checksum validation.

Table 37-101 British Columbia Personal Healthcare Number wide-breadth patterns

Pattern

[9]\d{9}

[9]\d{3} \d{3} \d{3}

 Library of system data identifiers 839
British Columbia Personal Healthcare Number

Table 37-102 British Columbia Personal Healthcare Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

British Columbia Personal Healthcare Number medium breadth

The medium breadth detects a 10-digit number that passes checksum validation.

Table 37-103 British Columbia Personal Healthcare Number medium-breadth patterns

Pattern

[9]\d{9}

[9]\d{3} \d{3} \d{3}

Table 37-104 British Columbia Personal Healthcare Number medium-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

British Columbia Personal Healthcare Number Validation Computes British Columbia Personal Healthcare Number
Check checksum that every British Columbia Personal Healthcare
Number must pass.

British Columbia Personal Healthcare Number narrow breadth

The narrow breadth detects a 10-digit number that passes checksum validation. It also requires
the presence of MSP-related keywords.

Table 37-105 British Columbia Personal Healthcare Number narrow-breadth patterns

Pattern

[9]\d{9}

[9]\d{3} \d{3} \d{3}

Table 37-106 British Columbia Personal Healthcare Number narrow-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

 Library of system data identifiers 840
Bulgarian Uniform Civil Number - EGN

Table 37-106 British Columbia Personal Healthcare Number narrow-breadth validator

(continued)

Mandatory validator Description

British Columbia Personal Healthcare Number Validation Computes British Columbia Personal Healthcare Number
Check checksum that every British Columbia Personal Healthcare
Number must pass.

Bulgarian Uniform Civil Number - EGN

The uniform civil number (EGN) is unique number assigned to each Bulgarian citizen or resident
foreign national. It serves as a national identification number. An EGN is assigned to Bulgarians
at birth, or when a birth certificate is issued.
This data identifier provides the following breadths of detection:
■ The wide breadth detects a 10-digit number without checksum validation.
See “Bulgarian Uniform Civil Number - EGN wide breadth” on page 840.
■ The medium breadth detects a 10-digit number that passes checksum validation.
See “Bulgarian Uniform Civil Number - EGN medium breadth” on page 841.
■ The narrow breadth detects a 10-digit number that passes checksum validation. It also
requires the presence of EGN-related keywords.
See “Bulgarian Uniform Civil Number - EGN narrow breadth” on page 841.

Bulgarian Uniform Civil Number - EGN wide breadth

The wide breadth detects a 10-digit number without checksum validation.

Table 37-107 Bulgarian Uniform Civil Number - EGN wide-breadth pattern

Pattern

\d\d[024][123456789]0[123456789]\d{4}

\d\d[135][012]0[123456789]\d{4}

\d\d[024][123456789][12]\d{5}

\d\d[135][012][12]\d{5}

\d\d[024][123456789]3[01]\d{4}

\d\d[135][012]3[01]\d{4}
 Library of system data identifiers 841
Bulgarian Uniform Civil Number - EGN

Table 37-108 Bulgarian Uniform Civil Number - EGN wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Bulgarian Uniform Civil Number - EGN medium breadth

The medium breadth detects a 10-digit number that passes checksum validation.

Table 37-109 Bulgarian Uniform Civil Number - EGN medium-breadth pattern

Pattern

\d\d[024][123456789]0[123456789]\d{4}

\d\d[135][012]0[123456789]\d{4}

\d\d[024][123456789][12]\d{5}

\d\d[135][012][12]\d{5}

\d\d[024][123456789]3[01]\d{4}

\d\d[135][012]3[01]\d{4}

Table 37-110 Bulgarian Uniform Civil Number - EGN medium-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Bulgarian Uniform Civil Number Validation Check Computes the checksum and validates the pattern against
it.

Bulgarian Uniform Civil Number - EGN narrow breadth

The narrow breadth detects a 10-digit number that passes checksum validation. It also requires
the presence of EGN-related keywords.

Table 37-111 Bulgarian Uniform Civil Number - EGN narrow-breadth pattern

Pattern

\d\d[024][123456789]0[123456789]\d{4}

\d\d[135][012]0[123456789]\d{4}
 Library of system data identifiers 842
Burgerservicenummer

Table 37-111 Bulgarian Uniform Civil Number - EGN narrow-breadth pattern (continued)

Pattern

\d\d[024][123456789][12]\d{5}

\d\d[135][012][12]\d{5}

\d\d[024][123456789]3[01]\d{4}

\d\d[135][012]3[01]\d{4}

Table 37-112 Bulgarian Uniform Civil Number - EGN narrow-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Bulgarian Uniform Civil Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

BUCN, uniform civil number, bucn#,

uniformcivilnumber#, uniform civil ID, uniform civil
number, uniform civil no, EGN, Bulgarian uniform civil
number, uniformcivilno#, BUCN#, EGN#

Униформ граждански номер, Униформ ID, Униформ

граждански ID, Униформ граждански не

Burgerservicenummer
In the Netherlands, the Burgerservicenummer is used to uniquely identify citizens and is printed
on driving licenses, passports and international ID cards under the header Personal Number.
The Burgerservicenummer data identifier detects an 8- or 9-digit number that passes checksum
validation.
The Burgerservicenummer data identifier provides two breadths of detection:
■ The wide breadth detects an 8- or 9-digit number that passes checksum validation.
See “Burgerservicenummer wide breadth” on page 843.
 Library of system data identifiers 843
Burgerservicenummer

■ The narrow breadth detects an 8- or 9-digit number that passes checksum validation. It
also requires the presence of a Burgerservicenummer-related keyword.
See “Burgerservicenummer narrow breadth” on page 843.

Burgerservicenummer wide breadth

The wide breadth detects an 8- or 9-digit number that passes checksum validation.

Table 37-113 Burgerservicenummer wide-breadth pattern

Pattern

\d{9}

Table 37-114 Burgerservicenummer wide-breadth validator

Mandatory validator Description

Burgerservicenummer Check Computes the checksum and validates the pattern against
it.

Burgerservicenummer narrow breadth

The narrow breadth detects an 8- or 9-digit number that passes checksum validation. It also
requires the presence of a Burgerservicenummer-related keyword.

Table 37-115 Burgerservicenummer narrow-breadth pattern

Pattern

\d{9}

Table 37-116 Burgerservicenummer narrow-breadth validators

Mandatory validator Description

Burgerservicenummer Check Computes the checksum and validates the pattern against
it.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Persoonsnummer, sofinummer, sociaal-fiscaal

nummer, persoonsgebonden, person number,
social-fiscal number, person-related number
 Library of system data identifiers 844
Canadian Social Insurance Number

Canadian Social Insurance Number

The Canadian Social Insurance Number (SIN) is a personal identification number issued by
Human Resources and Skills Development Canada primarily for administering national pension
and employment plans.
The Canadian Social Insurance Number data identifier provides three breadths of detection:
■ The wide breadth detects 9-digit numbers with the format DDD-DDD-DDD separated by
dashes, spaces, periods, slashes, or without separators. It also performs Luhn-check
validation.
See “Canadian Social Insurance Number wide breadth” on page 844.
■ The medium breadth detects 9-digit numbers with the format DDD-DDD-DDD separated
by dashes, spaces, or periods. It also performs Luhn check validation and eliminates
non-assigned numbers and common test numbers.
See “Canadian Social Insurance Number medium breadth” on page 845.
■ The narrow breadth detects 9-digit numbers with the format DDD-DDD-DDD separated by
dashes or spaces. It also performs Luhn-check validation; eliminates non-assigned numbers,
fictitiously assigned numbers, and common test numbers; and requires the presence of
Social Insurance-related keywords.
See “Canadian Social Insurance Number narrow breadth” on page 845.

Canadian Social Insurance Number wide breadth

The wide breadth detects 9-digit numbers with the format DDD-DDD-DDD separated by dashes,
spaces, periods, slashes, or without separators. It also performs Luhn-check validation.

Table 37-117 Canadian Social Insurance Number wide-breadth patterns

Pattern

\d{3} \d{3} \d{3}

\d{9}

\d{3}/\d{3}/\d{3}

\d{3}.\d{3}.\d{3}

\d{3}-\d{3}-\d{3}
 Library of system data identifiers 845
Canadian Social Insurance Number

Table 37-118 Canadian Social Insurance Number wide-breadth validator

Mandatory validator Description

Luhn Check Validator computes the Luhn checksum which every

Canadian Insurance Number must pass.

Canadian Social Insurance Number medium breadth

The medium breadth detects 9-digit numbers with the format DDD-DDD-DDD separated by
dashes, spaces, or periods. It also performs Luhn check validation and eliminates non-assigned
numbers and common test numbers.

Table 37-119 Canadian Social Insurance Number medium-breadth patterns

Pattern

\d{3} \d{3} \d{3}

\d{3}.\d{3}.\d{3}

\d{3}-\d{3}-\d{3}

Table 37-120 Canadian Social Insurance Number medium-breadth validators

Mandatory validator Description

Luhn Check Validator computes the Luhn checksum which every

Canadian Insurance Number must pass.

Number delimiter Validates a match by checking the surrounding numbers.

Exclude beginning characters With this option selected, data beginning with any of the
following list of values will not be matched.

Input:

8, 123456789

Canadian Social Insurance Number narrow breadth

The narrow breadth detects 9-digit numbers with the format DDD-DDD-DDD separated by
dashes or spaces. It also performs Luhn-check validation; eliminates non-assigned numbers,
fictitiously assigned numbers, and common test numbers; and requires the presence of Social
Insurance-related keywords.
 Library of system data identifiers 846
Chilean National Identification Number

Table 37-121 Canadian Social Insurance Number narrow-breadth patterns

Pattern

\d{3} \d{3} \d{3}

\d{3}-\d{3}-\d{3}

Table 37-122 Canadian Social Insurance Number narrow-breadth validators

Mandatory validator Description

Luhn Check Validator computes the Luhn checksum which every

Canadian Insurance Number must pass.

Number delimiter Validates a match by checking the surrounding numbers.

Exclude beginning characters With this option selected, data beginning with any of the
following list of values will not be matched.

Input:

0, 8, 123456789

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

pension, pensions, soc ins, ins #, social ins, CSIN,

SSN, social security, social insurance, Canada,
Canadian

Chilean National Identification Number

The Chilean National Identity Number or National Unique Role (RUN) is the only identifying
number assigned to all Chilean residents in or out of Chile, and to aliens residing temporarily
or permanently in the country.
This data identifier provides the following breadths of detection:
■ The wide breadth detects an 8- or 9-digit number without checksum validation.
See “Chilean National Identification Number wide breadth” on page 847.
■ The medium breadth detects an 8- or 9-digit number with checksum validation.
See “Chilean National Identification Number medium breadth” on page 847.
■ The narrow breadth detects an 8- or 9-digit number that passes checksum validation. It
also requires the presence of RUN-related keywords.
 Library of system data identifiers 847
Chilean National Identification Number

See “Chilean National Identification Number narrow breadth” on page 848.

Chilean National Identification Number wide breadth

The wide breadth detects an 8- or 9-digit number without checksum validation.

Table 37-123 Chilean National Identification Number wide-breadth patterns

Pattern

\d{7}[0123456789Kk]

\d{7}[-][0123456789Kk]

\d[.]\d{3}[.]\d{3}[-][0123456789Kk]

\d{8}[0123456789Kk]

\d{8}[-][0123456789Kk]

\d{2}[.]\d{3}[.]\d{3}[-][0123456789Kk]

Table 37-124 Chilean National Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Chilean National Identification Number medium breadth

The medium breadth detects an 8- or 9-digit number with checksum validation.

Table 37-125 Chilean National Identification Number medium-breadth patterns

Pattern

\d{7}[0123456789Kk]

\d{7}[-][0123456789Kk]

\d[.]\d{3}[.]\d{3}[-][0123456789Kk]

\d{8}[0123456789Kk]

\d{8}[-][0123456789Kk]

\d{2}[.]\d{3}[.]\d{3}[-][0123456789Kk]
 Library of system data identifiers 848
Chilean National Identification Number

Table 37-126 Chilean National Identification Number medium-breadth validator

Mandatory validator Description

Chilean National Identification Number Validation Check Computes the checksum and validates the pattern against
it.

Chilean National Identification Number narrow breadth

The narrow breadth detects an 8- or 9-digit number that passes checksum validation. It also
requires the presence of RUN-related keywords.

Table 37-127 Chilean National Identification Number narrow-breadth patterns

Pattern

\d{7}[0123456789Kk]

\d{7}[-][0123456789Kk]

\d[.]\d{3}[.]\d{3}[-][0123456789Kk]

\d{8}[0123456789Kk]

\d{8}[-][0123456789Kk]

\d{2}[.]\d{3}[.]\d{3}[-][0123456789Kk]

Table 37-128 Chilean National Identification Number narrow-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Chilean National Identification Number Validation Check Computes the checksum and validates the pattern against
it .

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

RUT, RUN, national identification number, Chilean

identity no., national unique role, rut#, run#,
identificationnumber, identityno.#, identity number,
nationaluniqueroleID#, nacional identidad, número
identificación, número identificación nacional,
identidad número
 Library of system data identifiers 849
China Passport Number

China Passport Number

The People's Republic of China passport, commonly referred to as the Chinese passport, is
issued to nationals of the People's Republic of China who do not permanently reside in Hong
Kong or Macau for international travel.
The China Passport Number data identifier provides two breadths of detection:
■ The wide breadth detects a 9- to 10-character identifier.
See “China Passport Number wide breadth” on page 849.
■ The narrow breadth detects a 9- 10-character identifier. It also requires the presence of
Chinese passport-related keywords.
See “China Passport Number narrow breadth” on page 849.

China Passport Number wide breadth

The wide breadth detects a 9- to 10-character identifier.

Table 37-129 China Passport Number wide-breadth patterns

Pattern

\d{9}

\l\d{8}

\l{2}\d{8}

Table 37-130 China Passport Number wide-breadth validator

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

China Passport Number narrow breadth

The wide breadth detects a 9- to 10-character identifier. It also requires the presence of Chinese
passport-related keywords.

Table 37-131 China Passport Number narrow-breadth patterns

Pattern

\d{9}

\l\d{8}
 Library of system data identifiers 850
Codice Fiscale

Table 37-131 China Passport Number narrow-breadth patterns (continued)

Pattern

\l{2}\d{8}

Table 37-132 China Passport Number narrow-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

中国护照, 护照, 护照本, passport, Passport, CHINA

PASSPORT, China Passport, china passport, Passport
Book, passport book

Codice Fiscale
The Codice Fiscale uniquely identifies an Italian citizen or permanent resident alien and
issuance of the code is centralized to the Ministry of Treasure. The Codice Fiscale is issued
to every Italian at birth.
The Codice Fiscale data identifier provides two breadths of detection:
■ The wide breadth detects a 16-character identifier that passes checksum validation.
See “Codice Fiscale wide breadth” on page 850.
■ The narrow breadth detects a 16-character identifier that passes checksum validation. It
also requires the presence of Codice Fiscale-related keywords.
See “Codice Fiscale narrow breadth” on page 851.

Codice Fiscale wide breadth

The wide breadth detects a 16-character identifier that passes checksum validation.

Table 37-133 Codice Fiscale wide-breadth patterns

Pattern

[A-Z]{6}[0-9LMNPQRSTUV]{2}[ABCDEHLMPRST][0-9LMNPQRSTUV]{2}[A-Z] [0-9LMNPQRSTUV]{3}[A-Z]
 Library of system data identifiers 851
Colombian Addresses

Table 37-133 Codice Fiscale wide-breadth patterns (continued)

Pattern

[A-Z]{3} [A-Z]{3} [0-9LMNPQRSTUV]{2}[ABCDEHLMPRST][0-9LMNPQRSTUV]{2}

[A-Z][0-9LMNPQRSTUV]{3}[A-Z]

Table 37-134 Codice Fiscale wide-breadth validator

Mandatory validator Description

Codice Fiscale Control Key Check Computes the control key and checks if it is valid.

Codice Fiscale narrow breadth

The narrow breadth detects a 16-character identifier that passes checksum validation. It also
requires the presence of Codice Fiscale-related keywords.

Table 37-135 Codice Fiscale narrow-breadth patterns

Pattern

[A-Z]{6}[0-9LMNPQRSTUV]{2}[ABCDEHLMPRST][0-9LMNPQRSTUV]{2}[A-Z] [0-9LMNPQRSTUV]{3}[A-Z]

[A-Z]{3} [A-Z]{3} [0-9LMNPQRSTUV]{2}[ABCDEHLMPRST][0-9LMNPQRSTUV]{2}

[A-Z][0-9LMNPQRSTUV]{3}[A-Z]

Table 37-136 Codice Fiscale narrow-breadth validators

Mandatory validator Description

Codice Fiscale Control Key Check Computes the control key and checks if it is valid.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

codice fiscal, dati anagrafici, partita I.V.A., p. iva, tax

code, personal data, VAT number

Colombian Addresses
The Colombian Addresses data identifier detects home addresses and physical locations in
Columbia.
The Colombian Addresses data identifier provides two breadths of detection:
 Library of system data identifiers 852
Colombian Addresses

■ The wide breadth detects an address without validation.

See “ Colombian Addresses wide breadth” on page 852.
■ The narrow breadth detects an address with keyword validation.
See “Colombian Addresses narrow breadth” on page 853.

Colombian Addresses wide breadth

The wide breadth detects an address without validation.

Table 37-137 Colombian Addresses wide-breadth patterns

Pattern

\d{1,3} No. \d{1,3}-\d{1,3}

\d{1,3} \d{1,3}-\d{1,3}

\d{1,3} Bis \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] Bis \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3} \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] \d{1,3}-\d{1,3}

\d{1,3} Bis No \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3} Bis No. \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] Bis No. \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] Bis # \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] No. \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3} # \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3} No. \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] Bis No \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] No \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3} # \d{1,3}-\d{1,3}

\d{1,3}[A-Za-z] # \d{1,3}-\d{1,3}

\d{1,3} No \d{1,3}-\d{1,3}
 Library of system data identifiers 853
Colombian Addresses

Table 37-137 Colombian Addresses wide-breadth patterns (continued)

Pattern

\d{1,3}[A-Za-z] No. \d{1,3}-\d{1,3}

\d{1,3}[A-Za-z] No \d{1,3}-\d{1,3}

\d{1,3} Bis # \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] # \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3} No \d{1,3}[A-Za-z]-\d{1,3}

The wide breadth of the Colombian Addresses data identifier does not include a validator.

Colombian Addresses narrow breadth

The narrow breadth detects an address with keyword validation.

Table 37-138 Colombian Addresses narrow-breadth patterns

Pattern

\d{1,3} No. \d{1,3}-\d{1,3}

\d{1,3} \d{1,3}-\d{1,3}

\d{1,3} Bis \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] Bis \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3} \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] \d{1,3}-\d{1,3}

\d{1,3} Bis No \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3} Bis No. \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] Bis No. \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] Bis # \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] No. \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3} # \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3} No. \d{1,3}[A-Za-z]-\d{1,3}

 Library of system data identifiers 854
Colombian Cell Phone Number

Table 37-138 Colombian Addresses narrow-breadth patterns (continued)

Pattern

\d{1,3}[A-Za-z] Bis No \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] No \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3} # \d{1,3}-\d{1,3}

\d{1,3}[A-Za-z] # \d{1,3}-\d{1,3}

\d{1,3} No \d{1,3}-\d{1,3}

\d{1,3}[A-Za-z] No. \d{1,3}-\d{1,3}

\d{1,3}[A-Za-z] No \d{1,3}-\d{1,3}

\d{1,3} Bis # \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3}[A-Za-z] # \d{1,3}[A-Za-z]-\d{1,3}

\d{1,3} No \d{1,3}[A-Za-z]-\d{1,3}

Table 37-139 Colombian Addresses narrow-breadth validators

Mandatory validator Description

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Calle, Cll, Carrera, Cra, Cr, Avenida, Av, Dg, Diagonal,

Diag, Tv, Trans, Transversal, vereda

Colombian Cell Phone Number

The Colombian Cell Phone Number data identifier detects Colombian cell phone numbers.
The Colombian Cell Phone Number data identifier provides two breadths of detection:
■ The wide breadth detects a 8- to 10- digit number with duplicate digit validation.
See “Colombian Cell Phone Number wide breadth” on page 855.
■ The narrow breadth detects an 8- to 10-digit number with required characters at the
beginning. It also checks for duplicate digits, and it requires the presence of Colombian
Cell Phone Number-related keywords.
See “Colombian Cell Phone Number narrow breadth” on page 856.
 Library of system data identifiers 855
Colombian Cell Phone Number

Colombian Cell Phone Number wide breadth

The wide breadth detects an 8- to 10-digit number with duplicate digit validation.

Table 37-140 Colombian Cell Phone Number wide-breadth patterns

Pattern

\d{8}

\d{2}.\d{3}.\d{3}

\d{2} \d{3} \d{3}

\d{2}/\d{3}/\d{3}

\d{2}-\d{3}-\d{3}

\d{2},\d{3},\d{3}

\d{9}

\d{3} \d{3} \d{3}

\d{3}-\d{3}-\d{3}

\d{3},\d{3},\d{3}

\d{3}/\d{3}/\d{3}

\d{3}.\d{3}.\d{3}

\d{10}

\d{1}/\d{3}/\d{3}/\d{3}

\d{1},\d{3},\d{3},\d{3}

\d{1}.\d{3}.\d{3}.\d{3}

\d{1}-\d{3}-\d{3}-\d{3}

\d{1} \d{3} \d{3} \d{3}

Table 37-141 Colombian Cell Phone Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.
 Library of system data identifiers 856
Colombian Cell Phone Number

Colombian Cell Phone Number narrow breadth

The narrow breadth detects an 8- to 10-digit number with required characters at the beginning.
It also checks for duplicate digits, and it requires the presence of Colombian Cell Phone
Number-related keywords.

Table 37-142 Colombian Cell Phone Number narrow-breadth patterns

Pattern

\d{8}

\d{2}.\d{3}.\d{3}

\d{2} \d{3} \d{3}

\d{2}/\d{3}/\d{3}

\d{2}-\d{3}-\d{3}

\d{2},\d{3},\d{3}

\d{9}

\d{3} \d{3} \d{3}

\d{3}-\d{3}-\d{3}

\d{3},\d{3},\d{3}

\d{3}/\d{3}/\d{3}

\d{3}.\d{3}.\d{3}

\d{10}

\d{1}/\d{3}/\d{3}/\d{3}

\d{1},\d{3},\d{3},\d{3}

\d{1}.\d{3}.\d{3}.\d{3}

\d{1}-\d{3}-\d{3}-\d{3}

\d{1} \d{3} \d{3} \d{3}

 Library of system data identifiers 857
Colombian Personal Identification Number

Table 37-143 Colombian Cell Phone Number narrow-breadth validators

Mandatory validator Description

Require beginning characters This validator requires the following characters at the
beginning of the number:

300, 301, 302, 310, 311, 312, 313, 314, 315, 316, 317,
318, 319, 320, 321, 350

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

numero celular, número de teléfono, teléfono celular

no., numero celular#

Colombian Personal Identification Number

The Colombian Personal Identification Number is a unique 8- or 10-digit number assigned to
Colombian citizens at birth.
The Colombian Personal Identification Number data identifier provides two breadths of detection:
■ The wide breadth detects an 8- or 10-digit number with duplicate digit validation.
See “Colombian Personal Identification Number wide breadth” on page 857.
■ The narrow breadth detects an 8- or 10-digit number with duplicate digit validation; prefix
and suffix exclusion; and beginning character exclusion. It also requires the presence of
Colombian Personal Identification Number-related keywords.
See “Colombian Personal Identification Number narrow breadth” on page 858.

Colombian Personal Identification Number wide breadth

The wide breadth detects an 8- or 10-digit number with duplicate digit validation.

Table 37-144 Colombian Personal Identification Number wide-breadth patterns

Pattern

\d{9}

\d{3} \d{3} \d{3}

 Library of system data identifiers 858
Colombian Personal Identification Number

Table 37-144 Colombian Personal Identification Number wide-breadth patterns (continued)

Pattern

\d{3}-\d{3}-\d{3}

\d{3},\d{3},\d{3}

\d{3}/\d{3}/\d{3}

\d{3}.\d{3}.\d{3}

Table 37-145 Colombian Personal Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Colombian Personal Identification Number narrow breadth

The narrow breadth detects an 8- or 10-digit number with duplicate digit validation; prefix and
suffix exclusion; and beginning character exclusion. It also requires the presence of Colombian
Personal Identification Number-related keywords.

Table 37-146 Colombian Personal Identification Number narrow-breadth patterns

Pattern

\d{9}

\d{3} \d{3} \d{3}

\d{3}-\d{3}-\d{3}

\d{3},\d{3},\d{3}

\d{3}/\d{3}/\d{3}

\d{3}.\d{3}.\d{3}

Table 37-147 Colombian Personal Identification Number narrow-breadth validators

Mandatory validator Description

Exclude beginning characters Excludes the following characters from the beginning of
the number:

300, 301, 302, 310, 310, 312, 313, 314, 315, 316, 317,
318, 319, 320, 321, 350
 Library of system data identifiers 859
Colombian Tax Identification Number

Table 37-147 Colombian Personal Identification Number narrow-breadth validators

(continued)

Mandatory validator Description

Exclude prefix Excludes the following prefixes:

$ ,$

Exclude suffix Excludes the following suffix:

.00

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

cedula, cédula, c.c., c.c, C.C., C.C, cc, CC, NIE., NIE,
nie., nie, cedula de ciudadania, cédula de ciudadanía,
cc#, CC #, documento de identificacion, documento
de identificación, Nit.

Colombian Tax Identification Number

The Colombian Tax Identification Number is
The Colombian Tax Identification Number data identifier provides two breadths of detection:
■ The wide breadth detects a 9-digit number with duplicate digit validation.
See “Colombian Tax Identification Number wide breadth” on page 859.
■ The narrow breadth detects a 9-digit number with duplicate digit validation, required
beginning characters, and prefix exclusion. It also requires the presence of Colombian Tax
Identification Number-related keywords.
See “Colombian Tax Identification Number narrow breadth” on page 860.

Colombian Tax Identification Number wide breadth

The wide breadth detects a 9-digit number with duplicate digit validation.
 Library of system data identifiers 860
Colombian Tax Identification Number

Table 37-148 Colombian Tax Identification Number wide-breadth patterns

Pattern

\d{9}

\d{3} \d{3} \d{3}

\d{3}-\d{3}-\d{3}

\d{3},\d{3},\d{3}

\d{3}/\d{3}/\d{3}

\d{3}.\d{3}.\d{3}

Table 37-149 Colombian Tax Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Colombian Tax Identification Number narrow breadth

The narrow breadth detects a 9-digit number with duplicate digit validation, required beginning
characters, and prefix exclusion. It also requires the presence of Colombian Tax Identification
Number-related keywords.

Table 37-150 Colombian Tax Identification Number narrow-breadth patterns

Pattern

\d{9}

\d{3} \d{3} \d{3}

\d{3}-\d{3}-\d{3}

\d{3},\d{3},\d{3}

\d{3}/\d{3}/\d{3}

\d{3}.\d{3}.\d{3}
 Library of system data identifiers 861
Credit Card Magnetic Stripe Data

Table 37-151 Colombian Tax Identification Number narrow-breadth validators

Mandatory validator Description

Require beginning characters Requires these characters at the beginning of the number:
800, 860, 890, 900

Exclude prefix Excludes the following prefix:

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

NIT., NIT, nit., nit, Nit.

Credit Card Magnetic Stripe Data

The magnetic stripe of a credit card contains information about the card. Storage of the complete
version of this data is a violation of the Payment Card Industry (PCI) Data Security Standard.
The Credit Card Magnetic Stripe Data data identifier detects the following raw data taken from
the credit card magnetic stripe:
■ Data from track 1, format B, which typically contains account number, name, expiration
date, and possibly Card Verification Value or Card Verification Code 1 (CVV1/CVC1).
■ Data from track 2, which typically contains account number and possibly expiration date,
service code and Card Verification Value or Card Verification Code 1 (CVV1/CVC1)
The Credit Card Magnetic Stripe data identifier detects the characteristic data pattern for track
2 data which contains the start sentinel, format code, primary account number, name, expiration
date, service code, discretional data, and the end sentinel. It also includes standard field
separators. It validates the data using a Luhn-check validator.
 Library of system data identifiers 862
Credit Card Magnetic Stripe Data

Table 37-152 Credit Card Magnetic Stripe Data medium-breadth patterns

Pattern Pattern (continued)

;1800\d{11}= %B3[068]\d{12}^[A-Z]{1}
;6011-\d{4}-\d{4}-\d{4}= %B3[068]\d{2} \d{6} \d{4}^[A-Z]{1}

;6011 \d{4} \d{4} \d{4}= %B3[068]\d{2}-\d{6}-\d{4}^[A-Z]{1}

;6011\d{12}= %B4\d{12}^[A-Z]{1}

;3[068]\d{12}= %B3[47]\d{2}-\d{6}-\d{5}^[A-Z]{1}

;3[068]\d{2} \d{6} \d{4}= %B4\d{3} \d{4} \d{4} \d{4}^[A-Z]{1}

;3[068]\d{2}-\d{6}-\d{4}= %B3[47]\d{2} \d{6} \d{5}^[A-Z]{1}

;4\d{12}= %B4\d{15}^[A-Z]{1}

;3[47]\d{2}-\d{6}-\d{5}= %B3[47]\d{13}^[A-Z]{1}

;4\d{3} \d{4} \d{4} \d{4}= %B5[1-5]\d{2}-\d{4}-\d{4}-\d{4}^[A-Z]{1}

;3[47]\d{2} \d{6} \d{5}= %B4\d{3}-\d{4}-\d{4}-\d{4}^[A-Z]{1}

;4\d{15}= ;3[47]\d{13}= %B5[1-5]\d{2} \d{4} \d{4} \d{4}^[A-Z]{1}

;5[1-5]\d{2}-\d{4}-\d{4}-\d{4}= %B5[1-5]\d{14}^[A-Z]{1}

;4\d{3}-\d{4}-\d{4}-\d{4}= %B2131\d{11}^[A-Z]{1}

;5[1-5]\d{2} \d{4} \d{4} \d{4}= %B3\d{3}-\d{4}-\d{4}-\d{4}^[A-Z]{1}

;5[1-5]\d{14}= ;2131\d{11}= %B3\d{3} \d{4} \d{4} \d{4}^[A-Z]{1}

;3\d{3}-\d{4}-\d{4}-\d{4}= %B3\d{15}^[A-Z]{1}

;3\d{3} \d{4} \d{4} \d{4}= %B2149\d{11}^[A-Z]{1}

;3\d{15}= %B2149 \d{6} \d{5}^[A-Z]{1}

;2149\d{11}= %B2149-\d{6}-\d{5}^[A-Z]{1}

;2149 \d{6} \d{5}= %B2014\d{11}^[A-Z]{1}

;2149-\d{6}-\d{5}= %B2014 \d{6} \d{5}^[A-Z]{1}

;2014\d{11}= %B2014-\d{6}-\d{5}^[A-Z]{1}

;2014 \d{6} \d{5}=

;2014-\d{6}-\d{5}=

%B1800\d{11}^[A-Z]{1}

%B6011-\d{4}-\d{4}-\d{4}^[A-Z]{1}

%B6011 \d{4} \d{4} \d{4}^[A-Z]{1}

%B6011\d{12}^[A-Z]{1}
 Library of system data identifiers 863
Credit Card Number

Table 37-153 Credit Card Magnetic Stripe Data medium-breadth validator

Validator Description

Luhn Check Computes the Luhn checksum which every instance must
pass.

Credit Card Number

Account number needed to process credit card transactions. Often abbreviated as CCN. Also
known as a Primary Account Number (PAN).
The Credit Card Number data identifier offers three breadths of detection:
■ The wide breadth detects valid credit card numbers that are separated by spaces, dashes,
periods, or without separators. It also performs Luhn-check validation.
See “Credit Card Number wide breadth” on page 863.
■ The medium breadth detects valid credit card numbers that are separated by spaces,
dashes, periods, or without separators. It also checks for common test numbers and
performs Luhn-check validation.
See “Credit Card Number medium breadth” on page 864.
■ The narrow breadth detects valid credit card numbers that are separated by spaces, dashes,
periods, or without separators. It also checks for common test numbers, performs
Luhn-check validation and requires the presence of credit card number-related keywords.
See “Credit Card Number narrow breadth” on page 867.

Credit Card Number wide breadth

The wide breadth detects valid credit card numbers that are separated by spaces, dashes,
periods, or without separators.
This validator includes formats for American Express, Diner's Club, Discover, Japan Credit
Bureau (JCB), MasterCard, and Visa.
This validator performs Luhn-check validation.
 Library of system data identifiers 864
Credit Card Number

Table 37-154 Credit Card Number wide-breadth patterns

Pattern Pattern (continued)

2149 \d{6} \d{5} 4\d{12}

2149-\d{6}-\d{5} \d{16}

2014\d{11} \d{4}.\d{4}.\d{4}.\d{4}

2014 .\d{6}.\d{5} \d{4}-\d{4}-\d{4}-\d{4}

2014 \d{6} \d{5} \d{4} \d{4} \d{4} \d{4}

2014-\d{6}-\d{5} 1800\d{11}

3[47]\d{2}.\d{6}.\d{5} 2131\d{11}

3[068]\d{2}.\d{6}.\d{4} 2149\d{11}

3[47]\d{2}-\d{6}-\d{5} 2149.\d{6}.\d{5}

3[068]\d{2}-\d{6}-\d{4}

3[47]\d{13}

3[068]\d{2} \d{6} \d{4}

3[47]\d{2} \d{6} \d{5}

3[068]\d{12}

Table 37-155 Credit Card Number wide-breadth validator

Mandatory validator Description

Luhn Check Computes the Luhn checksum, which every credit card number must pass.

Credit Card Number medium breadth

The medium breadth detects valid credit card numbers that are separated by spaces, dashes,
periods, or without separators. This validator performs Luhn check validation. This validator
includes formats for American Express, Diner's Club, Discover, Japan Credit Bureau (JCB),
MasterCard, and Visa. This validator eliminates common test numbers, including those reserved
for testing by credit card issuers.
 Library of system data identifiers 865
Credit Card Number

Table 37-156 Credit Card Number medium-breadth patterns

Pattern Pattern (continued)

 Library of system data identifiers 866
Credit Card Number

Table 37-156 Credit Card Number medium-breadth patterns (continued)

Pattern Pattern (continued)

1800\d{11} 2720.\d{4}.\d{4}.\d{4}
2131\d{11} 2720-\d{4}-\d{4}-\d{4}

3\d{3}.\d{4}.\d{4}.\d{4} 2720 \d{4} \d{4} \d{4}

3\d{3}-\d{4}-\d{4}-\d{4} 2720\d{12}

3\d{3} \d{4} \d{4} \d{4} 6221[2][6-8]\d{10}

3\d{15} 6221.[2][6-8]\d{2}.\d{4}.\d{4}

4\d{3}.\d{4}.\d{4}.\d{4} 6221-[2][6-8]\d{2}-\d{4}-\d{4}

4\d{3}-\d{4}-\d{4}-\d{4} 6221 [2][6-8]\d{2} \d{4} \d{4}

4\d{3} \d{4} \d{4} \d{4} 622[2-8]\d{12}

4\d{15} 622[2-8].\d{4}.\d{4}.\d{4}

4\d{12} 622[2-8]-\d{4}-\d{4}-\d{4}

5[1-5]\d{2}.\d{4}.\d{4}.\d{4} 622[2-8] \d{4} \d{4} \d{4}

5[1-5]\d{2}-\d{4}-\d{4}-\d{4} 6229[2][0-5]\d{10}

2149.\d{6}.\d{5} 6229.[2][0-5]\d{2}.\d{4}.\d{4}

5[1-5]\d{2} \d{4} \d{4} \d{4} 6229-[2][0-5]\d{2}-\d{4}-\d{4}

2149 \d{6} \d{5} 6229 [2][0-5]\d{2} \d{4} \d{4}

5[1-5]\d{14} 2014 \d{6} \d{5}

2149-\d{6}-\d{5} 2014-\d{6}-\d{5}

2149\d{11} 2014\d{11}

2014.\d{6}.\d{5} 6011.\d{4}.\d{4}.\d{4}

222[1-9]\d{12} 6011-\d{4}-\d{4}-\d{4}

222[1-9][.-]\d{4}[.-]\d{4}[.-]\d{4} 6011 \d{4} \d{4} \d{4}

22[3-9]\d{13} 6011\d{12}

22[3-9]\d[.-]\d{4}[.-]\d{4}[.-]\d{4} 3[068]\d{2}.\d{6}.\d{4}

2[3-6]\d{14} 3[068]\d{2}-\d{6}-\d{4}

2[3-6]\d{2}.\d{4}.\d{4}.\d{4} 3[068]\d{2} \d{6} \d{4}

2[3-6]\d{2}-\d{4}-\d{4}-\d{4} 3[068]\d{12}

2[3-6]\d{2} \d{4} \d{4} \d{4} 3[47]\d{13}

27[0-1]\d{13} 3[47]\d{2}.\d{6}.\d{5}

27[0-1]\d.\d{4}.\d{4}.\d{4} 3[47]\d{2} \d{6} \d{5}

 Library of system data identifiers 867
Credit Card Number

Table 37-156 Credit Card Number medium-breadth patterns (continued)

Pattern Pattern (continued)

27[0-1]\d-\d{4}-\d{4}-\d{4} 3[47]\d{2}-\d{6}-\d{5}
27[0-1]\d \d{4} \d{4} \d{4}

Table 37-157 Credit Card Number medium-breadth validators

Mandatory validator Description

Exclude exact match Excludes anything that matches the specified text.

Exclude exact match inputs 0111111111111111, 1234567812345670, 180025848680889, 180026939516875,

201400000000009, 201411032364438, 201431736711288, 210002956344412,
214906110040367, 30000000000004, 30175572836108, 30203642658706,
30374367304832, 30569309025904, 3088000000000000, 3088000000000009,
3088272824427380, 3096666928988980, 3158060990195830, 340000000000009,
341019464477148, 341111111111111, 341132368578216, 343510064010360,
344400377306201, 3530111333300000, 3566002020360500, 370000000000002,
371449635398431, 374395534374782, 378282246310005, 378282246310005,
378282246310005, 378734493671000, 38520000023237, 4007000000027,
4012888888881880, 4024007116284, 4111111111111110, 4111111111111111,
4222222222222, 4242424242424242, 4485249610564758, 4539399050593,
4539475158333170, 4539603277651940, 4539687075612974, 4539890911376230,
4556657397647250, 4716733846619930, 4716976758661, 4916437046413,
4916451936094420, 4916491104658550, 4916603544909870, 4916759155933,
5105105105105100, 5119301340696760, 5263386793750340, 5268196752489640,
5283145597742620, 5424000000000015, 5429800397359070, 5431111111111111,
5455780586062610, 5472715456453270, 5500000000000004, 5539878514522540,
5547392938355060, 5555555555554440, 5555555555554444, 5556722757422205,
6011000000000000, 6011000000000004, 6011000000000012, 6011000990139420,
6011111111111110, 6011111111111117, 6011312054074430, 6011354276117410,
6011601160116611, 6011905056260500, 869908581608894, 869933317208876,
869989278167071

Luhn Check Validator computes the Luhn checksum, which every credit card number must
pass.

Number Delimiter Validates a match by checking the surrounding number.

Credit Card Number narrow breadth

The narrow breadth detects valid credit card numbers that are separated by spaces, dashes,
periods, or without separators. It performs Luhn check validation. Includes formats for American
Express, Diner's Club, Discover, Japan Credit Bureau (JCB), MasterCard, and Visa. Eliminates
 Library of system data identifiers 868
Credit Card Number

common test numbers, including those reserved for testing by credit card issuers. It also
requires presence of a credit card-related keyword.
 Library of system data identifiers 869
Credit Card Number

Table 37-158 Credit Card Number narrow-breadth patterns

Pattern Pattern (continued)

222[1-9]\d{12}
222[1-9][.-]\d{4}[.-]\d{4}[.-]\d{4}

22[3-9]\d{13}

22[3-9]\d[.-]\d{4}[.-]\d{4}[.-]\d{4}

2[3-6]\d{14}

2[3-6]\d{2}.\d{4}.\d{4}.\d{4}

2[3-6]\d{2}-\d{4}-\d{4}-\d{4}

2[3-6]\d{2} \d{4} \d{4} \d{4}

27[0-1]\d{13}

27[0-1]\d.\d{4}.\d{4}.\d{4}

27[0-1]\d-\d{4}-\d{4}-\d{4}

27[0-1]\d \d{4} \d{4} \d{4}

2720.\d{4}.\d{4}.\d{4}

2720-\d{4}-\d{4}-\d{4}

2720 \d{4} \d{4} \d{4}

2720\d{12}

6221[2][6-8]\d{10}

6221.[2][6-8]\d{2}.\d{4}.\d{4}

6221-[2][6-8]\d{2}-\d{4}-\d{4}

6221 [2][6-8]\d{2} \d{4} \d{4}

622[2-8]\d{12}

622[2-8].\d{4}.\d{4}.\d{4}

622[2-8]-\d{4}-\d{4}-\d{4}

622[2-8] \d{4} \d{4} \d{4}

6229[2][0-5]\d{10}

6229.[2][0-5]\d{2}.\d{4}.\d{4}

6229-[2][0-5]\d{2}-\d{4}-\d{4}

6229 [2][0-5]\d{2} \d{4} \d{4}

 Library of system data identifiers 870
Credit Card Number

Table 37-158 Credit Card Number narrow-breadth patterns (continued)

Pattern Pattern (continued)

2149 \d{6} \d{5}

2149-\d{6}-\d{5}

2014\d{11}

2014 \d{6} \d{5}

2014-\d{6}-\d{5}

6011-\d{4}-\d{4}-\d{4}

6011 \d{4} \d{4} \d{4}

6011\d{12}

3[068]\d{12}

3[068]\d{2} \d{6} \d{4}

3[068]\d{2}-\d{6}-\d{4}

3[47]\d{2}-\d{6}-\d{5}

3[47]\d{2} \d{6} \d{5}

3[47]\d{13}

4\d{3}-\d{4}-\d{4}-\d{4}

3\d{3}.\d{4}.\d{4}.\d{4}

2149.\d{6}.\d{5}

2014.\d{6}.\d{5}

6011.\d{4}.\d{4}.\d{4}

3[068]\d{2}.\d{6}.\d{4}

3[47]\d{2}.\d{6}.\d{5}

4\d{3}.\d{4}.\d{4}.\d{4}

1800\d{11}

4\d{12}

4\d{3} \d{4} \d{4} \d{4}

4\d{15}

5[1-5]\d{2}-\d{4}-\d{4}-\d{4}

5[1-5]\d{2} \d{4} \d{4} \d{4}

5[1-5]\d{14}

5[1-5]\d{2}.\d{4}.\d{4}.\d{4}
 Library of system data identifiers 871
Credit Card Number

Table 37-158 Credit Card Number narrow-breadth patterns (continued)

Pattern Pattern (continued)

2131\d{11}
3\d{3}-\d{4}-\d{4}-\d{4}

3\d{3} \d{4} \d{4} \d{4}

3\d{15}

2149\d{11}

Table 37-159 Credit Card Number narrow-breadth validators

Mandatory validator Description

Exclude exact match Excludes anything that matches the specified text.

Exclude exact match inputs 0111111111111111, 1234567812345670, 180025848680889, 180026939516875,

201400000000009, 201411032364438, 201431736711288, 210002956344412,
214906110040367, 30000000000004, 30175572836108, 30203642658706,
30374367304832, 30569309025904, 3088000000000000, 3088000000000009,
3088272824427380, 3096666928988980, 3158060990195830, 340000000000009,
341019464477148, 341111111111111, 341132368578216, 343510064010360,
344400377306201, 3530111333300000, 3566002020360500, 370000000000002,
371449635398431, 374395534374782, 378282246310005, 378282246310005,
378282246310005, 378734493671000, 38520000023237, 4007000000027,
4012888888881880, 4024007116284, 4111111111111110, 4111111111111111,
4222222222222, 4242424242424242, 4485249610564758, 4539399050593,
4539475158333170, 4539603277651940, 4539687075612974, 4539890911376230,
4556657397647250, 4716733846619930, 4716976758661, 4916437046413,
4916451936094420, 4916491104658550, 4916603544909870, 4916759155933,
5105105105105100, 5119301340696760, 5263386793750340, 5268196752489640,
5283145597742620, 5424000000000015, 5429800397359070, 5431111111111111,
5455780586062610, 5472715456453270, 5500000000000004, 5539878514522540,
5547392938355060, 5555555555554440, 5555555555554444, 5556722757422205,
6011000000000000, 6011000000000004, 6011000000000012, 6011000990139420,
6011111111111110, 6011111111111117, 6011312054074430, 6011354276117410,
6011601160116611, 6011905056260500, 869908581608894, 869933317208876,
869989278167071

Luhn Check Validator computes the Luhn checksum which every Credit Card Number must
pass.

Number Delimiter Validates a match by checking the surrounding number.

Find keywords With this option selected, at least one of the following keywords or key phrases
must be present for the data to be matched.
 Library of system data identifiers 872
CUSIP Number

Table 37-159 Credit Card Number narrow-breadth validators (continued)

Mandatory validator Description

Find keywords inputs
account number, account ps, american express, americanexpress, amex,
bank card, bankcard, card num, card number, cc #, cc#, ccn, check card,
checkcard, credit card, credit card #, credit card number, credit card#, debit
card, debitcard, diners club, dinersclub, discover, enroute, japanese card
bureau, jcb, mastercard, mc, visa

CUSIP Number
The CUSIP number is a unique identifier assigned to North American stock or other securities.
This number is issued by the Committee on Uniform Security Identification Procedures (CUSIP)
to assist in clearing and settling trades. CINS is an extension of CUSIP used to identify securities
outside of North America.
The CUSIP Number data identifier detects 9-character strings.
This data identifier provides three breadths of detection:
■ The wide breadth validates the final check digit.
See “CUSIP Number wide breadth” on page 872.
■ The medium breadth validates the final check digit and requires the presence of a keyword.
See “CUSIP Number medium breadth” on page 873.
■ The narrow validates the final check digit and requires the presence of a keyword, excluding
the "NNA" keyword.
See “CUSIP Number narrow breadth” on page 873.

CUSIP Number wide breadth

The wide breadth detects 9-character strings. The 5th, 6th, 7th, and 8th character can be a
letter or number, and all others are digits. Validates the final check digit.

Table 37-160 CUSIP Number wide-breadth pattern

Pattern

w\d\w{6}\d

\w\d\w{4} \w{2} \d
 Library of system data identifiers 873
CUSIP Number

Table 37-161 CUSIP Number wide-breadth validator

Mandatory validator Description

Cusip Validation Validator checks for invalid CUSIP ranges and computes the CUSIP checksum
(Modulus 10 Double Add Double algorithm).

CUSIP Number medium breadth

The medium breadth of the CUSIP Number data identifier detects 9-character strings. The
5th, 6th, 7th, and 8th character can be a letter or number, and all others are digits.
This of the validator validates the final check digit and also requires the presence of a
CUSIP-related keyword.

Table 37-162 CUSIP Number medium-breadth pattern

Pattern

w\d\w{6}\d

\w\d\w{4} \w{2} \d

Table 37-163 CUSIP Number medium-breadth validator

Mandatory validator Description

Cusip Validation Validator checks for invalid CUSIP ranges and computes the CUSIP
checksum (Modulus 10 Double Add Double algorithm).

Find keywords With this option selected, at least one of the following keywords or key
phrases must be present for the data to be matched.

Find keywords input cusip, c.u.s.i.p., Committee on Uniform Security Identification

Procedures, American Bankers Association, Standard & Poor's, S&P,
National Numbering Association, NNA, National Securities
Identification Number

CUSIP Number narrow breadth

The narrow breadth detects 9-character strings. The 5th, 6th, 7th, and 8th character can be a
letter or number, and all others are digits.
This of the validator validates the final check digit and also requires the presence of a
CUSIP-related keyword.
This of the data identifier is narrower than the medium breadth because it does not include
the "NNA" abbreviation as a keyword.
 Library of system data identifiers 874
Czech Personal Identification Number

Table 37-164 CUSIP Number narrow-breadth pattern

Pattern

w\d\w{6}\d

\w\d\w{4} \w{2} \d

Table 37-165 CUSIP Number narrow-breadth validators

Mandatory validator Description

Cusip Validation Validator checks for invalid CUSIP ranges and computes the CUSIP checksum
(Modulus 10 Double Add Double algorithm).

Find keywords With this option selected, at least one of the following keywords or key phrases
must be present for the data to be matched.

Find keywords input cusip, c.u.s.i.p., Committee on Uniform Security Identification Procedures,
American Bankers Association, Standard & Poor's, S&P, National Numbering
Association, National Securities Identification Number

Czech Personal Identification Number

All citizens of the Czech Republic are issued a unique personal identification number by the
Ministry of Interior.
This data identifier provides three breadths of validation:
■ The wide breadth detects a 9- or 10-digit number without checksum validation.
See “Czech Personal Identification Number wide breadth” on page 874.
■ The medium breadth detects a 9- or 10-digit number with checksum validation.
See “Czech Personal Identification Number medium breadth” on page 875.
■ The narrow breadth detects a 9- or 10-digit number that passes checksum validation. It
also requires the presence of Czech Personal ID Number-related keywords.
See “Czech Personal Identification Number narrow breadth” on page 876.

Czech Personal Identification Number wide breadth

The wide breadth detects a 9- or 10-digit number without checksum validation.

Table 37-166 Czech Personal Identification Number wide-breadth patterns

Pattern

\d\d[0156]\d[0123]\d[/]\d\d\d
 Library of system data identifiers 875
Czech Personal Identification Number

Table 37-166 Czech Personal Identification Number wide-breadth patterns (continued)

Pattern

\d\d[0156]\d[0123]\d[/]\d\d\d\d

\d\d[0156]\d[0123]\d\d\d\d

\d\d[0156]\d[0123]\d\d\d\d\d

\d\d[0156]\d[012345678]\d[/]\d\d\d

\d\d[0156]\d[012345678]\d[/]\d\d\d\d

\d\d[0156]\d[012345678]\d\d\d\d

\d\d[0156]\d[012345678]\d\d\d\d\d

Table 37-167 Czech Personal Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Czech Personal Identification Number medium breadth

The medium breadth detects a 9- or 10-digit number with checksum validation.

Table 37-168 Czech Personal Identification Number medium-breadth pattern

Pattern

\d\d[0156]\d[0123]\d[/]\d\d\d

\d\d[0156]\d[0123]\d[/]\d\d\d\d

\d\d[0156]\d[0123]\d\d\d\d

\d\d[0156]\d[0123]\d\d\d\d\d

\d\d[0156]\d[012345678]\d[/]\d\d\d

\d\d[0156]\d[012345678]\d[/]\d\d\d\d

\d\d[0156]\d[012345678]\d\d\d\d

\d\d[0156]\d[012345678]\d\d\d\d\d
 Library of system data identifiers 876
Czech Personal Identification Number

Table 37-169 Czech Personal Identification Number medium-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Czech Personal Identity Number Computes the checksum and validates the pattern against it.
Validation Check

Exclude beginning characters 5555555555, 1111111111, 111111111

Czech Personal Identification Number narrow breadth

The narrow breadth detects a 9- or 10-digit number that passes checksum validation. It also
requires the presence of Czech Personal ID Number-related keywords.

Table 37-170 Czech Personal Identification Number narrow-breadth patterns

Pattern

\d\d[0156]\d[0123]\d[/]\d\d\d

\d\d[0156]\d[0123]\d[/]\d\d\d\d

\d\d[0156]\d[0123]\d\d\d\d

\d\d[0156]\d[0123]\d\d\d\d\d

\d\d[0156]\d[012345678]\d[/]\d\d\d

\d\d[0156]\d[012345678]\d[/]\d\d\d\d

\d\d[0156]\d[012345678]\d\d\d\d

\d\d[0156]\d[012345678]\d\d\d\d\d

Table 37-171 Czech Personal Identification Number narrow-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Czech Personal Identity Number Validation Check Computes the checksum and validates the pattern against
it.
 Library of system data identifiers 877
Denmark Personal Identification Number

Table 37-171 Czech Personal Identification Number narrow-breadth validator (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

personal ID number, PID, personal identity number,

Czech Personal ID Number, identity no, Czech Republic
ID, republic identity number, national number,
insurance number, unique identification number, PID#,
Czechidno#, identityno#

Osobní identifikační číslo, Pojištění číslo, unikátní

identifikační číslo , Osobní identifikační číslo,
identifikační číslo

Denmark Personal Identification Number

In Denmark, every citizen has a national identification number. The number serves as proof
of identification for almost all purposes.
The Denmark Personal Identification Number data identifier provides three breadths of detection:
■ The wide breadth detects a ten-digit number without checksum validation.
See “Denmark Personal Identification Number wide breadth” on page 877.
■ The medium breadth detects a ten-digit number with checksum validation.
See “Denmark Personal Identification Number medium breadth” on page 878.
■ The medium breadth detects a ten-digit number with checksum validation. It also requires
the presence of related keywords.
See “Denmark Personal Identification Number narrow breadth” on page 878.

Denmark Personal Identification Number wide breadth

The wide breadth detects a ten-digit number without checksum validation.

Table 37-172 Denmark Personal Identification Number wide-breadth patterns

Pattern

\d{6}[ -]\d{4}

\d{6}[ -]\l{4}
 Library of system data identifiers 878
Denmark Personal Identification Number

Table 37-172 Denmark Personal Identification Number wide-breadth patterns (continued)

Pattern

\d{10}

Table 37-173 Denmark Personal Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Denmark Personal Identification Number medium breadth

The medium breadth detects a ten-digit number with checksum validation.

Table 37-174 Denmark Personal Identification Number medium-breadth patterns

Pattern

\d{6}[ -]\d{4}

\d{6}[ -]\l{4}

\d{10}

Table 37-175 Denmark Personal Identification Number medium-breadth validators

Mandatory validators Description

Number Delimiter Validates a match by checking the surrounding

characters.

Denmark Personal Identification Number Validation Checksum validator for the Denmark Personal
Check Identification Number.

Denmark Personal Identification Number narrow breadth

The medium breadth detects a ten-digit number with checksum validation. It also requires the
presence of related keywords.

Table 37-176 Denmark Personal Identification Number narrow-breadth patterns

Pattern

\d{6}[ -]\d{4}

\d{6}[ -]\l{4}
 Library of system data identifiers 879
Drivers License Number – CA State

Table 37-176 Denmark Personal Identification Number narrow-breadth patterns (continued)

Pattern

\d{10}

Table 37-177 Denmark Personal Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Denmark Personal Identification Number Validation Check Checksum validator for the Denmark Personal Identification
Number.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

national identification number, national identity

number, personal identity number, personal
identification number, nationalid#, personalidentityno#,
unique identity number, uniqueidentityno#, Nationalt
identifikationsnummer, personnummer, unikt
identifikationsnummer, identifikationsnummer, centrale
personregister, cpr, cpr-nummer, cpr#, cpr-nummer#,
identifikationsnummer#, personnummer#

Drivers License Number – CA State

This number is the identification number for an individual's driver's license issued by the US
state of California.
The Drivers License Number – CA State data identifier detects the presence of a 7-digit number.
This data identifier provides two breadths of validation:
■ The wide breadth detects any 7-digit number.
See “Drivers License Number – CA State wide breadth” on page 880.
■ The medium breadth validates a detected number against keywords.
See “Drivers License Number – CA State medium breadth” on page 880.
 Library of system data identifiers 880
Drivers License Number – CA State

Drivers License Number – CA State wide breadth

The wide breadth of the CA Driver License Number data identifier detects an 8 character string,
beginning with a letter followed by a 7-digit number.

Note: This breadth option does not include any validators.

Table 37-178 Drivers License Number wide-breadth pattern

Pattern

\l\d{7}

Drivers License Number – CA State medium breadth

The medium breadth of this data identifier detects an 8 character string, beginning with a letter
followed by a 7-digit number.
It validates a detected number by requiring a driver's license keyword AND a California-related
keyword.

Table 37-179 Drivers License Number – CA State medium-breadth pattern

Pattern

\l\d{7}

Table 37-180 Drivers License Number – CA State medium-breadth validators

Mandatory validator Description

Find keywords With this option selected, at least one of the following keywords or key phrases must
be present for the data to be matched.

Find keywords input driver license, drivers license, driver's license, driver licenses, drivers licenses,
driver's licenses, dl#, dls#, lic#, lics#

Find keywords With this option selected, at least one of the following keywords or key phrases must
be present for the data to be matched.

Find keywords input ca, calif, california

 Library of system data identifiers 881
Drivers License Number - FL, MI, MN States

Drivers License Number - FL, MI, MN States

These number are the identification number for an individual's driver's license issued by one
of the following US states: Florida, Michigan, or Minnesota. These states are grouped together
because they share a common pattern for this number.
This data identifier detects a 13-character string, beginning with a letter followed by 12 numbers.
This data identifier provides two breadths of validation:
■ The wide breadth detects any 13-character string with a letter followed by 12 numbers.
See “Drivers License Number- FL, MI, MN States wide breadth” on page 881.
■ The medium breadth narrows the scope by requiring the presence keywords.
See “Drivers License Number- FL, MI, MN States medium breadth” on page 881.

Drivers License Number- FL, MI, MN States wide breadth

The wide breadth of this data identifier detects any 13 character string with a letter followed
by 12 numbers.
For the MN license number, the following format is matched: L-DDD-DDD-DDD-DDD.

Note: This breadth option does not include any validators.

Table 37-181 Drivers License Number- FL, MI, MN States wide-breadth patterns

Patterns

\l \d{3} \d{3} \d{3} \d{3}

\l\d{12}

\l\d{3}-\d{3}-\d{2}-\d{3}-\d

\l-\d{3}-\d{3}-\d{3}-\d{3}

Drivers License Number- FL, MI, MN States medium breadth

The medium breadth of this data identifier implements patters to detect any 13-character string
with a letter followed by 12 numbers. For the MN license number, the following format is
matched: L-DDD-DDD-DDD-DDD.
This data identifier validates the number by requiring the presence of a drivers license keyword
AND a state-related keyword.
 Library of system data identifiers 882
Drivers License Number - IL State

Table 37-182 Drivers License Number- FL, MI, MN States medium-breadth patterns

Pattern

\l \d{3} \d{3} \d{3} \d{3}

\l\d{12}

\l\d{3}-\d{3}-\d{2}-\d{3}-\d

\l-\d{3}-\d{3}-\d{3}-\d{3}

Table 37-183 Drivers License Number- FL, MI, MN States medium-breadth validators

Mandator validator Description

Find keywords Requires at least one of the input keywords or key phrases to be present for the
data to be matched.

Find keywords input driver license, drivers license, driver's license, driver licenses, drivers
licenses, driver's licenses, dl#, dls#, lic#, lics#

Find keywords Requires at least one of the input keywords or key phrases to be present for the
data to be matched.

Find keywords input fla, fl, florida, michigan, mi, minnesota, mn

Drivers License Number - IL State

This number is the identification number for an individual's driver's license issued by the US
state of Illinois.
The Drivers License Number - IL State data identifier detects the presence of an Illinois drivers
license number.
This data identifier provides two breadths of validation:
■ The wide breadth detects the presence of a 12-character string.
See “Drivers License Number- IL State wide breadth” on page 882.
■ The medium breadth narrows the scope by requiring the presence of keywords.
See “Drivers License Number- IL State medium breadth” on page 883.

Drivers License Number- IL State wide breadth

The wide breadth detects a 12-character string, beginning with a letter (the first letter of the
person's last name) followed by 11 numbers.
 Library of system data identifiers 883
Drivers License Number - NJ State

Note: This breadth option does not include any validators.

Table 37-184 Drivers License Number- IL State wide-breadth patterns

Pattern

\l\d{3}-\d{4}-\d{4}

\l\d{11}

Drivers License Number- IL State medium breadth

The medium breadth detects a 12-character string, beginning with a letter (the first letter of
the person's last name) followed by 11 numbers.
This breadth also requires the presence of both a driver's license keyword AND an
Illinois-related keyword.

Table 37-185 Drivers License Number- IL State medium-breadth patterns

Pattern

\l\d{3}-\d{4}-\d{4}

\l\d{11}

Table 37-186 Drivers License Number- IL State medium-breadth validators

Mandatory validators Description

Find keywords Requires at least one of the input keywords or key phrases
to be present for the data to be matched.

Find keywords input driver license, drivers license, driver's license, driver
licenses, drivers licenses, driver's licenses, dl#, dls#,
lic#, lics#

Find keywords Requires at least one of the input keywords or key phrases
to be present for the data to be matched.

Find keywords input il, illinois

Drivers License Number - NJ State

This number is the identification for an individual's driver's license issued by the US state of
New Jersey.
 Library of system data identifiers 884
Drivers License Number - NJ State

The Drivers License Number - NJ State data identifier detects the presence of a New Jersey
drivers license number.
This data identifier provides two breadths of validation:
■ The wide breadth detects the presence of a 15 character string.
See “Drivers License Number- NJ State wide breadth” on page 884.
■ The medium breadth narrows the scope by requiring the presence of keywords.
See “Drivers License Number- NJ State medium breadth” on page 884.

Drivers License Number- NJ State wide breadth

The wide breadth detects a 15-character string, beginning with a letter (the first letter of the
person's last name) followed by 14 numbers.

Note: The wide breadth option does not include any validators.

Table 37-187 Drivers License Number- NJ State wide-breadth patterns

Patterns

\l\d{4} \d{5} \d{5}

\l\d{14}

Drivers License Number- NJ State medium breadth

The medium breadth detects a 15-character string, beginning with a letter (the first letter of
the person's last name) followed by 14 numbers.
This breadth also requires the presence of both a driver's license keyword AND a New
Jersey-related keyword.

Table 37-188 Drivers License Number- NJ State medium-breadth patterns

Pattern

\l\d{3}-\d{4}-\d{4}

\l\d{11}
 Library of system data identifiers 885
Drivers License Number - NY State

Table 37-189 Drivers License Number- NJ State medium-breadth validators

Validators Description

Find keywords Requires at least one of the input keywords or key phrases
to be present for the data to be matched.

Find keywords input driver license, drivers license, driver's license, driver
licenses, drivers licenses, driver's licenses, dl#, dls#,
lic#, lics#

Find keywords Requires at least one of the input keywords or key phrases
to be present for the data to be matched.

Find keywords input nj, new jersey, newjersey

Drivers License Number - NY State

This number is the identification for an individual's driver's license issued by the US state of
New York.
The data identifier detects the presence of a New York drivers license number.
This data identifier provides two breadths of validation:
■ The wide breadth detects a string of nine digits.
See “Drivers License Number- NY State wide breadth” on page 885.
■ The medium breadth narrows the scope by requiring the presence of keywords.
See “Drivers License Number- NJ State medium breadth” on page 884.

Drivers License Number- NY State wide breadth

The wide breadth detects a 9-digit string.

Note: The wide breadth option does not include any validators.

Table 37-190 Drivers License Number- NY State wide-breadth patters

Pattern

\d{3} \d{3} \d{3}

\d{9}
 Library of system data identifiers 886
Driver's License Number - WA State

Drivers License Number - NY State medium breadth

The medium breadth detects a 9-digit string.
This breadth also requires the presence of both a driver's license keyword AND a New
York–related keyword.

Table 37-191 Drivers License Number- NY State medium-breadth patterns

Pattern

\l\d{3}-\d{4}-\d{4}

\l\d{11}

Table 37-192 Drivers License Number- NY State medium-breadth validators

Mandatory validators Description

Find keywords Requires at least one of the input keywords or key phrases to be present for the
data to be matched.

Find keywords input driver license, drivers license, driver's license, driver
licenses, drivers licenses, driver's licenses, dl#, dls#,
lic#, lics#

Find keywords Requires at least one of the input keywords or key phrases to be present for the
data to be matched.

Find keywords input new york, ny, newyork

Driver's License Number - WA State

Identification number for an individual's driver's license issued by the US state of Washington.
The Driver's License Number - WA State data identifier provides three breadths of detection.
■ The wide breadth detects a Washington State driver's license with no validation.
See “ Driver's License Number - WA State wide breadth” on page 887.
■ The medium breadth detects a Washington State driver's license with checksum validation.
See “Driver's License Number - WA State medium breadth” on page 887.
■ The narrow breadth detects a Washington State driver's license with checksum validation.
It also requires the presence of Washington State driver's license-related keywords.
See “Driver's License Number - WA State narrow breadth” on page 888.
 Library of system data identifiers 887
Driver's License Number - WA State

Driver's License Number - WA State wide breadth

The wide breadth detects a Washington State driver's license with no validation.

Table 37-193 Driver's License Number - WA State wide-breadth patterns

Pattern

\l{5}\l[A-Za-z*]\d{3}\w{2}

\l{4}[*]\l[A-Za-z*]\d{3}\w{2}

\l{3}[*]{2}\l[A-Za-z*]\d{3}\w{2}

\l{2}[*]{3}\l[A-Za-z*]\d{3}\w{2}

\l{1}[*]{4}\l[A-Za-z*]\d{3}\w{2}

The wide breadth of the Driver's License Number - WA State data identifier does not include
a validator.

Driver's License Number - WA State medium breadth

The medium breadth detects a Washington State driver's license with checksum validation.

Table 37-194 Driver's License Number - WA State medium-breadth patterns

Pattern

\l{5}\l[A-Za-z*]\d{3}\w{2}

\l{4}[*]\l[A-Za-z*]\d{3}\w{2}

\l{3}[*]{2}\l[A-Za-z*]\d{3}\w{2}

\l{2}[*]{3}\l[A-Za-z*]\d{3}\w{2}

\l{1}[*]{4}\l[A-Za-z*]\d{3}\w{2}

Table 37-195 Driver's License Number - WA State medium-breadth validators

Mandatory validator Description

Driver's License Number - WA State Validation Check Computes the checksum and validates the pattern against
it.
 Library of system data identifiers 888
Driver's License Number - WI State

Driver's License Number - WA State narrow breadth

The narrow breadth detects a Washington State driver's license with checksum validation. It
also requires the presence of Washington State driver's license-related keywords.

Table 37-196 Driver's License Number - WA State narrow-breadth patterns

Pattern

\l{5}\l[A-Za-z*]\d{3}\w{2}

\l{4}[*]\l[A-Za-z*]\d{3}\w{2}

\l{3}[*]{2}\l[A-Za-z*]\d{3}\w{2}

\l{2}[*]{3}\l[A-Za-z*]\d{3}\w{2}

\l{1}[*]{4}\l[A-Za-z*]\d{3}\w{2}

Table 37-197 Driver's License Number - WA State narrow-breadth validators

Mandatory validator Description

Driver's License Number - WA State Validation Check Computes the checksum and validates the pattern against
it.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

driver license, drivers license, driver licenses, drivers

licenses, dl#, dls#, lic#, lics#, wash, washington, wa

Driver's License Number - WI State

The Driver's License Number - WI State is an identification number for an individual driver's
license issued by the US state of Wisconsin.
The Driver's License Number - WI State data identifier provides three breadths of detection.
■ The wide breadth detects a 13-digit number with ending-character exclusion validation.
See “ Driver's License Number - WI State wide breadth” on page 889.
■ The wide breadth detects a 13-digit number with ending-character exclusion and checksum
validation.
See “Driver's License Number - WI State medium breadth” on page 889.
 Library of system data identifiers 889
Driver's License Number - WI State

■ The wide breadth detects a 13-digit number with ending-character exclusion and checksum
validation. It also requires the presence of Wisconsin State driver's license number-related
keywords.
See “Driver's License Number - WI State narrow breadth” on page 890.

Driver's License Number - WI State wide breadth

The wide breadth detects a 13-digit number with ending-character exclusion validation.

Table 37-198 Driver's License Number - WI Statewide-breadth patterns

Pattern

\l\d{3}-\d{4}-\d{4}-\d{2}

\l\d{13}

Table 37-199 Driver's License Number - WI State wide-breadth validator

Mandatory validator Description

Exclude ending characters Excludes the following characters from the end of the
number:

0000000000000, 1111111111111, 2222222222222,

3333333333333, 4444444444444, 5555555555555,
6666666666666, 7777777777777, 8888888888888,
9999999999999

Driver's License Number - WI State medium breadth

The wide breadth detects a 13-digit number with ending-character exclusion and checksum
validation.

Table 37-200 Driver's License Number - WI State medium-breadth patterns

Pattern

\l\d{3}-\d{4}-\d{4}-\d{2}

\l\d{13}
 Library of system data identifiers 890
Driver's License Number - WI State

Table 37-201 Driver's License Number - WI State medium-breadth validators

Mandatory validator Description

Driver's License Number - WI State Validation Check Computes the checksum and validates the pattern against
it.

Exclude ending characters Excludes the following characters from the end of the
number:

0000000000000, 1111111111111, 2222222222222,

3333333333333, 4444444444444, 5555555555555,
6666666666666, 7777777777777, 8888888888888,
9999999999999

Driver's License Number - WI State narrow breadth

The wide breadth detects a 13-digit number with ending-character exclusion and checksum
validation. It also requires the presence of Wisconsin State driver's license number-related
keywords.

Table 37-202 Driver's License Number - WI State narrow-breadth patterns

Pattern

\l\d{3}-\d{4}-\d{4}-\d{2}

\l\d{13}

Table 37-203 Driver's License Number - WI State narrow-breadth validators

Mandatory validator Description

Driver's License Number - WI State Validation Check Computes the checksum and validates the pattern against
it.

Exclude ending characters Excludes the following characters from the end of the
number:

0000000000000, 1111111111111, 2222222222222,

3333333333333, 4444444444444, 5555555555555,
6666666666666, 7777777777777, 8888888888888,
9999999999999
 Library of system data identifiers 891
Drug Enforcement Agency (DEA) Number

Table 37-203 Driver's License Number - WI State narrow-breadth validators (continued)

Mandatory validator Description

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

driver license, drivers license, driver licenses, drivers

licenses, dl#, dls#, lic#, lics#, wisc., wisconsin, wi

Drug Enforcement Agency (DEA) Number

A DEA number is a number assigned to a health care provider (such as a medical practitioner,
dentist, or veterinarian) by the U.S. Drug Enforcement Administration allowing them to write
prescriptions for controlled substances.
The Drug Enforcement Agency (DEA) Number data identifier provides three breadths of
detection:
■ The wide breadth detects an 8- or 9-character number without validation.
See “ Drug Enforcement Agency (DEA) Number wide breadth” on page 891.
■ The medium breadth detects an 8- or 9-character number with ending character exclusion
and checksum validation.
See “Drug Enforcement Agency (DEA) Number medium breadth” on page 892.
■ The narrow breadth detects an 8- or 9-character number with ending character exclusion
and checksum validation. It also requires the presence of DEA-number related keywords.
See “Drug Enforcement Agency (DEA) Number narrow breadth” on page 892.

Drug Enforcement Agency (DEA) Number wide breadth

The wide breadth detects an 8- or 9-character number without validation.

Table 37-204 Drug Enforcement Agency (DEA) Number wide-breadth patterns

Pattern

[ABFGMPR]\l\d{7}

[ABFGMPR]\d{8}

The wide breadth of the Drug Enforcement Agency (DEA) Number data identifier includes no
validators.
 Library of system data identifiers 892
Drug Enforcement Agency (DEA) Number

Drug Enforcement Agency (DEA) Number medium breadth

The medium breadth detects an 8- or 9-character number with ending character exclusion and
checksum validation.

Table 37-205 Drug Enforcement Agency (DEA) Number medium-breadth patterns

Pattern

[ABFGMPR]\l\d{7}

[ABFGMPR]\d{8}

Table 37-206 Drug Enforcement Agency (DEA) Number medium-breadth validators

Mandatory validator Description

Drug Enforcement Agency Number Validation Check Computes the checksum and validates the pattern against
it.

Exclude ending characters Excludes these ending characters:

5555555, 55555555

Drug Enforcement Agency (DEA) Number narrow breadth

The narrow breadth detects an 8- or 9-character number with ending character exclusion and
checksum validation. It also requires the presence of DEA-number related keywords.

Table 37-207 Drug Enforcement Agency (DEA) Number narrow-breadth patterns

Pattern

[ABFGMPR]\l\d{7}

[ABFGMPR]\d{8}

Table 37-208 Drug Enforcement Agency (DEA) Number narrow-breadth validators

Mandatory validator Description

Drug Enforcement Agency Number Validation Check Computes the checksum and validates the pattern against
it.

Exclude ending characters Excludes these ending characters:

5555555, 55555555
 Library of system data identifiers 893
Finnish Personal Identification Number

Table 37-208 Drug Enforcement Agency (DEA) Number narrow-breadth validators (continued)

Mandatory validator Description

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

dea number, DEA, DEA no., DEA Registration Number,

DEA registration no., DEA#, DEA No#, Drug
Enforcement Agency Number, Drug Enforcement
Agency No.

Finnish Personal Identification Number

The Finnish Personal Identification Number or Personal Identity Code is a unique personal
identifier used for identifying citizens in government and many other transactions.
The Finnish Personal Identification Number data identifier provides three breadths of detection:
■ The wide breadth detects a Finnish Personal Identification Number without validation.
See “ Finnish Personal Identification Number wide breadth” on page 893.
■ The medium breadth detects a Finnish Personal Identification Number with checksum
validation.
See “Finnish Personal Identification Number medium breadth” on page 894.
■ The narrow breadth detects a Finnish Personal Identification Number with checksum
validation. It also requires the presence of Finnish Personal Identification Number-related
keywords.
See “Finnish Personal Identification Number narrow breadth” on page 894.

Finnish Personal Identification Number wide breadth

The wide breadth detects a Finnish Personal Identification Number without validation.

Table 37-209 Finnish Personal Identification Number wide-breadth pattern

Pattern

\d{6}[-+Aa]\d{3}\w

The wide breadth of the Finnish Personal Identification Number wide breadth includes no
validators.
 Library of system data identifiers 894
Finnish Personal Identification Number

Finnish Personal Identification Number medium breadth

The medium breadth detects a Finnish Personal Identification Number with checksum validation.

Table 37-210 Finnish Personal Identification Number medium-breadth pattern

Pattern

\d{6}[-+Aa]\d{3}\w

Table 37-211 Finnish Personal Identification Number medium-breadth validators

Mandatory validator Description

Finnish Personal Identification Number Validation Check Computes the checksum and validates the pattern against
it.

Finnish Personal Identification Number narrow breadth

The narrow breadth detects a Finnish Personal Identification Number with checksum validation.
It also requires the presence of Finnish Personal Identification Number-related keywords.

Table 37-212 Finnish Personal Identification Number narrow-breadth pattern

Pattern

\d{6}[-+Aa]\d{3}\w

Table 37-213 Finnish Personal Identification Number narrow-breadth validators

Mandatory validator Description

Finnish Personal Identification Number Validation Check Computes the checksum and validates the pattern against
it.
 Library of system data identifiers 895
France Driver's License Number

Table 37-213 Finnish Personal Identification Number narrow-breadth validators (continued)

Mandatory validator Description

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

identification number, personal ID, identity number,

Finnish national ID number, personalIDnumber#,
National Identification Number, id number, National id
no., National id number, id no, tunnistenumero,
henkilötunnus, yksilöllinen henkilökohtainen
tunnistenumero, Ainutlaatuinen henkilökohtainen
tunnus, identiteetti numero, Suomen kansallinen
henkilötunnus, henkilötunnusnumero#, kansallisen
tunnistenumero, tunnusnumero, kansallinen tunnus
numero

France Driver's License Number

Identification number for an individual's driver's licence issued by the Driver and Vehicle
Licensing Agency of France.
The France Driver's License Number data identifier provides two breadths of detection:
■ The wide breadth detects a 12-digit number without checksum validation.
See “France Driver's License Number wide breadth” on page 895.
■ The narrow breadth detects a 12-digit number without checksum validation. It also requires
the presence of related keywords.
See “France Driver's License Number narrow breadth” on page 896.

France Driver's License Number wide breadth

The wide breadth detects a 12-digit number without checksum validation.

Table 37-214 France Driver's License Number wide-breadth pattern

Pattern

\d{12}
 Library of system data identifiers 896
France Health Insurance Number

Table 37-215 France Driver's License Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

France Driver's License Number narrow breadth

The narrow breadth detects a 12-digit number without checksum validation. It also requires
the presence of related keywords.

Table 37-216 France Driver's License Number narrow-breadth pattern

Pattern

\d{12}

Table 37-217 France Driver's License Number narrow-breadth validators

Mandatory validators Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

drivers licence number, drivers license number, driving

licence number, driving license number, permis de
conduire, licence number, license number, licence
numbers, license numbers, drivers license, driving
licence, driving license, DL#, dl#, DLNO#, dlno#, Driver
License, Driver License Number, Drivers Lic., Drivers
Licence, Driver's License, Driver's License Number,
driver's license number, Driver's Licence Number

France Health Insurance Number

A Carte Vitale is social insurance card used in France that contains medical information for
the card holder. It has a unique 21-digit serial number.
The France Health Insurance Number data identifier provides two breadths of detection:
 Library of system data identifiers 897
France Health Insurance Number

■ The wide breadth detects a 21-character number without checksum validation.

See “France Health Insurance Number wide breadth” on page 897.
■ The narrow breadth detects a 21-character number without checksum validation. It also
requires the presence of related keywords.
See “France Health Insurance Number narrow breadth” on page 897.

France Health Insurance Number wide breadth

The wide breadth detects a 21-character number without checksum validation.

Table 37-218 France Health Insurance Number wide-breadth patterns

Pattern

\d{10} \d{10} \d

\d{21}

Table 37-219 France Health Insurance Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

France Health Insurance Number narrow breadth

The narrow breadth detects a 21-character number without checksum validation. It also requires
the presence of related keywords.

Table 37-220 France Health Insurance Number narrow-breadth patterns

Pattern

\d{10} \d{10} \d

\d{21}

Table 37-221 France Health Insurance Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

 Library of system data identifiers 898
France Tax Identification Number

Table 37-221 France Health Insurance Number narrow-breadth validators (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

insurance card,social insurance card,carte vitale,carte

d'assuré social

France Tax Identification Number

France issue a tax identification number for anyone who has obligations to declare taxes in
France.
The France Tax Identification Number data identifier provides two breadths of detection:
■ The wide breadth detects a 13-digit number without checksum validation.
See “France Tax Identification Number wide breadth” on page 898.
■ The narrow breadth detects a 13-digit number without checksum validation. It also requires
the presence of related keywords.
See “France Tax Identification Number narrow breadth” on page 899.

France Tax Identification Number wide breadth

The wide breadth detects a 13-digit number without checksum validation.

Table 37-222 France Tax Identification Number wide-breadth patterns

Pattern

[0123]\d{12}

[0123]\d{1} \d{2} \d{3} \d{3} \d{3}

Table 37-223 France Tax Identification Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

 Library of system data identifiers 899
France Value Added Tax (VAT) Number

France Tax Identification Number narrow breadth

The narrow breadth detects a 13-digit number without checksum validation. It also requires
the presence of related keywords.

Table 37-224 France Tax Identification Number narrow-breadth patterns

Pattern

[0123]\d{12}

[0123]\d{1} \d{2} \d{3} \d{3} \d{3}

Table 37-225 France Tax Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

tax identification number, tax number, tax id, numéro

d'identification fiscale

France Value Added Tax (VAT) Number

The Value Added Tax (VAT) is a tax levied on goods and services provided in France and is
collected from the final customer. Companies must register with the Register of Commerce
and Companies in France to get VAT number allocated.
The France Value Added Tax (VAT) Number data identifier provides three breadths of detection:
■ The wide breadth detects a 13-character alphanumeric pattern without checksum validation.
See “France Value Added Tax (VAT) Number wide breadth” on page 900.
■ The medium breadth detects a 13-character alphanumeric pattern with checksum validation.
See “France Value Added Tax (VAT) Number medium breadth” on page 900.
■ The narrow breadth detects a 13-character alphanumeric pattern with checksum validation.
It also requires the presence of related keywords.
See “France Value Added Tax (VAT) Number narrow breadth” on page 901.
 Library of system data identifiers 900
France Value Added Tax (VAT) Number

France Value Added Tax (VAT) Number wide breadth

The wide breadth detects a 13-character alphanumeric pattern without checksum validation.

Table 37-226 France Value Added Tax (VAT) Number wide-breadth patterns

Pattern

[Ff][Rr][0-9A-Za-z]{2}\d{9}

[Ff][Rr][0-9A-Za-z]{2} \d{9}

[Ff][Rr] [0-9A-Za-z]{2}\d{9}

[Ff][Rr]-[0-9A-Za-z]{2}\d{9}

[Ff][Rr][0-9A-Za-z]{2} \d{3}-\d{3}-\d{3}

[Ff][Rr][0-9A-Za-z]{2} \d{3}.\d{3}.\d{3}

[Ff][Rr][0-9A-Za-z]{2} \d{3},\d{3},\d{3}

[Ff][Rr][0-9A-Za-z]{2} \d{3} \d{3} \d{3}

Table 37-227 France Value Added Tax (VAT) Number wide-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

France Value Added Tax (VAT) Number medium breadth

The medium breadth detects a 13-character alphanumeric pattern with checksum validation.

Table 37-228 France Value Added Tax (VAT) Number medium breadth patterns

[Ff][Rr][0-9A-Za-z]{2}\d{9}

[Ff][Rr][0-9A-Za-z]{2} \d{9}

[Ff][Rr] [0-9A-Za-z]{2}\d{9}

[Ff][Rr]-[0-9A-Za-z]{2}\d{9}

[Ff][Rr][0-9A-Za-z]{2} \d{3}-\d{3}-\d{3}

[Ff][Rr][0-9A-Za-z]{2} \d{3}.\d{3}.\d{3}
 Library of system data identifiers 901
France Value Added Tax (VAT) Number

Table 37-228 France Value Added Tax (VAT) Number medium breadth patterns (continued)

[Ff][Rr][0-9A-Za-z]{2} \d{3},\d{3},\d{3}

[Ff][Rr][0-9A-Za-z]{2} \d{3} \d{3} \d{3}

Table 37-229 France Value Added Tax (VAT) Number medium breadth validators

France VAT Number Validation Check Checksum validator for the France Value Added Tax (VAT
Number.

France Value Added Tax (VAT) Number narrow breadth

The narrow breadth detects a 13-character alphanumeric pattern with checksum validation. It
also requires the presence of related keywords.

Table 37-230 France Value Added Tax (VAT) Number narrow-breadth patterns

Pattern

[Ff][Rr][0-9A-Za-z]{2}\d{9}

[Ff][Rr][0-9A-Za-z]{2} \d{9}

[Ff][Rr] [0-9A-Za-z]{2}\d{9}

[Ff][Rr]-[0-9A-Za-z]{2}\d{9}

[Ff][Rr][0-9A-Za-z]{2} \d{3}-\d{3}-\d{3}

[Ff][Rr][0-9A-Za-z]{2} \d{3}.\d{3}.\d{3}

[Ff][Rr][0-9A-Za-z]{2} \d{3},\d{3},\d{3}

[Ff][Rr][0-9A-Za-z]{2} \d{3} \d{3} \d{3}

Table 37-231 France Value Added Tax (VAT) Number narrow-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

France VAT Number Validation Check Checksum validator for the France Value Added Tax (VAT
Number.
 Library of system data identifiers 902
French INSEE Code

Table 37-231 France Value Added Tax (VAT) Number narrow-breadth validators (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

france vat number, French vat number, VAT Number,

vat no, VAT#, value added tax number, value added
tax, SIREN identification no, Numéro d'identification
taxe sur valeur ajoutée, Numéro taxe valeur ajoutée,
taxe valeur ajoutée, Taxe sur la valeur ajoutée, Numéro
de TVA intracommunautaire, n° TVA,numéro de TVA,
Numéro de TVA en France, français numéro de TVA,
Numéro d'identification SIREN

French INSEE Code

The INSEE code in France is used as a social insurance number, a national identification
number, and for taxation and employment purposes.
The French INSEE Code data identifier detects the presence of INSEE numbers.
The French INSEE Code data identifier provides two breadths of detection:
■ The wide breadth detects a 15-digit number that passes checksum validation.
■ The narrow breadth detects a 15-digit number that passes checksum validation. It also
requires the presence of INSEE-related keywords.

French INSEE Code wide breadth

The wide breadth detects a 15-digit number which encodes the date of birth, department of
origin, commune of origin, and an order number. A space delimiter after the first 13 digits is
optional. The last two digits of the INSEE code encode a control key used to validate a
checksum.

Table 37-232 French INSEE Code wide-breadth patterns

Pattern

\d{13} \d{2}

d{15}
 Library of system data identifiers 903
French Passport Number

Table 37-233 French INSEE Code wide-breadth validator

Mandatory validator Description

INSEE Control Key This validator computes the INSEE control key and compares it to the last 2 digits
of the pattern.

French INSEE Code narrow breadth

The narrow breadth detects a 15-digit number which encodes the date of birth, department of
origin, commune of origin, and an order number. A space delimiter after the first 13 digits is
optional. The last two digits of the INSEE code encode a control key used to validate a
checksum. It also requires the presence of INSEE-related keywords.

Table 37-234 French INSEE Code narrow-breadth patterns

Pattern

\d{13} \d{2}

d{15}

Table 37-235 French INSEE Code narrow-breadth validators

Mandatory validator Description

INSEE Control Key This validator computes the INSEE control key and
compares it to the last 2 digits of the pattern.

Find keywords With this option selected, at least one of the

following keywords or key phrases must be present
for the data to be matched.

Inputs:

INSEE, numéro de sécu, code sécu, social

security number, social security code

French Passport Number

The French passport is an identity document issued to French citizens. Besides enabling the
bearer to travel internationally and serving as indication of French citizenship, the passport
facilitates the process of securing assistance from French consular officials abroad or other
European Union member states in case a French consular is absent, if needed.
The French Passport Number data identifier provides two breadths of detection:
■ The wide breadth detects a 9-character identifier.
 Library of system data identifiers 904
French Passport Number

See “French Passport Number wide breadth” on page 904.

■ The narrow breadth detects a 9-character identifier. It also requires the presence of French
Passport Number-related keywords.
See “French Passport Number narrow breadth” on page 904.

French Passport Number wide breadth

The wide breadth detects a 9-character identifier.

Table 37-236 French Passport Number wide-breadth pattern

Pattern

\d{2}\w{2}\w{5}

Table 37-237 French Passport Number wide-breadth validator

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

French Passport Number narrow breadth

The narrow breadth detects a 9-character identifier. It also requires the presence of French
Passport Number-related keywords.

Table 37-238 French Passport Number narrow-breadth pattern

Pattern

\d{2}\w{2}\w{5}

Table 37-239 French Passport Number narrow-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

 Library of system data identifiers 905
French Social Security Number

Table 37-239 French Passport Number narrow-breadth validators (continued)

Mandatory validator Description

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

passport, Passport, French Passport, french passport,

Passport Card, Passport Book, passport card, passport
book, passport number, passport no, Passport
Number, Passeport français, Passeport, Passeport
livre, Passeport carte, numéro passeport

French Social Security Number

The French Social Security Number (FSSN) is a unique number assigned to each French
citizen or resident foreign national. It serves as a national identification number.
The French Social Security Number system data identifier provides three breadths of detection:
■ The wide breadth detects a 15-digit number without checksum validation.
See “French Social Security Number wide breadth” on page 905.
■ The medium breadth detects a 15-digit number with checksum validation.
See “French Social Security Number medium breadth” on page 906.
■ The narrow breadth detects a 15-digit number that passes checksum validation. It also
requires the presence of FSSN-related keywords.
See “French Social Security Number narrow breadth” on page 906.

French Social Security Number wide breadth

The wide breadth detects a 15-digit number without checksum validation.

Table 37-240 French Social Security Number wide-breadth pattern

Pattern

[12]\d{2}[012]\d{2}[AB1234567890]\d{8}

Table 37-241 French Social Security Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.
 Library of system data identifiers 906
French Social Security Number

French Social Security Number medium breadth

The medium breadth detects a 15-digit number with checksum validation.

Table 37-242 French Social Security Number medium-breadth pattern

Pattern

[12]\d{2}[012]\d{2}[AB1234567890]\d{8}

Table 37-243 French Social Security Number medium-breadth validator

Mandatory validator Description

French Social Security Number Validation Check Computes the checksum and validates the pattern against
it.

French Social Security Number narrow breadth

The narrow breadth detects a 15-digit number that passes checksum validation. It also requires
the presence of FSSN-related keywords.

Table 37-244 French Social Security Number narrow-breadth pattern

Pattern

[12]\d{2}[012]\d{2}[AB1234567890]\d{8}

Table 37-245 French Social Security Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

French Social Security Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

French social security number, social security number,

FSSN#, SSN#, ssn, ssn#, socialsecuritynumber,
insurance number, national ID number, nationalid#

sécurité sociale non., sécurité sociale numéro, code

sécurité sociale, numéro d'assurance
 Library of system data identifiers 907
German Passport Number

German Passport Number

The German passport number is issued to German nationals for the purpose of international
travel. A German passport is an officially recognized document that German authorities accept
as proof of identity from German citizens.
The German Passport Number system data identifier provides three breadths of detection:
■ The wide breadth detects an 11-digit alphanumeric identifier ended by a letter "D" number
without checksum validation.
See “German Passport Number wide breadth” on page 907.
■ The medium breadth detects an 11-digit alphanumeric identifier ended by a letter "D" with
checksum validation.
See “German Passport Number medium breadth” on page 907.
■ The narrow breadth detects an 11-digit alphanumeric identifier ended by a letter "D" that
passes checksum validation. It also requires the presence of German Passport
Number-related keywords.
See “German Passport Number narrow breadth” on page 908.

German Passport Number wide breadth

The wide breadth detects an 11-digit alphanumeric identifier ended by a letter "D" number
without checksum validation.

Table 37-246 German Passport Number wide-breadth patterns

Pattern

\w{9}\dD

\w{10}[dD]

Table 37-247 German Passport Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

German Passport Number medium breadth

The medium breadth detects an 11-digit alphanumeric identifier ended by a letter "D" with
checksum validation.
 Library of system data identifiers 908
German Passport Number

Table 37-248 German Passport Number medium-breadth patterns

Pattern

\w{9}\dD

\w{10}[dD]

Table 37-249 German Passport Number medium-breadth validator

Mandatory validator Description

German Passport Number Validation Check Computes the checksum every German Passport Number
must pass.

German Passport Number narrow breadth

The narrow breadth detects an 11-digit alphanumeric identifier ended by a letter "D" that passes
checksum validation. It also requires the presence of German Passport Number-related
keywords.

Table 37-250 German Passport Number narrow-breadth patterns

Pattern

\w{9}\dD

\w{10}[dD]

Table 37-251 German Passport Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

German Passport Number Validation Check Computes the checksum every German Passport Number
must pass.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

German passport number, passport number, passport

no, passportno#, passportnumber#, Reisepass kein,
Reisepass, Passnummer
 Library of system data identifiers 909
German Personal ID Number

German Personal ID Number

The German Personal ID Number is issued to all German citizens.
This data identifier provides the following breadths of detection:
■ The wide breadth detects an 11-digit number ending with the letter "D" without checksum
validation.
See “German Personal ID Number wide breadth” on page 909.
■ The medium breadth detects an 11-digit number ending with the letter "D" that passes
checksum validation.
See “ German Personal ID Number medium breadth” on page 909.
■ The narrow breadth detects an 11-digit number ending with the letter "D" that passes
checksum validation. It also requires the presence of German Personal ID Number-related
keywords.
See “German Personal ID Number narrow breadth” on page 910.

German Personal ID Number wide breadth

The wide breadth detects an 11-digit number ending with the letter "D" without checksum
validation.

Table 37-252 German Personal ID Number wide-breadth pattern

Pattern

\w{9}\dD

Table 37-253 German Personal ID Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

German Personal ID Number medium breadth

The medium breadth detects an 11-digit number ending with the letter "D" that passes checksum
validation.

Table 37-254 German Personal ID Number medium-breadth pattern

Pattern

\w{9}\dD
 Library of system data identifiers 910
Germany Driver's License Number

Table 37-255 German Personal ID Number medium breadth validator

Mandatory validator Description

German ID Number Validation Check Computes the checksum and validates the pattern against
it.

German Personal ID Number narrow breadth

The narrow breadth detects an 11-digit number ending with the letter "D" that passes checksum
validation. It also requires the presence of German Personal ID Number-related keywords.

Table 37-256 German Personal ID Number narrow-breadth pattern

Pattern

\w{9}\dD

Table 37-257 German Personal ID Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

German ID Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords If you select this option, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

ID number, identification number, personal ID number,

perosnal ID, GPID, GPID#, unique personal ID number,
unique personal ID, insurance number, identity number
German personal ID number persönliche
identifikationsnummer, ID-Nummer, Deutsch
persönliche-ID-Nummer, persönliche ID Nummer,
eindeutige ID-Nummer, persönliche Nummer, identität
nummer, Versicherungsnummer

Germany Driver's License Number

Identification number for an individual's driver's licence issued by the Driver and Vehicle
Licensing Agency of the Germany.
The Germany Driver's License Number data identifier provides two breadths of detection:
 Library of system data identifiers 911
Germany Driver's License Number

■ The wide breadth detects a 13-character alphanumeric pattern without checksum validation.
See “Germany Driver's License Number wide breadth” on page 911.
■ The narrow breadth detects a 13-character alphanumeric pattern without checksum
validation. It also requires the presence of related keywords.
See “Germany Driver's License Number narrow breadth” on page 911.

Germany Driver's License Number wide breadth

The wide breadth detects a 13-character alphanumeric pattern without checksum validation.

Table 37-258 Germany Driver's License Number wide-breadth pattern

Pattern

\w\d{2}\w{6}\d\w

Table 37-259 Germany Driver's License Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Germany Driver's License Number narrow breadth

The narrow breadth detects a 13-character alphanumeric pattern without checksum validation.
It also requires the presence of related keywords.

Table 37-260 Germany Driver's License Number narrow-breadth patterns

Pattern

\w\d{2}\w{6}\d\w

Table 37-261 Germany Driver's License Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

 Library of system data identifiers 912
Germany Value Added Tax (VAT) Number

Table 37-261 Germany Driver's License Number narrow-breadth validators (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Führerschein, Fuhrerschein, Fuehrerschein,

Führerscheinnummer, Fuhrerscheinnummer,
Fuehrerscheinnummer, Führerscheinnummer,
Fuhrerscheinnummer, Fuehrerscheinnummer,
Führerschein- Nr, Fuhrerschein- Nr, Fuehrerschein-
Nr, Driver License, Driver License Number, driver
license number, Driver Licence, Drivers Lic., Drivers
License, Drivers Licence, Driver's License, Driver's
License Number, driver's license number, Driver's
Licence Number, Driving License number, driving
license number, DL#, dl#, DLNO#, dlno#, driving
licence, driving license

Germany Value Added Tax (VAT) Number

The Value Added Tax (VAT) is a tax levied on goods and services provided in France and is
collected from the final customer. The Value Added Tax (VAT) is a tax levied on goods and
services provided in France and is collected from the final customer.
The Germany Value Added Tax (VAT) Number data identifier provides three breadths of
detection:
■ The wide breadth detects an 11-character alphanumeric pattern without checksum validation.
See “Germany Value Added Tax (VAT) Number wide breadth” on page 912.
■ The medium breadth detects an 11-character alphanumeric pattern with checksum
validation.
See “Germany Value Added Tax (VAT) Number medium breadth” on page 913.
■ The narrow breadth detects an 11-character alphanumeric pattern with checksum validation.
It also requires the presence of related keywords.
See “Germany Value Added Tax (VAT) Number narrow breadth” on page 913.

Germany Value Added Tax (VAT) Number wide breadth

The wide breadth detects an 11-character alphanumeric pattern without checksum validation.
 Library of system data identifiers 913
Germany Value Added Tax (VAT) Number

Table 37-262 Germany Value Added Tax (VAT) Number wide-breadth patterns

Pattern

[Dd][Ee]\d{9}

[Dd][Ee] \d{9}

[Dd][Ee]\d{3}[, ]\d{3}[, ]\d{3}

[Dd][Ee] \d{3}[, ]\d{3}[, ]\d{3}

Table 37-263 Germany Value Added Tax (VAT) Number wide-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Germany Value Added Tax (VAT) Number medium breadth

The medium breadth detects an 11-character alphanumeric pattern with checksum validation.

Table 37-264 Germany Value Added Tax (VAT) Number medium-breadth patterns

Pattern

[Dd][Ee]\d{9}

[Dd][Ee] \d{9}

[Dd][Ee]\d{3}[, ]\d{3}[, ]\d{3}

[Dd][Ee] \d{3}[, ]\d{3}[, ]\d{3}

Table 37-265 Germany Value Added Tax (VAT) Number medium breadth validators

Germany VAT Number Validation Check Checksum validator for the Germany Value Added Tax
(VAT) Number.

Germany Value Added Tax (VAT) Number narrow breadth

The narrow breadth detects an 11-character alphanumeric pattern with checksum validation.
It also requires the presence of related keywords.
 Library of system data identifiers 914
Greek Tax Identification Number

Table 37-266 Germany Value Added Tax (VAT) Number narrow-breadth patterns

Pattern

[Dd][Ee]\d{9}

[Dd][Ee] \d{9}

[Dd][Ee]\d{3}[, ]\d{3}[, ]\d{3}

[Dd][Ee] \d{3}[, ]\d{3}[, ]\d{3}

Table 37-267 Germany Value Added Tax (VAT) Number narrow-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Germany VAT Number Validation Check Checksum validator for the Germany Value Added Tax
(VAT) Number.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

VAT Number, vat no, vat number, VAT#, vat#,

Mehrwertsteuer, MwSt, Mehrwertsteuer
Identifikationsnummer, Mehrwertsteuer nummer

Greek Tax Identification Number

The Arithmo Forologiko Mitro (AFM) is a unique personal tax identification number assigned
to any individual resident in Greece or person who owns property in Greece.
The Greek Tax Identification Number system data identifier provides three breadths of detection:
■ The wide breadth detects a 9-digit number without checksum validation.
See “Greek Tax Identification Number wide breadth” on page 915.
■ The medium breadth detects a 9-digit number with checksum validation.
See “Greek Tax Identification Number medium breadth” on page 915.
■ The narrow breadth detects a 9-digit number that passes checksum validation. It also
requires the presence of AFM-related keywords.
See “Greek Tax Identification Number narrow breadth” on page 915.
 Library of system data identifiers 915
Greek Tax Identification Number

Greek Tax Identification Number wide breadth

The wide breadth detects a 9-digit number without checksum validation.

Table 37-268 Greek Tax Identification Number wide-breadth pattern

Pattern

\d{9}

Table 37-269 Greek Tax Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Greek Tax Identification Number medium breadth

The medium breadth detects a 9-digit number with checksum validation.

Table 37-270 Greek Tax Identification Number medium-breadth pattern

Pattern

\d{9}

Table 37-271 Greek Tax Identification Number medium-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Greek Tax Identification Number Validation Check Computes Greek Tax Identification Number checksum
every Greek Tax Identification Number must pass.

Greek Tax Identification Number narrow breadth

The narrow breadth detects a 9-digit number that passes checksum validation. It also requires
the presence of AFM-related keywords.

Table 37-272 Greek Tax Identification Number narrow-breadth pattern

Pattern

\d{9}
 Library of system data identifiers 916
Hong Kong ID

Table 37-273 Greek Tax Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Greek Tax Identification Number Validation Check Computes Greek Tax Identification Number checksum
every Greek Tax Identification Number must pass.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

AFM, TIN, tax ID No., Tax id no, tax identification

number, tax id no., Tax Registry Number, Tax Registry
No., AFM#, TIN#, Tax Identification Number, TaxIDNo#,
taxregistryno#

Αριθμός Φορολογικού Μητρώου, AΦΜ, AΦΜ αριθμός,

Φορολογικού Μητρώου Νο., τον αριθμό φορολογικού
μητρώου

Hong Kong ID
The Hong Kong ID is the unique identifier for all residents of Hong Kong and appears on the
Hong Kong Identity Card.
The Hong Kong ID data identifier detects the presence of Hong Kong IDs.
The Hong Kong ID data identifier provides two breadths of detection:
■ The wide breadth detects eight characters in the form LDDDDDD(D) or LDDDDDD(A). The
last character in the detected string is used to validate a checksum.
See “Hong Kong ID wide breadth” on page 916.
■ The narrow breadth detects eight characters in the form LDDDDDD(D) or LDDDDDD(A).
The last character in the detected string is used to validate a checksum. It also requires
the presence of Hong Kong ID-related keywords.
See “Hong Kong ID narrow breadth” on page 917.

Hong Kong ID wide breadth

The wide breadth detects eight characters in the form LDDDDDD(D) or LDDDDDD(A). The
last character in the detected string is used to validate a checksum.
 Library of system data identifiers 917
Hong Kong ID

Table 37-274 Hong Kong ID wide-breadth patterns

Patterns

\w\d{6}(\d)

U\w\d{6}(\d)

\w{2}\d{6}(\d)

\w\d{6}(A)

U\w\d{6}(A)

\w{2}\d{6}(A)

Table 37-275 Hong Kong ID wide-breadth validator

Mandatory validator Description

Hong Kong ID Computes the checksum and validates the pattern against it.

Hong Kong ID narrow breadth

The narrow breadth detects eight characters in the form LDDDDDD(D) or LDDDDDD(A). The
last character in the detected string is used to validate a checksum. It also requires the presence
of Hong Kong ID-related keywords.

Table 37-276 Hong Kong ID narrow-breadth patterns

Patterns

\w\d{6}(\d)

U\w\d{6}(\d)

\w{2}\d{6}(\d)

\w\d{6}(A)

U\w\d{6}(A)

\w{2}\d{6}(A)
 Library of system data identifiers 918
Hungarian Social Security Number

Table 37-277 Hong Kong ID narrow-breadth validators

Mandatory validator Description

Hong Kong ID Computes the checksum and validates the pattern against
it.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

身份證,三顆星, Identity card, Hong Kong permanent

resident ID Card, HKID

Hungarian Social Security Number

The Hungarian Social Security Number (TAJ) is a unique identifier issued by the Hungarian
government.
The Hungarian Social Security Number system data identifier provides three breadths of
detection:
■ The wide breadth detects a 9-digit number without checksum validation.
See “Hungarian Social Security Number wide breadth” on page 918.
■ The medium breadth detects a 9-digit number with checksum validation.
See “Hungarian Social Security Number medium breadth” on page 919.
■ The narrow breadth detects a 9-digit number that passes checksum validation. It also
requires TAJ-related keywords.
See “Hungarian Social Security Number narrow breadth” on page 919.

Hungarian Social Security Number wide breadth

The wide breadth detects a 9-digit number without checksum validation.

Table 37-278 Hungarian Social Security Number wide-breadth pattern

Pattern

\d{9}
 Library of system data identifiers 919
Hungarian Social Security Number

Table 37-279 Hungarian Social Security Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Hungarian Social Security Number medium breadth

The medium breadth detects a 9-digit number with checksum validation.

Table 37-280 Hungarian Social Security Number medium-breadth pattern

Pattern

\d{9}

Table 37-281 Hungarian Social Security Number medium-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Hungarian Social Security Validation Check Computes the checksum and validates the pattern against
it.

Hungarian Social Security Number narrow breadth

The narrow breadth detects a 9-digit number that passes checksum validation. It also requires
TAJ-related keywords.

Table 37-282 Hungarian Social Security Number narrow-breadth pattern

Pattern

\d{9}

Table 37-283 Hungarian Social Security Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Hungarian Social Security Validation Check Computes the checksum and validates the pattern against
it.
 Library of system data identifiers 920
Hungarian Tax Identification Number

Table 37-283 Hungarian Social Security Number narrow-breadth validators (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Hungarian social security number, social security

number, socialsecuritynumber#, hssn#, HSSN#,
socialsecuritynno, HSSN, TAJ, TAJ#, SSN, SSN#,
social security no

ÁFA, Közösségi adószám, Általános forgalmi adó

szám, hozzáadottérték adó, ÁFA szám, magyar ÁFA
szám

Hungarian Tax Identification Number

The Hungarian Tax Identification Number is a 10-digit number that always begins with the digit
"8."
The Hungarian Tax Identification Number system data identifier provides three breadths of
detection:
■ The wide breadth detects a 10-digit number beginning with the digit "8" without checksum
validation.
See “Hungarian Tax Identification Number wide breadth” on page 920.
■ The medium breadth detects a 10-digit number beginning with the digit "8" with checksum
validation.
See “Hungarian Tax Identification Number medium breadth” on page 921.
■ The narrow breadth detects a 10-digit number beginning with the digit "8" that passes
checksum validation. It also requires the presence of Hungarian Tax Identification
Number-related keywords.
See “Hungarian Tax Identification Number narrow breadth” on page 921.

Hungarian Tax Identification Number wide breadth

The wide breadth detects a 10-digit number beginning with the digit "8" without checksum
validation.
 Library of system data identifiers 921
Hungarian Tax Identification Number

Table 37-284 Hungarian Tax Identification Number wide-breadth pattern

Pattern

[8]\d{9}

Table 37-285 Hungarian Tax Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Hungarian Tax Identification Number medium breadth

The medium breadth detects a 10-digit number beginning with the digit "8" with checksum
validation.

Table 37-286 Hungarian Tax Identification Number medium breadth-pattern

Pattern

[8]\d{9}

Table 37-287 Hungarian Tax Identification Number medium-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Hungarian Tax Identification Number Validation Check Computes the checksum and validates the pattern against
it.

Hungarian Tax Identification Number narrow breadth

The narrow breadth detects a 10-digit number beginning with the digit "8" that passes checksum
validation. It also requires the presence of Hungarian Tax Identification Number-related
keywords.

Table 37-288 Hungarian Tax Identification Number narrow breadth-pattern

Pattern

[8]\d{9}
 Library of system data identifiers 922
Hungarian VAT Number

Table 37-289 Hungarian Tax Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Hungarian Tax Identification Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Hungarian tax identification number, Hungarian TIN,

tax ID number, VAT number, tax authority no, tax ID
tax identity number, taxidnumber#, tin#, TIN#,
Hungatiantin#, tax identification no, taxIDno#,
adóazonosító szám, adószám, adóhatóság szám

Hungarian VAT Number

All Hungarian businesses (including non-profit organizations) upon registration at the court of
Registry are granted a value-added tax (VAT) number.
The Hungarian VAT Number system data identifier provides three breadths of detection:
■ The wide breadth detects an 8-digit number beginning with the letters "HU/hu" without
checksum validation.
See “Hungarian VAT Number wide breadth” on page 922.
■ The medium breadth detects an 8-digit number beginning with the letters "HU/hu" with
checksum validation.
See “Hungarian VAT Number medium breadth” on page 923.
■ The narrow breadth detects an 8-digit number beginning with the letters "HU/hu" that passes
checksum validation. It also requires the presence of Hungarian VAT Number-related
keywords.
See “Hungarian VAT Number narrow breadth” on page 923.

Hungarian VAT Number wide breadth

The wide breadth detects an 8-digit number beginning with the letters "HU/hu" without checksum
validation.
 Library of system data identifiers 923
Hungarian VAT Number

Table 37-290 Hungarian VAT Number wide-breadth pattern

Pattern

HU\d{8}

hu\d{8}

Table 37-291 Hungarian VAT Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Hungarian VAT Number medium breadth

The medium breadth detects an 8-digit number beginning with the letters "HU/hu" with checksum
validation.

Table 37-292 Hungarian VAT Number medium-breadth pattern

Pattern

HU\d{8}

hu\d{8}

Table 37-293 Hungarian VAT Number medium-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Hungarian VAT Number Validation Check Computes the checksum and validates the pattern against
it.

Hungarian VAT Number narrow breadth

The narrow breadth detects an 8-digit number beginning with the letters "HU/hu" that passes
checksum validation. It also requires the presence of Hungarian VAT Number-related keywords.

Table 37-294 Hungarian VAT Number narrow-breadth pattern

Pattern

HU\d{8}

hu\d{8}
 Library of system data identifiers 924
IBAN Central

Table 37-295 Hungarian VAT Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Hungarian VAT Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

VAT, VAT No., Value Added Tax Number, vat#, vatno#,

hungarianvatno#, tax no., VAT number, value added
tax

ÁFA, Közösségi adószám, Általános forgalmi adó

szám, hozzáadottérték adó, ÁFA szám, magyar ÁFA
szám

IBAN Central
The International Bank Account Number (IBAN) is an international standard for identifying
bank accounts across national borders.
The IBAN Central data identifier detects IBAN numbers for Andorra, Austria, Belgium, Germany,
Italy, Liechtenstein, Luxembourg, Malta, Monaco, San Marino, and Switzerland.
The IBAN West data identifier provides two breadths of detection:
■ The wide breadth detects a country-specific IBAN number that passes a checksum.
See “IBAN Central wide breadth” on page 925.
■ The narrow breadth detects a country-specific IBAN number that passes a checksum. It
also requires the presence of IBAN-related keywords.
See “IBAN Central narrow breadth” on page 926.

Note: Do not add the NIB validation to any IBAN data identifiers that apply to DLP Agents. The
NIB validator is only for use with server-side detection.
 Library of system data identifiers 925
IBAN Central

IBAN Central wide breadth

The wide breadth detects a country-specific IBAN number that passes a checksum. IBAN
numbers can include space delimiters, dash delimiters, or no delimiters.

Table 37-296 IBAN Central wide-breadth patterns

Pattern Description

AD\d{2}\d{4}\d{4}\w{4}\w{4}\w{4} Andorra patterns

AD\d{2} \d{4} \d{4} \w{4} \w{4} \w{4}

AD\d{2}-\d{4}-\d{4}-\w{4}-\w{4}-\w{4}

AT\d{2}\d{4}\d{4}\d{4}\d{4} Austria patterns

AT\d{2} \d{4} \d{4} \d{4} \d{4}

AT\d{2}-\d{4}-\d{4}-\d{4}-\d{4}

BE\d{2}\d{4}\d{4}\d{4} Belgium patterns

BE\d{2} \d{4} \d{4} \d{4}

BE\d{2}-\d{4}-\d{4}-\d{4}

CH\d{2}\d{4}\d\w{3}\w{4}\w{4}\w Switzerland patterns

CH\d{2} \d{4} \d\w{3} \w{4} \w{4} \w

CH\d{2}-\d{4}-\d\w{3}-\w{4}-\w{4}-\w

DE\d{2}\d{4}\d{4}\d{4}\d{4}\d{2} Germany patterns

DE\d{2} \d{4} \d{4} \d{4} \d{4} \d{2}

DE\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{2}

IT\d{2}[A-Z]\d{3}\d{4}\d{3}\w\w{4}\w{4}\w{3} Italy patterns

IT\d{2} [A-Z]\d{3} \d{4} \d{3}\w \w{4}

\w{4} \w{3}

IT\d{2}-[A-Z]\d{3}-\d{4}-\d{3}\w-\w{4}-\w{4}-\w{3}

LI\d{2}\d{4}\d\w{3}\w{4}\w{4}\w Liechtenstein patterns

LI\d{2} \d{4} \d\w{3} \w{4} \w{4} \w

LI\d{2}-\d{4}-\d\w{3}-\w{4}-\w{4}-\w

LU\d{2}\d{3}\w\w{4}\w{4}\w{4} Luxembourg patterns

LU\d{2} \d{3}\w \w{4} \w{4} \w{4}

LU\d{2}-\d{3}\w-\w{4}-\w{4}-\w{4}
 Library of system data identifiers 926
IBAN Central

Table 37-296 IBAN Central wide-breadth patterns (continued)

Pattern Description

MC\d{2}\d{4}\d{4}\d{2}\w{2}\w{4}\w{4}\w\d{2} Monaco patterns

MC\d{2} \d{4} \d{4} \d{2}\w{2} \w{4} \w{4}

\w\d{2}

MC\d{2}-\d{4}-\d{4}-\d{2}\w{2}-\w{4}-\w{4}-\w\d{2}

MT\d{2}[A-Z]{4}\d{4}\d\w{3}\w{4}\w{4}\w{4}\w{3} Malta

MT\d{2} [A-Z]{4} \d{4} \d\w{3} \w{4} \w{4}

\w{4} \w{3}

MT\d{2}-[A-Z]{4}-\d{4}-\d\w{3}-\w{4}-\w{4}-\w{4}-\w{3}

SM\d{2}[A-Z]\d{3}\d{4}\d{3}\w\w{4}\w{4}\w{3} San Marino patterns

SM\d{2} [A-Z]\d{3} \d{4} \d{3}\w \w{4}

\w{4} \w{3}

SM\d{2}-[A-Z]\d{3}-\d{4}-\d{3}\w-\w{4}-\w{4}-\w{3}

Table 37-297 IBAN Central wide-breadth validator

Validator Description

Mod 97 Validator Computes the ISO 7064 Mod 97-10 checksum of the
complete match.

IBAN Central narrow breadth

The narrow breadth detects a country-specific IBAN number that passes a checksum. It also
requires the presence of IBAN-related keywords.

Table 37-298 IBAN Central narrow-breadth patterns

Pattern Description

AD\d{2}\d{4}\d{4}\w{4}\w{4}\w{4} Andorra patterns

AD\d{2} \d{4} \d{4} \w{4} \w{4} \w{4}

AD\d{2}-\d{4}-\d{4}-\w{4}-\w{4}-\w{4}

AT\d{2}\d{4}\d{4}\d{4}\d{4} Austria patterns

AT\d{2} \d{4} \d{4} \d{4} \d{4}

AT\d{2}-\d{4}-\d{4}-\d{4}-\d{4}
 Library of system data identifiers 927
IBAN Central

Table 37-298 IBAN Central narrow-breadth patterns (continued)

Pattern Description

BE\d{2}\d{4}\d{4}\d{4} Belgium patterns

BE\d{2} \d{4} \d{4} \d{4}

BE\d{2}-\d{4}-\d{4}-\d{4}

CH\d{2}\d{4}\d\w{3}\w{4}\w{4}\w Switzerland patterns

CH\d{2} \d{4} \d\w{3} \w{4} \w{4} \w

CH\d{2}-\d{4}-\d\w{3}-\w{4}-\w{4}-\w

DE\d{2}\d{4}\d{4}\d{4}\d{4}\d{2} Germany patterns

DE\d{2} \d{4} \d{4} \d{4} \d{4} \d{2}

DE\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{2}

IT\d{2}[A-Z]\d{3}\d{4}\d{3}\w\w{4}\w{4}\w{3} Italy patterns

IT\d{2} [A-Z]\d{3} \d{4} \d{3}\w \w{4}

\w{4} \w{3}

IT\d{2}-[A-Z]\d{3}-\d{4}-\d{3}\w-\w{4}-\w{4}-\w{3}

LI\d{2}\d{4}\d\w{3}\w{4}\w{4}\w Liechtenstein patterns

LI\d{2} \d{4} \d\w{3} \w{4} \w{4} \w

LI\d{2}-\d{4}-\d\w{3}-\w{4}-\w{4}-\w

LU\d{2}\d{3}\w\w{4}\w{4}\w{4} Luxembourg patterns

LU\d{2} \d{3}\w \w{4} \w{4} \w{4}

LU\d{2}-\d{3}\w-\w{4}-\w{4}-\w{4}

MC\d{2}\d{4}\d{4}\d{2}\w{2}\w{4}\w{4}\w\d{2} Monaco patterns

MC\d{2} \d{4} \d{4} \d{2}\w{2} \w{4} \w{4}

\w\d{2}

MC\d{2}-\d{4}-\d{4}-\d{2}\w{2}-\w{4}-\w{4}-\w\d{2}

MT\d{2}[A-Z]{4}\d{4}\d\w{3}\w{4}\w{4}\w{4}\w{3} Malta

MT\d{2} [A-Z]{4} \d{4} \d\w{3} \w{4} \w{4}

\w{4} \w{3}

MT\d{2}-[A-Z]{4}-\d{4}-\d\w{3}-\w{4}-\w{4}-\w{4}-\w{3}
 Library of system data identifiers 928
IBAN East

Table 37-298 IBAN Central narrow-breadth patterns (continued)

Pattern Description

SM\d{2}[A-Z]\d{3}\d{4}\d{3}\w\w{4}\w{4}\w{3} San Marino patterns

SM\d{2} [A-Z]\d{3} \d{4} \d{3}\w \w{4}

\w{4} \w{3}

SM\d{2}-[A-Z]\d{3}-\d{4}-\d{3}\w-\w{4}-\w{4}-\w{3}

Table 37-299 IBAN Central narrow-breadth validators

Validator Description

Mod 97 Validator Computes the ISO 7064 Mod 97-10 checksum of the
complete match.

Find keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

Code IBAN, numéro IBAN, IBAN Code, IBAN number

IBAN East
The International Bank Account Number (IBAN) is an international standard for identifying
bank accounts across national borders.
The IBAN East data identifier detects IBAN numbers for Bosnia, Bulgaria, Croatia, Cyprus,
Czech Republic, Estonia, Greece, Hungary, Israel, Latvia, Lithuania, Macedonia, Montenegro,
Poland, Romania, Serbia, Slovakia, Slovenia, Turkey, and Tunisia.
The IBAN West data identifier provides two breadths of detection:
■ The wide breadth detects a country-specific IBAN number that passes a checksum.
See “IBAN East wide breadth” on page 929.
■ The narrow breadth detects a country-specific IBAN number that passes a checksum. It
also requires the presence of IBAN-related keywords.
See “IBAN East narrow-breadth” on page 931.

Note: Do not add the NIB validation to any IBAN data identifiers that apply to DLP Agents. The
NIB validator is only for use with server-side detection.
 Library of system data identifiers 929
IBAN East

IBAN East wide breadth

The wide breadth detects a country-specific IBAN number that passes a checksum. IBAN
numbers can include space delimiters, dash delimiters, or no delimiters.

Table 37-300 IBAN East wide-breadth patterns

Pattern Description

BA\d{2}\d{4}\d{4}\d{4}\d{4} Bosnia patterns

BA\d{2} \d{4} \d{4} \d{4} \d{4}

BA\d{2}-\d{4}-\d{4}-\d{4}-\d{4}

BG\d{2}[A-Z]{4}\d{4}\d{2}\w{2}\w{4}\w{2} Bulgaria patterns

BG\d{2} [A-Z]{4} \d{4} \d{2}\w{2} \w{4}

\w{2}

BG\d{2}-[A-Z]{4}-\d{4}-\d{2}\w{2}-\w{4}-\w{2}

CY\d{2}\d{4}\d{4}\w{4}\w{4}\w{4}\w{4} Cyprus patterns

CY\d{2} \d{4} \d{4} \w{4} \w{4} \w{4} \w{4}

CY\d{2}-\d{4}-\d{4}-\w{4}-\w{4}-\w{4}-\w{4}

CZ\d{2}\d{4}\d{4}\d{4}\d{4}\d{4} Czech Republic patterns

CZ\d{2} \d{4} \d{4} \d{4} \d{4} \d{4}

CZ\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}

EE\d{2}\d{4}\d{4}\d{4}\d{4} Estonia patterns

EE\d{2} \d{4} \d{4} \d{4} \d{4}

EE\d{2}-\d{4}-\d{4}-\d{4}-\d{4}

GR\d{2}\d{4}\d{3}\w\w{4}\w{4}\w{4}\w{3} Greece patterns

GR\d{2} \d{4} \d{3}\w \w{4} \w{4} \w{4}

\w{3}

GR\d{2}-\d{4}-\d{3}\w-\w{4}-\w{4}-\w{4}-\w{3}

HR\d{2}\d{4}\d{4}\d{4}\d{4}\d Croatia patterns

HR\d{2} \d{4} \d{4} \d{4} \d{4} \d

HR\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d
 Library of system data identifiers 930
IBAN East

Table 37-300 IBAN East wide-breadth patterns (continued)

Pattern Description

HU\d{2}\d{4}\d{4}\d{4}\d{4}\d{4}\d{4} Hungary patterns

HU\d{2} \d{4} \d{4} \d{4} \d{4} \d{4} \d{4}

HU\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}

IL\d{2}\d{4}\d{4}\d{4}\d{4}\d{3} Israel patterns

IL\d{2} \d{4} \d{4} \d{4} \d{4} \d{3}

IL\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{3}

LT\d{2}\d{4}\d{4}\d{4}\d{4} Lithuania patterns

LT\d{2} \d{4} \d{4} \d{4} \d{4}

LT\d{2}-\d{4}-\d{4}-\d{4}-\d{4}

LV\d{2}[A-Z]{4}\w{4}\w{4}\w{4}\w Latvia patterns

LV\d{2} [A-Z]{4} \w{4} \w{4} \w{4} \w

LV\d{2}-[A-Z]{4}-\w{4}-\w{4}-\w{4}-\w

ME\d{2}\d{4}\d{4}\d{4}\d{4}\d{2} Montenegro patterns

ME\d{2} \d{4} \d{4} \d{4} \d{4} \d{2}

ME\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{2}

MK\d{2}\d{3}\w\w{4}\w{4}\w\d{2} Macedonia patterns

MK\d{2} \d{3}\w \w{4} \w{4} \w\d{2}

MK\d{2}-\d{3}\w-\w{4}-\w{4}-\w\d{2}

PL\d{2}\d{4}\d{4}\d{4}\d{4}\d{4}\d{4} Poland patterns

PL\d{2} \d{4} \d{4} \d{4} \d{4} \d{4} \d{4}

PL\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}

RO\d{2}[A-Z]{4}\w{4}\w{4}\w{4}\w{4} Romania patterns

RO\d{2} [A-Z]{4} \w{4} \w{4} \w{4} \w{4}

RO\d{2}-[A-Z]{4}-\w{4}-\w{4}-\w{4}-\w{4}

RS\d{2}\d{4}\d{4}\d{4}\d{4}\d{2} Serbia patterns

RS\d{2} \d{4} \d{4} \d{4} \d{4} \d{2}

RS\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{2}
 Library of system data identifiers 931
IBAN East

Table 37-300 IBAN East wide-breadth patterns (continued)

Pattern Description

SI\d{2}\d{4}\d{4}\d{4}\d{3} Slovenia patterns

SI\d{2} \d{4} \d{4} \d{4} \d{3}

SI\d{2}-\d{4}-\d{4}-\d{4}-\d{3}

SK\d{2}\d{4}\d{4}\d{4}\d{4}\d{4} Slovak Republic patterns

SK\d{2} \d{4} \d{4} \d{4} \d{4} \d{4}

SK\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}

TN59\d{4}\d{4}\d{4}\d{4}\d{4} Tunisia patterns

TN59 \d{4} \d{4} \d{4} \d{4} \d{4}

TN59-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}

TR\d{2}\d{4}\d\w{3}\w{4}\w{4}\w{4}\w{2} Turkey patterns

TR\d{2} \d{4} \d\w{3} \w{4} \w{4} \w{4}

\w{2}

TR\d{2}-\d{4}-\d\w{3}-\w{4}-\w{4}-\w{4}-\w{2}

Table 37-301 IBAN East wide-breadth validator

Validator Description

Mod 97 Validator Computes the ISO 7064 Mod 97-10 checksum of the
complete match.

IBAN East narrow-breadth

The narrow breadth detects a country-specific IBAN number that passes a checksum. It also
requires the presence of IBAN-related keywords.

Table 37-302 IBAN East narrow-breadth patterns

Pattern Description

BA\d{2}\d{4}\d{4}\d{4}\d{4} Bosnia patterns

BA\d{2} \d{4} \d{4} \d{4} \d{4}

BA\d{2}-\d{4}-\d{4}-\d{4}-\d{4}
 Library of system data identifiers 932
IBAN East

Table 37-302 IBAN East narrow-breadth patterns (continued)

Pattern Description

BG\d{2}[A-Z]{4}\d{4}\d{2}\w{2}\w{4}\w{2} Bulgaria patterns

BG\d{2} [A-Z]{4} \d{4} \d{2}\w{2} \w{4}

\w{2}

BG\d{2}-[A-Z]{4}-\d{4}-\d{2}\w{2}-\w{4}-\w{2}

CY\d{2}\d{4}\d{4}\w{4}\w{4}\w{4}\w{4} Cyprus patterns

CY\d{2} \d{4} \d{4} \w{4} \w{4} \w{4} \w{4}

CY\d{2}-\d{4}-\d{4}-\w{4}-\w{4}-\w{4}-\w{4}

CZ\d{2}\d{4}\d{4}\d{4}\d{4}\d{4} Czech Republic patterns

CZ\d{2} \d{4} \d{4} \d{4} \d{4} \d{4}

CZ\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}

EE\d{2}\d{4}\d{4}\d{4}\d{4} Estonia patterns

EE\d{2} \d{4} \d{4} \d{4} \d{4}

EE\d{2}-\d{4}-\d{4}-\d{4}-\d{4}

GR\d{2}\d{4}\d{3}\w\w{4}\w{4}\w{4}\w{3} Greece patterns

GR\d{2} \d{4} \d{3}\w \w{4} \w{4} \w{4}

\w{3}

GR\d{2}-\d{4}-\d{3}\w-\w{4}-\w{4}-\w{4}-\w{3}

HR\d{2}\d{4}\d{4}\d{4}\d{4}\d Croatia patterns

HR\d{2} \d{4} \d{4} \d{4} \d{4} \d

HR\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d

HU\d{2}\d{4}\d{4}\d{4}\d{4}\d{4}\d{4} Hungary patterns

HU\d{2} \d{4} \d{4} \d{4} \d{4} \d{4} \d{4}

HU\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}

IL\d{2}\d{4}\d{4}\d{4}\d{4}\d{3} Israel patterns

IL\d{2} \d{4} \d{4} \d{4} \d{4} \d{3}

IL\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{3}
 Library of system data identifiers 933
IBAN East

Table 37-302 IBAN East narrow-breadth patterns (continued)

Pattern Description

LT\d{2}\d{4}\d{4}\d{4}\d{4} Lithuania patterns

LT\d{2} \d{4} \d{4} \d{4} \d{4}

LT\d{2}-\d{4}-\d{4}-\d{4}-\d{4}

LV\d{2}[A-Z]{4}\w{4}\w{4}\w{4}\w Latvia patterns

LV\d{2} [A-Z]{4} \w{4} \w{4} \w{4} \w

LV\d{2}-[A-Z]{4}-\w{4}-\w{4}-\w{4}-\w

ME\d{2}\d{4}\d{4}\d{4}\d{4}\d{2} Montenegro patterns

ME\d{2} \d{4} \d{4} \d{4} \d{4} \d{2}

ME\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{2}

MK\d{2}\d{3}\w\w{4}\w{4}\w\d{2} Macedonia patterns

MK\d{2} \d{3}\w \w{4} \w{4} \w\d{2}

MK\d{2}-\d{3}\w-\w{4}-\w{4}-\w\d{2}

PL\d{2}\d{4}\d{4}\d{4}\d{4}\d{4}\d{4} Poland patterns

PL\d{2} \d{4} \d{4} \d{4} \d{4} \d{4} \d{4}

PL\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}

RO\d{2}[A-Z]{4}\w{4}\w{4}\w{4}\w{4} Romania patterns

RO\d{2} [A-Z]{4} \w{4} \w{4} \w{4} \w{4}

RO\d{2}-[A-Z]{4}-\w{4}-\w{4}-\w{4}-\w{4}

RS\d{2}\d{4}\d{4}\d{4}\d{4}\d{2} Serbia patterns

RS\d{2} \d{4} \d{4} \d{4} \d{4} \d{2}

RS\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{2}

SI\d{2}\d{4}\d{4}\d{4}\d{3} Slovenia patterns

SI\d{2} \d{4} \d{4} \d{4} \d{3}

SI\d{2}-\d{4}-\d{4}-\d{4}-\d{3}

SK\d{2}\d{4}\d{4}\d{4}\d{4}\d{4} Slovak Republic patterns

SK\d{2} \d{4} \d{4} \d{4} \d{4} \d{4}

SK\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}
 Library of system data identifiers 934
IBAN West

Table 37-302 IBAN East narrow-breadth patterns (continued)

Pattern Description

TN59\d{4}\d{4}\d{4}\d{4}\d{4} Tunisia patterns

TN59 \d{4} \d{4} \d{4} \d{4} \d{4}

TN59-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}

TR\d{2}\d{4}\d\w{3}\w{4}\w{4}\w{4}\w{2} Turkey patterns

TR\d{2} \d{4} \d\w{3} \w{4} \w{4} \w{4}

\w{2}

TR\d{2}-\d{4}-\d\w{3}-\w{4}-\w{4}-\w{4}-\w{2}

Table 37-303 IBAN East narrow-breadth validators

Validator Description

Mod 97 Validator Computes the ISO 7064 Mod 97-10 checksum of the
complete match.

Find keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

Code IBAN, numéro IBAN, IBAN Code, IBAN number

IBAN West
The International Bank Account Number (IBAN) is an international standard for identifying
bank accounts across national borders.
The IBAN West data identifier detects IBAN numbers for Denmark, Faroe Islands, Finland,
France, Gibraltar, Greenland, Iceland, Ireland, Netherlands, Norway, Portugal, Spain, Sweden,
and the United Kingdom.
The IBAN West data identifier provides two breadths of detection:
■ The wide breadth detects a country-specific IBAN number that passes a checksum.
See “IBAN West wide breadth” on page 935.
■ The narrow breadth detects a country-specific IBAN number that passes a checksum. It
also requires the presence of IBAN-related keywords.
See “IBAN West narrow-breadth” on page 937.
 Library of system data identifiers 935
IBAN West

Note: Do not add the NIB validation to any IBAN data identifiers that apply to DLP Agents. The
NIB validator is only for use with server-side detection.

IBAN West wide breadth

The wide breadth detects a country-specific IBAN number that passes a checksum. IBAN
numbers can include space delimiters, dash delimiters, or no delimiters.

Table 37-304 IBAN West wide-breadth patterns

Pattern Description

DK\d{2}\d{4}\d{4}\d{4}\d{2} Denmark patterns

DK\d{2} \d{4} \d{4} \d{4} \d{2}

DK\d{2}-\d{4}-\d{4}-\d{4}-\d{2}

ES\d{2}\d{4}\d{4}\d{4}\d{4}\d{4} Spain patterns

ES\d{2} \d{4} \d{4} \d{4} \d{4} \d{4}

ES\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}

FI\d{2}\d{4}\d{4}\d{4}\d{2} Finland patterns

FI\d{2} \d{4} \d{4} \d{4} \d{2}

FI\d{2}-\d{4}-\d{4}-\d{4}-\d{2}

FO\d{2}\d{4}\d{4}\d{4}\d{2} Faroe Islands patterns

FO\d{2} \d{4} \d{4} \d{4} \d{2}

FO\d{2}-\d{4}-\d{4}-\d{4}-\d{2}

FR\d{2}\d{4}\d{4}\d{2}\w{2}\w{4}\w{4}\w\d{2} France patterns

FR\d{2} \d{4} \d{4} \d{2}\w{2} \w{4} \w{4}

\w\d{2}

FR\d{2}-\d{4}-\d{4}-\d{2}\w{2}-\w{4}-\w{4}-\w\d{2}

GB\d{2}[A-Z]{4}\d{4}\d{4}\d{4}\d{2} United Kingdom

GB\d{2} [A-Z]{4} \d{4} \d{4} \d{4} \d{2}

GB\d{2}-[A-Z]{4}-\d{4}-\d{4}-\d{4}-\d{2}

GI\d{2}[A-Z]{4}\w{4}\w{4}\w{4}\w{3} Gibraltar patterns

GI\d{2} [A-Z]{4} \w{4} \w{4} \w{4} \w{3}

GI\d{2}-[A-Z]{4}-\w{4}-\w{4}-\w{4}-\w{3}
 Library of system data identifiers 936
IBAN West

Table 37-304 IBAN West wide-breadth patterns (continued)

Pattern Description

GL\d{2}\d{4}\d{4}\d{4}\d{2} Greenland patterns

GL\d{2} \d{4} \d{4} \d{4} \d{2}

GL\d{2}-\d{4}-\d{4}-\d{4}-\d{2}

IE\d{2}[A-Z]{4}\d{4}\d{4}\d{4}\d{2} Ireland patterns

IE\d{2} [A-Z]{4} \d{4} \d{4} \d{4} \d{2}

IE\d{2}-[A-Z]{4}-\d{4}-\d{4}-\d{4}-\d{2}

IS\d{2}\d{4}\d{4}\d{4}\d{4}\d{4}\d{2} Iceland patterns

IS\d{2} \d{4} \d{4} \d{4} \d{4} \d{4} \d{2}

IS\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}-\d{2}

NL\d{2}[A-Z]{4}\d{4}\d{4}\d{2} Netherlands patterns

NL\d{2} [A-Z]{4} \d{4} \d{4} \d{2}

NL\d{2}-[A-Z]{4}-\d{4}-\d{4}-\d{2}

NO\d{2}\d{4}\d{4}\d{3} Montenegro patterns

NO\d{2} \d{4} \d{4} \d{3}

NO\d{2}-\d{4}-\d{4}-\d{3}

PT\d{2}\d{4}\d{4}\d{4}\d{4}\d{4}\d Portugal patterns

PT\d{2} \d{4} \d{4} \d{4} \d{4} \d{4} \d

PT\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}-\d

SE\d{2}\d{4}\d{4}\d{4}\d{4}\d{4} Sweden patterns

SE\d{2} \d{4} \d{4} \d{4} \d{4} \d{4}

SE\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}

Table 37-305 IBAN West wide-breadth validator

Validator Description

Mod 97 Validator Computes the ISO 7064 Mod 97-10 checksum of the
complete match.
 Library of system data identifiers 937
IBAN West

IBAN West narrow-breadth

The narrow breadth detects a country-specific IBAN number that passes a checksum. It also
requires the presence of IBAN-related keywords.

Table 37-306 IBAN West narrow-breadth patterns

Pattern Description

DK\d{2}\d{4}\d{4}\d{4}\d{2} Denmark patterns

DK\d{2} \d{4} \d{4} \d{4} \d{2}

DK\d{2}-\d{4}-\d{4}-\d{4}-\d{2}

ES\d{2}\d{4}\d{4}\d{4}\d{4}\d{4} Spain patterns

ES\d{2} \d{4} \d{4} \d{4} \d{4} \d{4}

ES\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}

FI\d{2}\d{4}\d{4}\d{4}\d{2} Finland patterns

FI\d{2} \d{4} \d{4} \d{4} \d{2}

FI\d{2}-\d{4}-\d{4}-\d{4}-\d{2}

FO\d{2}\d{4}\d{4}\d{4}\d{2} Faroe Islands patterns

FO\d{2} \d{4} \d{4} \d{4} \d{2}

FO\d{2}-\d{4}-\d{4}-\d{4}-\d{2}

FR\d{2}\d{4}\d{4}\d{2}\w{2}\w{4}\w{4}\w\d{2} France patterns

FR\d{2} \d{4} \d{4} \d{2}\w{2} \w{4} \w{4}

\w\d{2}

FR\d{2}-\d{4}-\d{4}-\d{2}\w{2}-\w{4}-\w{4}-\w\d{2}

GB\d{2}[A-Z]{4}\d{4}\d{4}\d{4}\d{2} United Kingdom

GB\d{2} [A-Z]{4} \d{4} \d{4} \d{4} \d{2}

GB\d{2}-[A-Z]{4}-\d{4}-\d{4}-\d{4}-\d{2}

GI\d{2}[A-Z]{4}\w{4}\w{4}\w{4}\w{3} Gibraltar patterns

GI\d{2} [A-Z]{4} \w{4} \w{4} \w{4} \w{3}

GI\d{2}-[A-Z]{4}-\w{4}-\w{4}-\w{4}-\w{3}

GL\d{2}\d{4}\d{4}\d{4}\d{2} Greenland patterns

GL\d{2} \d{4} \d{4} \d{4} \d{2}

GL\d{2}-\d{4}-\d{4}-\d{4}-\d{2}
 Library of system data identifiers 938
IBAN West

Table 37-306 IBAN West narrow-breadth patterns (continued)

Pattern Description

IE\d{2}[A-Z]{4}\d{4}\d{4}\d{4}\d{2} Ireland patterns

IE\d{2} [A-Z]{4} \d{4} \d{4} \d{4} \d{2}

IE\d{2}-[A-Z]{4}-\d{4}-\d{4}-\d{4}-\d{2}

IS\d{2}\d{4}\d{4}\d{4}\d{4}\d{4}\d{2} Iceland patterns

IS\d{2} \d{4} \d{4} \d{4} \d{4} \d{4} \d{2}

IS\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}-\d{2}

NL\d{2}[A-Z]{4}\d{4}\d{4}\d{2} Netherlands patterns

NL\d{2} [A-Z]{4} \d{4} \d{4} \d{2}

NL\d{2}-[A-Z]{4}-\d{4}-\d{4}-\d{2}

NO\d{2}\d{4}\d{4}\d{3} Montenegro patterns

NO\d{2} \d{4} \d{4} \d{3}

NO\d{2}-\d{4}-\d{4}-\d{3}

PT\d{2}\d{4}\d{4}\d{4}\d{4}\d{4}\d Portugal patterns

PT\d{2} \d{4} \d{4} \d{4} \d{4} \d{4} \d

PT\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}-\d

SE\d{2}\d{4}\d{4}\d{4}\d{4}\d{4} Sweden patterns

SE\d{2} \d{4} \d{4} \d{4} \d{4} \d{4}

SE\d{2}-\d{4}-\d{4}-\d{4}-\d{4}-\d{4}

Table 37-307 IBAN West narrow-breadth validators

Validator Description

Mod 97 Validator Computes the ISO 7064 Mod 97-10 checksum of the
complete match.

Find keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

Code IBAN, numéro IBAN, IBAN Code, IBAN number

 Library of system data identifiers 939
Indian Aadhaar Card Number

Indian Aadhaar Card Number

The UIDAI is mandated to assign a 12-digit UID number termed as Aadhaar to all the residents
of India. The Aadhaar number is robust enough to eliminate duplicate and fake identities and
can be verified and authenticated in a cost-effective way online.
The Indian Aadhaar Card Number data identifier provides three breadths of detection:
■ The wide breadth detects a 12-digit number.
See “Indian Aadhaar Card Number wide breadth” on page 939.
■ The medium breadth detects a 12-digit number. It also validates the checksum.
See “Indian Aadhaar Card Number medium breadth” on page 939.
■ The narrow breadth detects a 12-digit number. It also validates the checksum and requires
the presence of related keywords.
See “Indian Aadhaar Card Number narrow breadth” on page 940.

Indian Aadhaar Card Number wide breadth

The wide breadth detects a 12-digit number.

Table 37-308 Indian Aadhaar Card Number wide-breadth patterns

Pattern

[2-9]\d{11}

[2-9]\d{3} \d{4} \d{4}

Table 37-309 Indian Aadhaar Card Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Indian Aadhaar Card Number medium breadth

The medium breadth detects a 12-digit number. It also validates the checksum.

Table 37-310 Indian Aadhaar Card Number medium-breadth patterns

Pattern

[2-9]\d{11}

[2-9]\d{3} \d{4} \d{4}

 Library of system data identifiers 940
Indian Aadhaar Card Number

Table 37-311 Indian Aadhaar Card Number medium-breadth validators

Mandatory validator Description

Exclude ending characters Any number ending with the following characters is
excluded from matching:

333333333333,666666666666,999999999999

Number delimiter Validates a match by checking the surrounding numbers.

Verheoff validation check Computes the checksum and validates the pattern against
it.

Indian Aadhaar Card Number narrow breadth

The narrow breadth detects a 12-digit number. It also validates the checksum and requires
the presence of related keywords.

Table 37-312 Indian Aadhaar Card Number narrow-breadth patterns

Pattern

[2-9]\d{11}

[2-9]\d{3} \d{4} \d{4}

Table 37-313 Indian Aadhaar Card Number narrow-breadth validators

Mandatory validator Description

Exclude ending characters Any number ending with the following characters is
excluded from matching:

333333333333,666666666666,999999999999

Number delimiter Validates a match by checking the surrounding numbers.

Verheoff validation check Computes the checksum and validates the pattern against
it.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

aadhar card no.,uidai,aadhar no.,Aadhar

Number,Aadhar#,Aadhar Card#
 Library of system data identifiers 941
Indian Permanent Account Number

Indian Permanent Account Number

The Indian Permanent Account Number (PAN) is a unique 10-character alphanumeric identifier
issued by the Indian Income Tax Department to an individual.
This data identifier provides two breadths of detection:
■ The wide breadth detects a 10-character alphanumeric identifier without checksum
validation.
See “Indian Permanent Account Number wide breadth” on page 941.
■ The narrow breadth detects a 10-character alphanumeric identifier with checksum validation.
It also requires the presence of PAN-related keywords.
See “Indian Permanent Account Number narrow breadth” on page 941.

Indian Permanent Account Number wide breadth

The wide breadth detects a 10-character alphanumeric identifier without checksum validation.

Table 37-314 Indian Permanent Account Number wide-breadth pattern

Pattern

[A-Za-z]{3}[CPHFATBLJGcphfatbljg][A-Za-z]\d{4}[A-Za-z]

Table 37-315 Indian Permanent Account Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Indian Permanent Account Number narrow breadth

The narrow breadth detects a 10-character alphanumeric identifier with checksum validation.
It also requires the presence of PAN-related keywords.

Table 37-316 Indian Permanent Account Number narrow-breadth pattern

Pattern

[A-Za-z]{3}[CPHFATBLJGcphfatbljg][A-Za-z]\d{4}[A-Za-z]

Table 37-317 Indian Permanent Account Number narrow-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.
 Library of system data identifiers 942
Indonesian Identity Card Number

Table 37-317 Indian Permanent Account Number narrow-breadth validator (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

PAN, permanent account number, pan, pan#, PAN#,

PAN Card Number, pan card no, pancardno#, PAN
card no, pan#, PANID#

Indonesian Identity Card Number

The Indonesian identity card (Kartu Tanda Penduduk, or KTP) number is used as the basis
for issuance of passport, driving license, taxpayer identification number, insurance policy,
certificate of land rights, and identity documents.
The Indonesian Identity Card Number system data identifier provides three breadths of
detection:
■ The wide breadth detects a 16-digit number without checksum validation.
See “Indonesian Identity Card Number wide breadth” on page 942.
■ The medium breadth detects a 16-digit number with checksum validation.
See “Indonesian Identity Card Number medium breadth” on page 943.
■ The narrow breadth detects a 16-digit number that passes checksum validation. It also
requires the presence of Indonesian Identity Card Number-related keywords.
See “Indonesian Identity Card Number narrow breadth” on page 943.

Indonesian Identity Card Number wide breadth

The wide breadth detects a 16-digit number without checksum validation.

Table 37-318 Indonesian Identity Card Number wide-breadth pattern

Pattern

\d{2}[01237]\d{3}[01234567]\d[01]\d{7}

Table 37-319 Indonesian Identity Card Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.
 Library of system data identifiers 943
Indonesian Identity Card Number

Indonesian Identity Card Number medium breadth

The medium breadth detects a 16-digit number with checksum validation.

Table 37-320 Indonesian Identity Card Number medium-breadth pattern

Pattern

\d{2}[01237]\d{3}[01234567]\d[01]\d{7}

Table 37-321 Indonesian Identity Card Number medium-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Indonesian Kartu Tanda Penduduk Validation Check Validator computes the checksum that every Indonesian
Kartu Tanda Penduduk must pass.

Indonesian Identity Card Number narrow breadth

The narrow breadth detects a 16-digit number that passes checksum validation. It also requires
the presence of Indonesian Identity Card Number-related keywords.

Table 37-322 Indonesian Identity Card Number narrow-breadth pattern

Pattern

\d{2}[01237]\d{3}[01234567]\d[01]\d{7}

Table 37-323 Indonesian Identity Card Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Indonesian Kartu Tanda Penduduk Validation Check Validator computes the checksum that every Indonesian
Kartu Tanda Penduduk must pass.
 Library of system data identifiers 944
International Mobile Equipment Identity Number

Table 37-323 Indonesian Identity Card Number narrow-breadth validators (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

identity card number, Indonesian identity card no,

Indonesian identity card number, NIK, KTP, unique ID,
unique identity number, national identification number,
national identity no, identity number

kartu tanda penduduk nomor, nomor Induk

Kependudukan, tanda penduduk nomor, kartu identitas
Indonesia no, kartu identitas Indonesia nomor, nomor
identitas unik

International Mobile Equipment Identity Number

The International Mobile Station Equipment Identity (IMEI) is a unique identifier for 3GPP
(GSM, UMTS, and LTE) and iDEN mobile phones and some satellite phones.
■ The wide breadth detects a 15-digit number with duplicate digit validation.
See “International Mobile Equipment Identity Number wide breadth” on page 944.
■ The medium breadth detects a 15-digit number with Luhn check validation and beginning
character exclusion.
See “International Mobile Equipment Identity Number medium breadth” on page 945.
■ The narrow breadth detects a 15-digit number with duplicate digit and Luhn check validation.
It also requires the presence of IMEI-related keywords.
See “International Mobile Equipment Identity Number narrow breadth” on page 945.

International Mobile Equipment Identity Number wide breadth

The wide breadth detects a 15-digit number with duplicate digit validation.

Table 37-324 International Mobile Equipment Identity Number wide-breadth patterns

Pattern

\d{15}

\d{2}-\d{6}-\d{6}-\d
 Library of system data identifiers 945
International Mobile Equipment Identity Number

Table 37-325 International Mobile Equipment Identity Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

International Mobile Equipment Identity Number medium breadth

The medium breadth detects a 15-digit number with Luhn check validation and beginning
character exclusion.

Table 37-326 International Mobile Equipment Identity Number medium-breadth patterns

Pattern

\d{15}

\d{2}-\d{6}-\d{6}-\d

Table 37-327 International Mobile Equipment Identity Number medium-breadth validators

Mandatory validator Description

Luhn Check Computes the Luhn checksum and validates the pattern
against it.

Number delimiter Validates a match by checking the surrounding numbers.

Exclude beginning characters Excludes the following characters from the beginning of
the number:

000000000000000

International Mobile Equipment Identity Number narrow breadth

The narrow breadth detects a 15-digit number with duplicate digit and Luhn check validation.
It also requires the presence of IMEI-related keywords.

Table 37-328 International Mobile Equipment Identity Number narrow-breadth patterns

Pattern

\d{15}

\d{2}-\d{6}-\d{6}-\d
 Library of system data identifiers 946
International Securities Identification Number

Table 37-329 International Mobile Equipment Identity Number narrow-breadth validators

Mandatory validator Description

Luhn Check Computes the Luhn checksum and validates the pattern
against it.

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

imei, IMEI, imei no, IMEI No, IMEI Number, imei number,
International Mobile Station Equipment Identity
Number, International Mobile Station Equipment
Identity

International Securities Identification Number

An International Securities Identification Number (ISIN) is a 12-character alphanumerical code
that uniquely identifies a security. Securities for which ISINs are issued include bonds,
commercial paper, stocks and warrants.
■ The wide breadth detects a 12-character identifier without validation.
See “ International Securities Identification Number wide breadth” on page 946.
■ The medium breadth detects a 12-character identifier with checksum validation.
See “International Securities Identification Number medium breadth” on page 947.
■ The narrow breadth detects a 12-character identifier with checksum validation. It also
requires the presence of ISIN-related keywords.
See “International Securities Identification Number narrow breadth” on page 947.

International Securities Identification Number wide breadth

The wide breadth detects a 12-character identifier without validation.

Table 37-330 International Securities Identification Number wide-breadth pattern

Pattern

\l{2}\w{9}\d
 Library of system data identifiers 947
International Securities Identification Number

The wide breadth of the International Securities Identification Number includes no validators.

International Securities Identification Number medium breadth

The medium breadth detects a 12-character identifier with checksum validation.

Table 37-331 International Securities Identification Number medium-breadth patterns

Pattern

\l{2}\w{9}\d

Table 37-332 International Securities Identification Number medium-breadth validators

Mandatory validator Description

International Securities Identification Number Validation Computes the checksum and validates the pattern against
Check it.

International Securities Identification Number narrow breadth

The narrow breadth detects a 12-character identifier with checksum validation. It also requires
the presence of ISIN-related keywords.

Table 37-333 International Securities Identification Number narrow-breadth patterns

Pattern

\l{2}\w{9}\d

Table 37-334 International Securities Identification Number narrow-breadth validators

Mandatory validator Description

International Securities Identification Number Validation Computes the checksum and validates the pattern against
Check it.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

isin, i.s.i.n, International Securities Identification

Number, Standard & Poor's, S&P, National Numbering
Association, NNA ID, ID number, identification number,
Id no., international securities ID no., International
securities ID number
 Library of system data identifiers 948
IP Address

IP Address
An IP address is the computer networking code that is used to identify devices and facilitate
communications.
The IP Address data identifier detects IPv4 addresses.
This data identifier offers three breadths of detection:
■ The wide breadth detects IP addresses and validates their format.
See “IP Address wide breadth” on page 948.
■ The medium breadth detects IP addresses, validates their format, and eliminates fictitious
addresses.
See “IP Address medium breadth” on page 949.
■ The narrow breadth detects IP addresses, validates their format, and eliminates fictitious
and unassigned addresses.
See “IP Address narrow breadth” on page 949.

IP Address wide breadth

The wide breadth of the IP Address data identifier detects numbers in format
DDD.DDD.DDD.DDD with an optional /DD. Each three-digit group must be between 0 and
255 inclusive and the /DD must be between 0 and 32. Additionally, 0.0.0.0 is not allowed.

Table 37-335 IP Address wide-breadth patterns

Pattern

\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}

\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/[0-9]

\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/[1-2][0-9]?

\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/[3][0-2]?

Table 37-336 IP Address wide-breadth validator

Validator Description

IP Basic Check Every IP address must match the format x.x.x.x and every
number must be less than 256.
 Library of system data identifiers 949
IP Address

IP Address medium breadth

The medium breadth of the IP Address data identifier detects numbers in format
DDD.DDD.DDD.DDD with an optional /DD. Each three-digit group must be between 0 and
255 inclusive and the /DD must be between 0 and 32. Additionally, 0.0.0.0 is not allowed. Also,
eliminates as common fictitious examples all 1-digit match groups such as 1.1.1.2.

Table 37-337 IP Address medium-breadth patterns

Pattern

\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}

\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/[0-9]

\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/[1-2][0-9]?

\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/[3][0-2]?

Table 37-338 IP Address medium-breadth validator

Mandatory Validator Description

IP Octet Check Every IP address must match the format x.x.x.x, every number must be less than 256,
and no IP address can contain only single-digit numbers (1.1.1.2).

IP Address narrow breadth

The narrow breadth of the IP Address data identifier detects numbers in format
DDD.DDD.DDD.DDD with an optional /DD. Each three-digit group must be between 0 and
255 inclusive and the /DD must be between 0 and 32. Additionally, 0.0.0.0 is not allowed. Also,
eliminates as common fictitious examples all 1-digit match groups such as 1.1.1.2. Also
eliminates unassigned IP addresses ("bogons").

Table 37-339 IP Address narrow-breadth patterns

Pattern

\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}

\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/[0-9]

\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/[1-2][0-9]?

\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}/[3][0-2]?
 Library of system data identifiers 950
IPv6 Address

Table 37-340 IP Address narrow-breadth validators

Mandatory Validator Description

IP Octet Check Every IP address must match the format x.x.x.x, every number must be less than 256,
and no IP address can contain only single-digit numbers (1.1.1.2).

IP Octet Check Checks whether the IP address falls into any of the "Bogons" ranges. If so, the match
is invalid.

IPv6 Address
Internet Protocol version 6 (IPv6) is the latest version of the Internet Protocol (IP), the
communications protocol that provides an identification and location system for computers on
networks and routes traffic across the Internet.
This data identifier offers three breadths of detection:
■ The wide breadth detects IPv6 addresses and validates their format.
See “IPv6 Address wide breadth” on page 950.
■ The medium breadth detects IPv6 addresses and validates their format. It also validates
that they do not begin with the numeral 0.
See “IPv6 Address medium breadth” on page 951.
■ The narrow breadth detects IPv6 addresses and validates their format. It also validates
that they do not begin with the numeral 0. Address strings are fully compressed, not
normalized.
See “IPv6 Address narrow breadth” on page 952.

IPv6 Address wide breadth

The wide breadth detects IPv6 addresses and validates that they match the format
xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx.

Table 37-341 IPv6 Address wide-breadth patterns

Pattern

[0-9A-Fa-f:./%]{11,19}

[0-9A-Fa-f:./%]{2,10}

[0-9A-Fa-f:./%]{20,28}

[0-9A-Fa-f:./%]{29,37}

[0-9A-Fa-f:./%]{38,46}
 Library of system data identifiers 951
IPv6 Address

Table 37-341 IPv6 Address wide-breadth patterns (continued)

Pattern

[0-9A-Fa-f:./%]{47,48}

Table 37-342 IPv6 Address wide-breadth validator

Validator Description

IPv6 Address Basic Validation Check Checks every IPv6 address and verifies that they match
the xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx format.

IPv6 Address medium breadth

The medium breadth detects IPv6 addresses and validates that they match the format
xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx. It also validates that they do not begin with the
numeral 0.

Table 37-343 IPv6 Address medium-breadth patterns

Pattern

[0-9A-Fa-f:./%]{11,19}

[0-9A-Fa-f:./%]{2,10}

[0-9A-Fa-f:./%]{20,28}

[0-9A-Fa-f:./%]{29,37}

[0-9A-Fa-f:./%]{38,46}

[0-9A-Fa-f:./%]{47,48}

Table 37-344 IPv6 Address medium-breadth validator

Mandatory Validator Description

IPv6 Address Medium Checks every IPv6 address and verifies that they match the
Validation Check xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx format, and that addresses do not start with
the numeral 0.
 Library of system data identifiers 952
Irish Personal Public Service Number

IPv6 Address narrow breadth

The narrow breadth detects IPv6 addresses and validates that they match the format
xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx. It also validates that they do not begin with the
numeral 0. Address strings are fully compressed, not normalized.

Table 37-345 IPv6 Address narrow-breadth patterns

Pattern

[0-9A-Fa-f:./%]{11,19}

[0-9A-Fa-f:./%]{2,10}

[0-9A-Fa-f:./%]{20,28}

[0-9A-Fa-f:./%]{29,37}

[0-9A-Fa-f:./%]{38,46}

[0-9A-Fa-f:./%]{47,48}

Table 37-346 IPv6 Address narrow-breadth validator

Mandatory Validator Description

IPv6 Address Reserved Checks every IPv6 address and verifies that they match the
Validation Check xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx format, do not start with the numeral 0, and
are fully compressed.

Table 37-347 IPv6 Address narrow-breadth normalizer

normalizer Description

Noop (No operation) String is passed as it is without normalizing.

Irish Personal Public Service Number

The format of the number is a unique 8-character alphanumeric string ending with a letter,
such as 8765432A. The number is assigned at the registration of birth of the child and is issued
on a Public Services Card and is unique to every person.
The Irish Personal Public Service Number system data identifier provides three breadths of
detection:
■ The wide breadth detects an 8-character alphanumeric string ending with a letter without
checksum validation.
See “Irish Personal Public Service Number wide breadth” on page 953.
 Library of system data identifiers 953
Irish Personal Public Service Number

■ The medium breadth detects an 8-character alphanumeric string ending with a letter with
checksum validation.
See “Irish Personal Public Service Number medium breadth” on page 953.
■ The narrow breadth detects an 8-character alphanumeric string ending with a letter that
passes checksum validation. It also requires the presence of Irish Personal Public Service
Number-related keywords.
See “Irish Personal Public Service Number narrow breadth” on page 954.

Irish Personal Public Service Number wide breadth

The wide breadth detects an 8-character alphanumeric string ending with a letter without
checksum validation.

Table 37-348 Irish Personal Public Service Number wide-breadth pattern

Pattern

\d{7}[a-wA-W]

Table 37-349 Irish Personal Public Service Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Irish Personal Public Service Number medium breadth

The medium breadth detects an 8-character alphanumeric string ending with a letter with
checksum validation.

Table 37-350 Irish Personal Public Service Number medium-breadth pattern

Pattern

\d{7}[a-wA-W]

Table 37-351 Irish Personal Public Service Number medium-breadth validator

Mandatory validator Description

Irish Personal Public Service Number Validation Check Computes the checksum and validates the pattern against
it.
 Library of system data identifiers 954
Israel Personal Identification Number

Irish Personal Public Service Number narrow breadth

The narrow breadth detects an 8-character alphanumeric string ending with a letter that passes
checksum validation. It also requires the presence of Irish Personal Public Service
Number-related keywords.

Table 37-352 Irish Personal Public Service Number narrow-breadth pattern

Pattern

\d{7}[a-wA-W]

Table 37-353 Irish Personal Public Service Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Irish Personal Public Service Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

public service no, personal public service no, pps no,

PPS No, personal service no, PPS service no, ppsno#,
Irish PPS No, Irish pps no, PPSNO#, publicserviceno#,
personal public service number

uimhir phearsanta seirbhíse poiblí, pps uimh, Uimhir

aitheantais phearsanta

Israel Personal Identification Number

The Israel Personal Identification Number is a 9-digit number issued to all Israeli citizens at
birth by the Ministry of the Interior. Personal identification numbers are also issued to all
residents over 16 years old who have legal temporary or permanent residence status.
The Israel Personal Identification Number data identifier provides three breadths of detection:
■ The wide breadth detects a 9-digit number without checksum validation.
See “Israel Personal Identification Number wide breadth” on page 955.
■ The medium breadth detects a 9-digit number with checksum validation.
See “Israel Personal Identification Number medium breadth” on page 955.
 Library of system data identifiers 955
Israel Personal Identification Number

■ The narrow breadth detects a 9-digit number with checksum validation. It also requires the
presence of Israeli Identity Number-related keywords.
See “Israel Personal Identification Number narrow breadth” on page 955.

Israel Personal Identification Number wide breadth

The wide breadth detects a 9-digit number without checksum validation.

Table 37-354 Israel Personal Identification Number wide-breadth pattern

Pattern

\d{9}

Table 37-355 Israel Personal Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Israel Personal Identification Number medium breadth

The medium breadth detects a 9-digit number with checksum validation.

Table 37-356 Israel Personal Identification Number medium-breadth patterns

Pattern

\d{9}

Table 37-357 Israel Personal Identification Number medium-breadth validators

Mandatory validator Description

Israeli Identity Number Validation Check Computes the checksum and validates the pattern against
it.

Number delimiter Validates a match by checking the surrounding numbers.

Israel Personal Identification Number narrow breadth

The narrow breadth detects a 9-digit number with checksum validation. It also requires the
presence of Israeli Identity Number-related keywords.
 Library of system data identifiers 956
Italy Driver's License Number

Table 37-358 Israel Personal Identification Number narrow-breadth patterns

Pattern

\d{9}

Table 37-359 Israel Personal Identification Number narrow-breadth validators

Mandatory validator Description

Israel Personal Identification Number Validation Check Computes the checksum and validates the pattern against
it.

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

identity number, IDnumber#, israeliidentitynumber,

identitynumber#, identity no, Israeli identity number,
unique personal ID, personal ID, unique ID, unique
identity number, ‫זהות ישר‬,‫מספר זיהוי ישר אלי‬,‫מספר זיה וי‬
‫عدد هوية فريدة‬,‫رقم الهوية‬,‫هوية إسرائ يلية‬,‫هو ية اسرائيل ية عدد‬, ‫אלית‬
‫من نوعها‬

Italy Driver's License Number

Identification number for an individual driver's license issued by the Driver and Vehicle Licensing
Agency of the Italy.
The Italy Driver's License Number data identifier provides two breadths of detection:
■ The wide breadth detects a 10-character alphanumeric pattern without checksum validation.
See “Italy Driver's License Number wide breadth” on page 956.
■ The narrow breadth detects a 10-character alphanumeric pattern without checksum
validation. It also requires the presence of related keywords.
See “Italy Driver's License Number narrow breadth” on page 957.

Italy Driver's License Number wide breadth

The wide breadth detects a 10-character alphanumeric pattern without checksum validation.
 Library of system data identifiers 957
Italy Driver's License Number

Table 37-360 Italy Driver's License Number wide-breadth patterns

Pattern

\l[AVav]\w{7}\l

\l[AVav] \w{7} \l

\l[AVav]-\w{7}-\l

\l[AVav] [-] \w{7} [-] \l

Table 37-361 Italy Driver's License Number wide-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Italy Driver's License Number narrow breadth

The narrow breadth detects a 10-character alphanumeric pattern without checksum validation.
It also requires the presence of related keywords.

Table 37-362 Italy Driver's License Number narrow-breadth patterns

Pattern

\l[AVav]\w{7}\l

\l[AVav] \w{7} \l

\l[AVav]-\w{7}-\l

\l[AVav] [-] \w{7} [-] \l

Table 37-363 Italy Driver's License Number narrow-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

 Library of system data identifiers 958
Italy Health Insurance Number

Table 37-363 Italy Driver's License Number narrow-breadth validators (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

drivers licence number, drivers license number, driving

licence number, driving license number, drivers
license, driving licence, driving license, patente guida
numero, patente di guida numero, patente di guida,
patente guida, Driver's License, Driver's License
Number, driver's license number, Driver's Licence
Number

Italy Health Insurance Number

The Italian Health Insurance Card is issued to every Italian citizen by the Italian Ministry of
Economy and Finance in cooperation with the Italian Agency of Revenue. The objective of the
card is to improve the social security services through expenditure control and performance,
and to optimize the use health services to citizens.
The Italy Health Insurance Number data identifier provides two breadths of detection:
■ The wide breadth detects a 16-character alphanumeric pattern without checksum validation.
It also requires the presence of related keywords.
See “Italy Health Insurance Number wide breadth” on page 958.
■ The wide breadth detects a 16-character alphanumeric pattern with checksum validation.
It also requires the presence of related keywords.
See “Italy Health Insurance Number narrow breadth” on page 959.

Italy Health Insurance Number wide breadth

The wide breadth detects a 16-character alphanumeric pattern without checksum validation.
It also requires the presence of related keywords.

Table 37-364 Italy Health Insurance Number wide-breadth pattern

Pattern

[A-Z]{6}[0-9LMNPQRSTUV]{2}[ABCDEHLMPRST][0-9LMNPQRSTUV]

{2}[A-Z][0-9LMNPQRSTUV]{3}[A-Z]
 Library of system data identifiers 959
Italy Health Insurance Number

Table 37-364 Italy Health Insurance Number wide-breadth pattern (continued)

Pattern

[A-Z]{3} [A-Z]{3} [0-9LMNPQRSTUV]{2}[ABCDEHLMPRST]

[0-9LMNPQRSTUV]{2} [A-Z][0-9LMNPQRSTUV]{3}[A-Z]

Table 37-365 Italy Health Insurance Number wide-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

Find keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

TESSERA SANITARIA, tessera sanitaria, tessera

sanitaria italiana, Health Insurance Card, Italian health
insurance card, health insurance card, EHIC, health
card, ehic, Health Card

Italy Health Insurance Number narrow breadth

The wide breadth detects a 16-character alphanumeric pattern with checksum validation. It
also requires the presence of related keywords.

Table 37-366 Italy Health Insurance Number narrow-breadth patterns

Pattern

[A-Z]{6}[0-9LMNPQRSTUV]{2}[ABCDEHLMPRST][0-9LMNPQRSTUV]

{2}[A-Z][0-9LMNPQRSTUV]{3}[A-Z]

[A-Z]{3} [A-Z]{3} [0-9LMNPQRSTUV]{2}[ABCDEHLMPRST]

[0-9LMNPQRSTUV]{2} [A-Z][0-9LMNPQRSTUV]{3}[A-Z]

Table 37-367 Italy Health Insurance Number narrow-breadth validators

Mandatory validator Description

Codice Fiscale Control Key Check Computes the control key and checks if it is valid.

Number delimiter Validates a match by checking the surrounding numbers.

 Library of system data identifiers 960
Italy Passport Number

Table 37-367 Italy Health Insurance Number narrow-breadth validators (continued)

Mandatory validator Description

Find keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

TESSERA SANITARIA, tessera sanitaria, tessera

sanitaria italiana, Health Insurance Card, Italian health
insurance card, health insurance card, EHIC, health
card, ehic, Health Card

Italy Passport Number

The Italian passports are issued to Italian citizens for the purpose of international travel.
The Italy Passport Number data identifier provides two breadths of detection:
■ The wide breadth detects a nine-character alphanumeric pattern without checksum
validation.
See “Italy Passport Number wide breadth” on page 960.
■ The narrow breadth detects a nine-character alphanumeric pattern without checksum
validation. It also requires the presence of related keywords.
See “Italy Passport Number narrow breadth” on page 960.

Italy Passport Number wide breadth

The wide breadth detects a nine-character alphanumeric pattern without checksum validation.

Table 37-368 Italy Passport Number wide-breadth pattern

Pattern

\l{2}\d{7}

Table 37-369 Italy Passport Number wide-breadth validator

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

Italy Passport Number narrow breadth

The narrow breadth detects a nine-character alphanumeric pattern without checksum validation.
It also requires the presence of related keywords.
 Library of system data identifiers 961
Italy Value Added Tax (VAT) Number

Table 37-370 Italy Passport Number narrow-breadth patterns

Pattern

\l{2}\d{7}

Table 37-371 Italy Passport Number narrow-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Repubblica Italiana Passaporto, Passaporto,

Passaporto Italiana, passport number, Italiana
Passaporto numero, Passaporto numero, Numéro
passeport italien, numéro passeport, Italian passport
number

Italy Value Added Tax (VAT) Number

Value-Added Tax (VAT) is a consumption tax that is borne by the end consumer. VAT is paid
for each transaction in the manufacturing and distribution process. For Italy, the Value Added
Tax is issued by VAT office for the region in which the business is established.
The Italy Value Added Tax (VAT) Number data identifier provides three breadths of detection:
■ The wide breadth detects a 13-character alphanumeric pattern preceded by IT, without
checksum validation.
See “Italy Value Added Tax (VAT) Number wide breadth” on page 961.
■ The medium breadth detects a 13-character alphanumeric pattern preceded by IT, with
checksum validation.
See “Italy Value Added Tax (VAT) Number medium breadth” on page 962.
■ The narrow breadth detects a 13-character alphanumeric pattern preceded by IT, with
checksum validation. It also requires the presence of related keywords.
See “Italy Value Added Tax (VAT) Number narrow breadth” on page 963.

Italy Value Added Tax (VAT) Number wide breadth

The wide breadth detects a 13-character alphanumeric pattern preceded by IT, without
checksum validation.
 Library of system data identifiers 962
Italy Value Added Tax (VAT) Number

Table 37-372 Italy Value Added Tax (VAT) Number wide-breadth pattern

Pattern

[Ii][Tt]\d{11}

[Ii][Tt] \d{11}

[Ii][Tt].\d{11}

[Ii][Tt]-\d{11}

[Ii][Tt],\d{11}

Table 37-373 Italy Value Added Tax (VAT) Number wide-breadth validator

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

Italy Value Added Tax (VAT) Number medium breadth

The medium breadth detects a 13-character alphanumeric pattern preceded by IT, with
checksum validation.

Table 37-374 Italy Value Added Tax (VAT) Number medium-breadth patterns

[Ii][Tt]\d{11}

[Ii][Tt] \d{11}

[Ii][Tt].\d{11}

[Ii][Tt]-\d{11}

[Ii][Tt],\d{11}

Table 37-375 Italy Value Added Tax (VAT) Number medium-breadth validator

Italy VAT Number Validation Check Checksum validator for the Italy Value Added Tax
(VAT) Number.
 Library of system data identifiers 963
Japan Passport Number

Italy Value Added Tax (VAT) Number narrow breadth

The narrow breadth detects a 13-character alphanumeric pattern preceded by IT, with
checksum validation. It also requires the presence of related keywords.

Table 37-376 Italy Value Added Tax (VAT) Number narrow-breadth patterns

Pattern

[Ii][Tt]\d{11}

[Ii][Tt] \d{11}

[Ii][Tt].\d{11}

[Ii][Tt]-\d{11}

[Ii][Tt],\d{11}

Table 37-377 Italy Value Added Tax (VAT) Number narrow-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

Italy VAT Number Validation Check Checksum validator for the Italy Value Added Tax (VAT)
Number.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

VAT Number, vat no, VAT#, IVA, numero partita IVA,

IVA#, numero IVA

Japan Passport Number

Japan Passport Numbers are issued to Japanese citizens for international travel.
The Japan Passport Number data identifier provides two breadths of detection:
■ The wide breadth detects a valid Japanese passport number pattern.
See “Japan Passport Number wide breadth” on page 964.
■ The narrow breadth detects a valid Japanese passport number pattern. It also requires the
presence of related keywords.
See “Japan Passport Number narrow breadth” on page 964.
 Library of system data identifiers 964
Japan Passport Number

Japan Passport Number wide breadth

The wide breadth detects a valid Japanese passport number pattern.

Table 37-378 Japan Passport Number wide-breadth patterns

Patterns

\l{2}\d{3}\l\d{2}\l\d

\l{2}\d{4}\l\d\l\d

\l\d{4}\l\d{2}\l\d

\l\d{4}\l\d{2}\l{2}\d

\l{2}\d{3}\l\d{2}\l{2}\d

\l{2}\d{8}

\l{2}\d{7}

\l\d{8}

Table 37-379 Japan Passport Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Japan Passport Number narrow breadth

The narrow breadth detects a valid Japanese passport number pattern. It also requires the
presence of related keywords.

Table 37-380 Japan Passport Number narrow-breadth patterns

Patterns

\l{2}\d{3}\l\d{2}\l\d

\l{2}\d{4}\l\d\l\d

\l\d{4}\l\d{2}\l\d

\l\d{4}\l\d{2}\l{2}\d

\l{2}\d{3}\l\d{2}\l{2}\d

\l{2}\d{8}
 Library of system data identifiers 965
Japanese Juki-Net Identification Number

Table 37-380 Japan Passport Number narrow-breadth patterns (continued)

Patterns

\l{2}\d{7}

\l\d{8}

Table 37-381 Japan Passport Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

日本国旅券, パスポート, パスポート数, passport,

Passport, JAPAN PASSPORT, Japan Passport, japan
passport, Passport Book, passport book

Japanese Juki-Net Identification Number

The Juki Net Identification Number is a unique number assigned to both Japanese and foreign
residents for confirming their personal identification.
The Juki-Net Identification Number system data identifier provides three breadths of detection:
■ The wide breadth detects an 11-digit number without checksum validation.
See “Japanese Juki-Net Identification Number wide breadth” on page 965.
■ The medium breadth detects an 11-digit number with checksum validation.
See “Japanese Juki-Net Identification Number medium breadth” on page 966.
■ The narrow breadth detects an 11-digit number that passes checksum validation. It also
requires the presence of Juki-Net ID-related keywords.
See “Japanese Juki-Net Identification Number narrow breadth” on page 966.

Japanese Juki-Net Identification Number wide breadth

The wide breadth detects an 11-digit number without checksum validation.
 Library of system data identifiers 966
Japanese Juki-Net Identification Number

Table 37-382 Japanese Juki-Net Identification Number wide-breadth pattern

Pattern

\d{11}

Table 37-383 Japanese Juki-Net Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Japanese Juki-Net Identification Number medium breadth

The medium breadth detects an 11-digit number with checksum validation.

Table 37-384 Japanese Juki-Net Identification Number medium-breadth pattern

Pattern

\d{11}

Table 37-385 Japanese Juki-Net Identification Number medium-breadth validator

Mandatory validator Description

Japanese Juki-Net Id Validation Check Validator computes checksum number that every Japanese
Juki-net card number must pass.

Number Delimiter Validates a match by checking the surrounding characters.

Japanese Juki-Net Identification Number narrow breadth

The narrow breadth detects an 11-digit number that passes checksum validation. It also
requires the presence of Juki-Net Identification Number-related keywords.

Table 37-386 Japanese Juki-Net Identification Number narrow-breadth pattern

Pattern

\d{11}

Table 37-387 Japanese Juki-Net Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.
 Library of system data identifiers 967
Japanese My Number - Corporate

Table 37-387 Japanese Juki-Net Identification Number narrow-breadth validators (continued)

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Japanese Juki-Net Id Validation Check Validator computes checksum number that every Japanese
Juki-net card number must pass..

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

juki net identity number, juki net number,

identification number, Juki Net No,
jukinetno# personal identification number,
juki net no, jukinetnumber#, unique jukinet
ID

住基ネット識別番号, 住基ネット番号, 識別番号, 個人識

別番号, ID番号, ユニークID番号

Japanese My Number - Corporate

The Japanese My Number - Corporate is a unique identifier for Japanese corporations used
for tax administration, social security administration, and disaster response.
■ The wide breadth detects a 13-digit number with checksum validation.
See “ Japanese My Number - Corporate wide breadth” on page 967.
■ The narrow breadth detects a 13-digit number with checksum validation. It also requires
the presence of a Japanese My Number-related keyword.
See “Japanese My Number - Corporate narrow breadth” on page 968.

Japanese My Number - Corporate wide breadth

The wide breadth detects a 13-digit number with checksum validation.

Table 37-388 Japanese My Number - Corporate wide-breadth pattern

Pattern

\d{13}
 Library of system data identifiers 968
Japanese My Number - Personal

Table 37-389 Japanese My Number - Corporate wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Japanese My Number Validation Check Computes the checksum and validates the pattern against
it.

Number delimiter Validates a match by checking the surrounding numbers.

Japanese My Number - Corporate narrow breadth

The narrow breadth detects a 13-digit number with checksum validation. It also requires the
presence of a Japanese My Number-related keyword.

Table 37-390 Japanese My Number - Corporate narrow-breadth pattern

Pattern

\d{13}

Table 37-391 Japanese My Number - Corporate narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Japanese My Number Validation Check Computes the checksum and validates the pattern against
it.

Exclude beginning characters Excludes the following characters from the beginning of
the number: 000000000000

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

マイナンバー, 共通番号

Japanese My Number - Personal

The Japanese My Number - Personal is a unique identifier for Japanese citizens and residents
used for tax administration, social security administration, and disaster response.
■ The wide breadth detects a 12-digit number with checksum validation.
 Library of system data identifiers 969
Japanese My Number - Personal

See “Japanese My Number - Personal wide breadth” on page 969.

■ The medium breadth detects a 12-digit number with checksum validation.
See “Japanese My Number - Personal medium breadth” on page 969.
■ The narrow breadth detects a 12-digit number with checksum validation. It also requires
the presence of a Japanese My Number-related keyword.
See “Japanese My Number - Personal narrow breadth” on page 970.

Japanese My Number - Personal wide breadth

The wide breadth detects a 12-digit number with checksum validation.

Table 37-392 Japanese My Number - Personal wide-breadth pattern

Pattern

\d{12}

Table 37-393 Japanese My Number - Personal wide-breadth validators

Mandatory validator Description

Japanese My Number Validation Check Computes the checksum and validates the pattern against
it.

Exclude beginning characters Excludes the following characters from the beginning of
the number: 000000000000

Japanese My Number - Personal medium breadth

The medium breadth detects a 12-digit number with checksum validation.

Table 37-394 Japanese My Number - Personal medium-breadth patterns

Pattern

\d{12}

\d{4} \d{4} \d{4}

\d{4}-\d{4}-\d{4}

\d{4}.\d{4}.\d{4}
 Library of system data identifiers 970
Korea Passport Number

Table 37-395 Japanese My Number - Personal medium-breadth validators

Mandatory validator Description

Japanese My Number Validation Check Computes the checksum and validates the pattern against
it.

Exclude beginning characters Excludes the following characters from the beginning of
the number: 000000000000

Japanese My Number - Personal narrow breadth

The narrow breadth detects a 12-digit number with checksum validation. It also requires the
presence of a Japanese My Number-related keyword.

Table 37-396 Japanese My Number - Personal narrow-breadth patterns

Pattern

\d{12}

\d{4} \d{4} \d{4}

\d{4}-\d{4}-\d{4}

\d{4}.\d{4}.\d{4}

Table 37-397 Japanese My Number - Personal narrow-breadth validators

Mandatory validator Description

Japanese My Number Validation Check Computes the checksum and validates the pattern against
it.

Exclude beginning characters Excludes the following characters from the beginning of
the number: 000000000000

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

マイナンバー, 個人番号, 共通番号

Korea Passport Number

Korean Passports are issued to Korean citizens to facilitate international travel.
 Library of system data identifiers 971
Korea Passport Number

The Korea Passport Number data identifier provides two breadths of detection:
■ The wide breadth detects a valid Korean Passport Number pattern.
See “Korea Passport Number wide breadth” on page 971.
■ The narrow breadth detects a valid Korean Passport Number pattern. It also requires the
presence of related keywords.
See “Korea Passport Number narrow breadth” on page 971.

Korea Passport Number wide breadth

The wide breadth detects a valid Korean Passport Number pattern.

Table 37-398 Korea Passport Number wide-breadth patterns

Patterns

\l{2}\d{7}

\l\d{8}

\d{9}

Table 37-399 Korea Passport Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Korea Passport Number narrow breadth

The narrow breadth detects a valid Korean Passport Number pattern. It also requires the
presence of related keywords.

Table 37-400 Korea Passport Number narrow-breadth patterns

Patterns

\l{2}\d{7}

\l\d{8}

\d{9}
 Library of system data identifiers 972
Korea Residence Registration Number for Foreigners

Table 37-401 Korea Passport Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

한국어 여권, 여권, 여권 번호, 조선 민주주의 인민 공화국,

대한민국, passport, Passport, KOREA PASSPORT,
Korea Passport, korea passport, Book, passport book,
South Korea, Republic of Korea

Korea Residence Registration Number for Foreigners

A foreign resident registration number is a 13-digit number issued to all foreign residents of
the Republic of Korea. It is used to identify people in various private transactions such as in
banking and employment and for online identification purposes.
The Korea Residence Registration Number for Foreigners data identifier provides three breadths
of detection:
■ The wide breadth detects a valid Korea Residence Registration Number for Foreigners
pattern.
See “Korea Residence Registration Number for Foreigners wide breadth” on page 972.
■ The medium breadth detects a valid Korea Residence Registration Number for Foreigners
pattern. It also validates the checksum.
See “Korea Residence Registration Number for Foreigners medium breadth” on page 973.
■ The narrow breadth detects a valid Korea Residence Registration Number for Foreigners
pattern. It also validates the checksum and requires the presence of related keywords.
See “Korea Residence Registration Number for Foreigners narrow breadth” on page 974.

Korea Residence Registration Number for Foreigners wide breadth

The wide breadth detects a valid Korea Residence Registration Number for Foreigners pattern.

Table 37-402 Korea Residence Registration Number for Foreigners wide-breadth patterns

Patterns

\d{2}[01]\d[0123]\d-\d{7}
 Library of system data identifiers 973
Korea Residence Registration Number for Foreigners

Table 37-402 Korea Residence Registration Number for Foreigners wide-breadth patterns
(continued)

Patterns

\d{2}[01]\d[0123]\d{8}

\d\d[01]\d[0123]\d-\d{7}

\d{2}[01]\d[0123]\d[ ]\d{7}

Table 37-403 Korea Residence Registration Number for Foreigners wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Korea Residence Registration Number for Foreigners medium

breadth
The medium breadth detects a valid Korea Residence Registration Number for Foreigners
pattern. It also validates the checksum.

Table 37-404 Korea Residence Registration Number for Foreigners medium-breadth patterns

Patterns

\d{2}[01]\d[0123]\d-\d{7}

\d{2}[01]\d[0123]\d{8}

\d\d[01]\d[0123]\d-\d{7}

\d{2}[01]\d[0123]\d[ ]\d{7}

Table 37-405 Korea Residence Registration Number for Foreigners medium-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding characters.

KRRN Foreign Validation Check Validates that the third and fourth digits represent a valid
month, and that the fifth and sixth digits represent a valid
day. Validates the checksum of the pattern.
 Library of system data identifiers 974
Korea Residence Registration Number for Korean

Korea Residence Registration Number for Foreigners narrow breadth

The narrow breadth detects a valid Korea Residence Registration Number for Foreigners
pattern. It also validates the checksum and requires the presence of related keywords.

Table 37-406 Korea Residence Registration Number for Foreigners narrow-breadth patterns

Patterns

\d{2}[01]\d[0123]\d-\d{7}

\d{2}[01]\d[0123]\d{8}

\d\d[01]\d[0123]\d-\d{7}

\d{2}[01]\d[0123]\d[ ]\d{7}

Table 37-407 Korea Residence Registration Number for Foreigners narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding characters.

KRRN Foreign Validation Check Validates that the third and fourth digits represent a valid
month, and that the fifth and sixth digits represent a valid
day. Validates the checksum of the pattern.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

외국인 등록 번호, 주민번호, Foreign Registration

Number, Foreign Resident Number

Korea Residence Registration Number for Korean

A resident registration number is a 13-digit number issued to all residents of the Republic of
Korea. Similar to national identification numbers in other countries, it is used to identify people
in various private transactions such as in banking and employment. It is also used extensively
for online identification purposes.
The Korea Residence Registration Number for Korean data identifier provides three breadths
of detection:
■ The wide breadth detects a valid Korea Residence Registration Number for Korean pattern.
 Library of system data identifiers 975
Korea Residence Registration Number for Korean

See “Korea Residence Registration Number for Korean wide breadth” on page 975.
■ The medium breadth detects a valid Korea Residence Registration Number for Korean
pattern. It also validates the checksum.
See “Korea Residence Registration Number for Korean medium breadth” on page 975.
■ The narrow breadth detects a valid Korea Residence Registration Number for Korean
pattern. It also validates the checksum and requires the presence of related keywords.
See “Korea Residence Registration Number for Korean narrow breadth” on page 976.

Korea Residence Registration Number for Korean wide breadth

The wide breadth detects a valid Korea Residence Registration Number for Korean pattern.

Table 37-408 Korea Residence Registration Number for Korean wide-breadth patterns

Patterns

\d{2}[01]\d[0123]\d-\d{7}

\d{2}[01]\d[0123]\d{8}

\d\d[01]\d[0123]\d-\d{7}

\d{2}[01]\d[0123]\d[ ]\d{7}

Table 37-409 Korea Residence Registration Number for Korean wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Korea Residence Registration Number for Korean medium breadth

The medium breadth detects a valid Korea Residence Registration Number for Korean pattern.
It also validates the checksum.

Table 37-410 Korea Residence Registration Number for Korean medium-breadth patterns

Patterns

\d{2}[01]\d[0123]\d-\d{7}

\d{2}[01]\d[0123]\d{8}

\d\d[01]\d[0123]\d-\d{7}

\d{2}[01]\d[0123]\d[ ]\d{7}
 Library of system data identifiers 976
Korea Residence Registration Number for Korean

Table 37-411 Korea Residence Registration Number for Korean medium-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding characters.

Advanced KRRN Validation Validates that the third and fourth digits represent a valid
month, and that the fifth and sixth digits represent a valid
day. Validates the checksum of the pattern.

Korea Residence Registration Number for Korean narrow breadth

The narrow breadth detects a valid Korea Residence Registration Number for Korean pattern.
It also validates the checksum and requires the presence of related keywords.

Table 37-412 Korea Residence Registration Number for Korean narrow-breadth patterns

Pattern

\d{2}[01]\d[0123]\d-\d{7}

\d{2}[01]\d[0123]\d{8}

\d\d[01]\d[0123]\d-\d{7}

\d{2}[01]\d[0123]\d[ ]\d{7}

Table 37-413 Korea Residence Registration Number for Korean narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding characters.

Advanced KRRN Validation Validates that the third and fourth digits represent a valid
month, and that the fifth and sixth digits represent a valid
day. Validates the checksum of the pattern.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

주민등록번호, 주민번호, Resident Registration Number,

Resident Number
 Library of system data identifiers 977
Luxembourg National Register of Individuals Number

Luxembourg National Register of Individuals Number

The Luxembourg National Register of Individuals Number is an 11-digit identification number
issued to all Luxembourg citizens at age 15.
The Luxembourg National Register of Individuals Number system data identifier provides three
breadths of detection:
■ The wide breadth detects an 11-digit number without checksum validation.
See “ Luxembourg National Register of Individuals Number wide breadth” on page 977.
■ The medium breadth detects an 11-digit number with checksum validation.
See “ Luxembourg National Register of Individuals Number medium breadth” on page 977.
■ The narrow breadth detects an 11-digit number that passes checksum validation. It also
requires the presence of Luxembourg National Register of Individuals Number-related
keywords.
See “ Luxembourg National Register of Individuals Number narrow breadth” on page 978.

Luxembourg National Register of Individuals Number wide breadth

The wide breadth detects an 11-digit number without checksum validation.

Table 37-414 Luxembourg National Register of Individuals Number wide-breadth pattern

Pattern

\d{11}

Table 37-415 Luxembourg National Register of Individuals Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Luxembourg National Register of Individuals Number medium breadth

The medium breadth detects an 11-digit number with checksum validation.

Table 37-416 Luxembourg National Register of Individuals Number medium breadth patterns

Pattern

\d{11}
 Library of system data identifiers 978
Luxembourg National Register of Individuals Number

Table 37-417 Luxembourg National Register of Individuals Number medium breadth validator

Mandatory validator Description

Luxembourg National Register of Individuals Number Validator computes checksum number that every
Validation Check Luxembourg Registre national des personnes physiques
Number must pass.

Number Delimiter Validates a match by checking the surrounding characters.

Luxembourg National Register of Individuals Number narrow breadth

The narrow breadth detects an 11-digit number that passes checksum validation. It also
requires the presence of Luxembourg National Register of Individuals Number-related keywords.

Table 37-418 Luxembourg National Register of Individuals Number narrow breadth patterns

Pattern

\d{11}

Table 37-419 Luxembourg National Register of Individuals Number narrow breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Luxembourg National Register of Individuals Number Validator computes checksum number that every
Validation Check Luxembourg Registre national des personnes physiques
Number must pass.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Personal ID, personal ID number, personalidno#,

unique ID number, personalidnumber#, unique ID key,
Personal ID Code, uniqueidkey#, individual code,
individual ID, Eindeutige ID-Nummer, Eindeutige ID,
ID personnelle, Numéro d'identification personnel,
IDpersonnelle#, Persönliche Identifikationsnummer,
EindeutigeID#
 Library of system data identifiers 979
Malaysian MyKad Number (MyKad)

Malaysian MyKad Number (MyKad)

The Malaysian National Registration Identity Card Number (NRIC No.) is a unique 12-digit
number issued to Malaysian citizens and permanent residents for identification, indexing, and
tracking purposes.
The Malaysian MyKad Number (MyKad) system data identifier provides three breadths of
detection:
The Malaysian MyKad Number (MyKad) system data identifier provides three breadths of
detection:
■ The wide breadth detects an 12-digit number without checksum validation.
See “ Malaysian MyKad Number (MyKad) wide breadth” on page 979.
■ The medium breadth detects a 12-digit number with checksum validation.
See “ Malaysian MyKad Number (MyKad) medium breadth” on page 979.
■ The narrow breadth detects a 12-digit number that passes checksum validation. It also
requires the presence of MyKad-related keywords.
See “ Malaysian MyKad Number (MyKad) narrow breadth” on page 980.

Malaysian MyKad Number (MyKad) wide breadth

The wide breadth detects a 12-digit number without checksum validation.

Table 37-420 Malaysian MyKad Number (MyKad) wide-breadth patterns

Pattern

\d{12}

\d{6}-\d{2}-\d{4}

Table 37-421 Malaysian MyKad Number (MyKad) wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Malaysian MyKad Number (MyKad) medium breadth

The medium breadth detects a 12-digit number with checksum validation.
 Library of system data identifiers 980
Malaysian MyKad Number (MyKad)

Table 37-422 Malaysian MyKad Number (MyKad) medium-breadth patterns

Pattern

\d{12}

\d{6}-\d{2}-\d{4}

Table 37-423 Malaysian MyKad Number (MyKad) medium-breadth validators

Mandatory validator Description

Malaysian My Kad Number Validation Check Validator computes checksum number that every
Malaysian My Kad Number must pass.

Number Delimiter Validates a match by checking the surrounding characters.

Malaysian MyKad Number (MyKad) narrow breadth

The narrow breadth detects a 12-digit number that passes checksum validation. It also requires
the presence of MyKad-related keywords.

Table 37-424 Malaysian MyKad Number (MyKad) narrow-breadth patterns

Pattern

\d{12}

\d{6}-\d{2}-\d{4}

Table 37-425 Malaysian MyKad Number (MyKad) narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Malaysian MyKad Number Validation Check Validator computes checksum number that every
Malaysian MyKad Number must pass.
 Library of system data identifiers 981
Mexican Personal Registration and Identification Number

Table 37-425 Malaysian MyKad Number (MyKad) narrow-breadth validators (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

NRIC No, nricno#, MyKad Number, mykad no,

mykadnumber#, identity card no, MyKadno#, mykad,
mykad#, identity card number, nric no, nombor kad
pengenalan, kad pengenalan no, kad pengenalan
Malaysia, bilangan identiti unik, nombor peribadi,
nomborperibadi#, kadpengenalanno#

Mexican Personal Registration and Identification

Number
The Mexican Personal Registration and Identification Number is a number used in Mexican
states (with the exception of Mexico City) as a personal identification code, in addition to CURP.
The Mexican Personal Registration and Identification Number data identifier provides three
breadths of detection:
■ The wide breadth detects a valid Mexican Personal Registration and Identification Number
pattern.
See “Mexican Personal Registration and Identification Number wide breadth” on page 981.
■ The medium breadth detects a valid Mexican Personal Registration and Identification
Number. It also validates the checksum.
See “Mexican Personal Registration and Identification Number medium breadth” on page 982.
■ The narrow breadth detects a valid Mexican Personal Registration and Identification Number.
It also validates the checksum and requires the presence of related keywords.
See “Mexican Personal Registration and Identification Number narrow breadth” on page 983.

Mexican Personal Registration and Identification Number wide

breadth
The wide breadth detects a valid Mexican Personal Registration and Identification Number
pattern.
 Library of system data identifiers 982
Mexican Personal Registration and Identification Number

Table 37-426 Mexican Personal Registration and Identification Number wide-breadth pattern

Pattern

\d{2}-\d{3}-\d{2}-\d{7}-\w

Table 37-427 Mexican Personal Registration and Identification Number wide-breadth validator

Mandatory validator Description

Exclude ending characters Any number ending with the following characters is
excluded from matching:

00000000000000, 11111111111111,
22222222222222, 33333333333333,
44444444444444, 55555555555555,
66666666666666, 77777777777777,
88888888888888, 99999999999999

Mexican Personal Registration and Identification Number medium

breadth
The medium breadth detects a valid Mexican Personal Registration and Identification Number.
It also validates the checksum.

Table 37-428 Mexican Personal Registration and Identification Number medium-breadth

pattern

Pattern

\d{2}-\d{3}-\d{2}-\d{7}-\w

Table 37-429 Mexican Personal Registration and Identification Number medium-breadth

validator

Mandatory validator Description

Exclude ending characters Any number ending with the following characters is
excluded from matching:

00000000000000, 11111111111111,
22222222222222, 33333333333333,
44444444444444, 55555555555555,
66666666666666, 77777777777777,
88888888888888, 99999999999999

Mexican CRIP Validation Check Computes the checksum for every number matched and
validates the pattern against it.
 Library of system data identifiers 983
Mexican Tax Identification Number

Mexican Personal Registration and Identification Number narrow

breadth
The narrow breadth detects a valid Mexican Personal Registration and Identification Number.
It also validates the checksum and requires the presence of related keywords.

Table 37-430 Mexican Personal Registration and Identification Number narrow-breadth

pattern

Pattern

\d{2}-\d{3}-\d{2}-\d{7}-\w

Table 37-431 Mexican Personal Registration and Identification Number narrow-breadth

validator

Mandatory validator Description

Exclude ending characters Any number ending with the following characters is
excluded from matching:

00000000000000, 11111111111111, 22222222222222,

33333333333333, 44444444444444, 55555555555555,
66666666666666, 77777777777777, 88888888888888,
99999999999999

Mexican CRIP Validation Check Computes the checksum for every number matched and
validates the pattern against it.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Personal Registration and Identification Code, CRIP,

crip, CRIP#, crip#, Mexican Personal ID Code, Mexican
personal identification number, Clave de Registro de
Identidad Personal, Código de Identificación Personal
mexicana, número de identificación personal mexicana

Mexican Tax Identification Number

In Mexico, a legal entity, such as a company or a person, is assigned a tax identification
number. An RFC number for a company is 12 characters, while an RFC number for a person
is 13 characters.
The Mexican Tax Identification Number data identifier provides three breadths of detection:
 Library of system data identifiers 984
Mexican Tax Identification Number

■ The wide breadth detects a valid Mexican Tax Identification Number pattern.
See “Mexican Tax Identification Number wide breadth” on page 984.
■ The medium breadth detects a valid Mexican Tax Identification Number pattern. It also
validates the checksum.
See “Mexican Tax Identification Number medium breadth” on page 984.
■ The narrow breadth detects a valid Mexican Tax Identification Number pattern. It also
validates the checksum and requires the presence of related keywords.
See “Mexican Tax Identification Number narrow breadth” on page 985.

Mexican Tax Identification Number wide breadth

The wide breadth detects a valid Mexican Tax Identification Number pattern.

Table 37-432 Mexican Tax Identification Number wide-breadth patterns

Patterns

\l{4}\d{2}[01]\d[0-3]\d\w{3}

\l{4}[- ]\d{2}[01]\d[0-3]\d\w{3}

\l{3}\d{2}[01]\d[0-3]\d\w{3}

\l{3}[- ]\d{2}[01]\d[0-3]\d\w{3}

Mexican Tax Identification Number medium breadth

The medium breadth detects a valid Mexican Tax Identification Number pattern. It also validates
the checksum.

Table 37-433 Mexican Tax Identification Number medium-breadth patterns

Patterns

\l{4}\d{2}[01]\d[0-3]\d\w{3}

\l{4}[- ]\d{2}[01]\d[0-3]\d\w{3}

\l{3}\d{2}[01]\d[0-3]\d\w{3}

\l{3}[- ]\d{2}[01]\d[0-3]\d\w{3}
 Library of system data identifiers 985
Mexican Tax Identification Number

Table 37-434 Mexican Tax Identification Number medium-breadth validator

Mandatory validator Description

Mexican TAX ID Validation Check Computes the checksum for every number matched and
validates the pattern against it.

Mexican Tax Identification Number narrow breadth

The narrow breadth detects a valid Mexican Tax Identification Number pattern. It also validates
the checksum and requires the presence of related keywords.

Table 37-435 Mexican Tax Identification Number narrow-breadth patterns

Patterns

\l{4}\d{2}[01]\d[0-3]\d\w{3}

\l{4}[- ]\d{2}[01]\d[0-3]\d\w{3}

\l{3}\d{2}[01]\d[0-3]\d\w{3}

\l{3}[- ]\d{2}[01]\d[0-3]\d\w{3}

Table 37-436 Mexican Tax Identification Number narrow-breadth validators

Mandatory validator Description

Mexican TAX ID Validation Check Computes the checksum for every number matched and
validates the pattern against it.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Tax Identification Number, Tax ID, Tax ID No., RFC

Number, TIN, TIN#, Federal Taxpayer Registry Code,
Registro Federal de Contribuyentes, número de
identificación de impuestos, Código del Registro
Federal de Contribuyentes, Número RFC, Clave del
RFC
 Library of system data identifiers 986
Mexican Unique Population Registry Code

Mexican Unique Population Registry Code

The Mexican Unique Population Registry Code (Clave Única de Registro de Población, or
CURP) is the unique alphanumeric identifier assigned to each person living in Mexico, either
nationals or foreigners, as well as Mexican nationals who live in other countries.
The Mexican Unique Population Registry Code system data identifier provides three breadths
of detection:
■ The wide breadth detects an 18-digit number without validation.
See “Mexican Unique Population Registry Code wide breadth” on page 986.
■ The medium breadth detects an 18-digit number with checksum validation.
See “Mexican Unique Population Registry Code medium breadth” on page 986.
■ The narrow breadth detects an 18-character alphanumeric identifier that passes checksum
validation. It also requires the presence of CURP-related keywords.
See “ Mexican Unique Population Registry Code narrow breadth” on page 987.

Mexican Unique Population Registry Code wide breadth

The wide breadth detects an 18-character alphanumeric identifier without validation.

Table 37-437 Mexican Unique Population Registry Code wide-breadth pattern

Pattern

\w[AEIOUaeiou]\w{2}\d{2}[0-1]\d[0-3]\d[HMhm]\w{7}

Mexican Unique Population Registry Code medium breadth

The medium breadth detects an 18-character alphanumeric identifier with checksum validation.

Table 37-438 Mexican Unique Population Registry Code medium-breadth pattern

Pattern

\w[AEIOUaeiou]\w{2}\d{2}[0-1]\d[0-3]\d[HMhm]\w{7}

Table 37-439 Mexican Unique Population Registry Code medium-breadth validator

Mandatory validator Description

Mexican Personal ID Code Number Validation Check Validator computes checksum number that every Mexican
Personal ID Code Number must pass.
 Library of system data identifiers 987
Mexico CLABE Number

Mexican Unique Population Registry Code narrow breadth

The narrow breadth detects an 18-character alphanumeric identifier that passes checksum
validation. It also requires the presence of CURP-related keywords.

Table 37-440 Mexican Unique Population Registry Code narrow-breadth pattern

Pattern

\w[AEIOUaeiou]\w{2}\d{2}[0-1]\d[0-3]\d[HMhm]\w{7}

Table 37-441 Mexican Unique Population Registry Code narrow-breadth validators

Mandatory validator Description

Mexican Personal ID Code Number Validation Check Validator computes checksum number that every Mexican
Personal ID Code Number must pass.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Personal ID, personal ID number, personal ID, unique

ID number, unique ID key, personal ID code, unique
population registry code, unique population code,
personalid#, personalidnumber#, uniqueidkey#, CURP,
curp#, clave Única de registro de Población, clave
única, clave única de identidad, clave personal
Identidad, personal Identidad Clave, ClaveÚnica#,
clavepersonalIdentidad#

Mexico CLABE Number

The Mexico CLABE (Clave Bancaria Estandarizada) Number is an 18-digit number used as
a banking standard for the numbering of bank accounts in Mexico.
The Mexico CLABE Number data identifier provides three breadths of detection:
■ The wide breadth detects an 18-digit number without checksum validation.
See “ Mexico CLABE Number wide breadth” on page 988.
■ The medium breadth detects an 18-digit number with checksum validation.
See “Mexico CLABE Number medium breadth” on page 988.
■ The narrow breadth detects an 18-digit number with checksum validation. It also requires
the presence of CLABE-related keywords.
See “Mexico CLABE Number narrow breadth” on page 988.
 Library of system data identifiers 988
Mexico CLABE Number

Mexico CLABE Number wide breadth

The wide breadth detects an 18-digit number without checksum validation.

Table 37-442 Mexico CLABE Number wide-breadth patterns

Pattern

\d{18}

Table 37-443 Mexico CLABE Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Mexico CLABE Number medium breadth

The medium breadth detects an 18-digit number with checksum validation.

Table 37-444 Mexico CLABE Number medium-breadth patterns

Pattern

\d{18}

Table 37-445 Mexico CLABE Number medium-breadth validators

Mandatory validator Description

Mexico CLABE Number Validation Check Computes the checksum and validates the pattern against
it.

Number delimiter Validates a match by checking the surrounding numbers.

Exclude beginning characters Excludes the following characters from the beginning of
the number: 555555555555555555

Mexico CLABE Number narrow breadth

The narrow breadth detects an 18-digit number with checksum validation. It also requires the
presence of CLABE-related keywords.
 Library of system data identifiers 989
National Drug Code (NDC)

Table 37-446 Mexico CLABE Number narrow-breadth patterns

Pattern

\d{18}

Table 37-447 Mexico CLABE Number narrow-breadth validators

Mandatory validator Description

Mexico CLABE Number Validation Check Computes the checksum and validates the pattern against
it.

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Mexico CLABE Number, mexico clabe number, clabe

number, clabe no., Mexico CLABE No., mexico clabe
no., CLABE No#, clabe no#, Clave Bancaria
Estandarizada, Estandarizado Banco número de clave,
número de clave, clave número, clave#

National Drug Code (NDC)

The National Drug Code (NDC) is an identifier issued by the Food and Drug Administration
(FDA) for an individual drug in the United States. An alternate format is defined by HIPAA
regulations.
The National Drug Code data identifier detects the existence of an NDC as well as the HIPAA
version.
This data identifier provides three breadths of detection:
■ The wide breadth checks for the existence of an NDC number or its HIPAA version.
See “National Drug Code (NDC) wide breadth” on page 990.
■ The medium breadth restricts the patterns for detecting the numbers.
See “National Drug Code (NDC) medium breadth” on page 990.
■ The narrow breadth requires a keyword match.
See “National Drug Code (NDC) narrow breadth” on page 991.
 Library of system data identifiers 990
National Drug Code (NDC)

National Drug Code (NDC) wide breadth

The wide breadth detects the standard FDA format, which is a 10-digit number in the format
4-4-2, 5-4-1 or 5-3-2, with the numbers separated by dashes or spaces.
This data identifier also detects the HIPAA format, an 11-digit number in the format 5-4-2. The
HIPAA format may include a single asterisk to represent a missing digit.

Table 37-448 National Drug Code (NDC) wide breadth patterns

Patterns

*?\d{4} \d{4} \d{2}

*?\d{4}-\d{4}-\d{2}

\d{5} *?\d{3} \d{2}

\d{5}-*?\d{3}-\d{2}

\d{5} \d{4} *?\d

\d{5}-\d{4}-*?\d

\d{5} \d{4} \d{2}

\d{5}-\d{4}-\d{2}

National Drug Code (NDC) medium breadth

The medium breadth detects the standard FDA format, which is a 10-digit number in the format
4-4-2, 5-4-1 or 5-3-2, with the numbers separated by dashes.
This data identifier also detects the HIPAA format, an 11-digit number in the format 5-4-2. The
HIPAA format may include a single asterisk to represent a missing digit.

Note: The medium breadth of this data identifier does not include any validators.

Table 37-449 National Drug Code (NDC) medium breadth patterns

Pattern

*?\d{4}-\d{4}-\d{2}

\d{5}-*?\d{3}-\d{2}

\d{5}-\d{4}-*?\d

\d{5}-\d{4}-\d{2}
 Library of system data identifiers 991
National Provider Identifier Number

National Drug Code (NDC) narrow breadth

The narrow breadth detects the standard FDA format, which is a 10-digit number in the format
4-4-2, 5-4-1 or 5-3-2, with the numbers separated by dashes.
This data identifier also detects the HIPAA format, an 11-digit number in the format 5-4-2. The
HIPAA format may include a single asterisk to represent a missing digit. This data identifier
also requires the presence of an NDC-related keyword.

Table 37-450 National Drug Code (NDC) narrow breadth patterns

Pattern

*?\d{4}-\d{4}-\d{2}

\d{5}-*?\d{3}-\d{2}

\d{5}-\d{4}-*?\d

\d{5}-\d{4}-\d{2}

Table 37-451 National Drug Code (NDC) narrow breadth validators

Mandatory validator Description

Find keywords With this option selected, at least one of the following keywords or key phrases
must be present for the data to be matched.

Find keywords input ndc, national drug code

National Provider Identifier Number

National Provider Identifier (NPI) is a unique 10-digit identification number issued to health
care providers in the United States by the Centers for Medicare and Medicaid Services.
The National Provider Identifier Number data identifier provides three breadths of detection:
■ The wide breadth detects a 10-digit number without checksum validation.
See “National Provider Identifier Number wide breadth” on page 992.
■ The medium breadth detects a 10-digit number with checksum validation.
See “National Provider Identifier Number medium breadth” on page 992.
■ The narrow breadth detects a 10-digit number with checksum validation. It also requires
the presence of NPI-related keywords.
See “National Provider Identifier Number narrow breadth” on page 992.
 Library of system data identifiers 992
National Provider Identifier Number

National Provider Identifier Number wide breadth

The wide breadth detects a 10-digit number without checksum validation.

Table 37-452 National Provider Identifier Number wide-breadth patterns

Pattern

\d{10}

80840\d{10}

Table 37-453 National Provider Identifier Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

National Provider Identifier Number medium breadth

The medium breadth detects a 10-digit number with checksum validation.

Table 37-454 National Provider Identifier Number medium-breadth patterns

Pattern

\d{10}

80840\d{10}

Table 37-455 National Provider Identifier Number medium-breadth validators

Mandatory validator Description

National Provider Identifier Number Validation Check Computes the checksum and validates the pattern against
it.

Number delimiter Validates a match by checking the surrounding numbers.

National Provider Identifier Number narrow breadth

The narrow breadth detects a 10-digit number with checksum validation. It also requires the
presence of NPI-related keywords.
 Library of system data identifiers 993
Netherlands Driver's License Number

Table 37-456 National Provider Identifier Number narrow-breadth patterns

Pattern

\d{10}

80840\d{10}

Table 37-457 National Provider Identifier Number narrow-breadth validators

Mandatory validator Description

National Provider Identifier Number Validation Check Computes the checksum and validates the pattern against
it.

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

National Provider Identifier, NPI, npi, n.p.i, hipaa,

National Provider ID, npiid, national provider ID
number, NPI ID

Netherlands Driver's License Number

Identification number for an individual driver's license issue by the Netherlands' RDW agency.
The Netherlands Driver's License Number data identifier provides two breadths of detection:
■ The wide breadth detects a 10-digit number without checksum validation.
See “Netherlands Driver's License Number wide breadth” on page 993.
■ The narrow breadth detects a 10-digit number without checksum validation. It also requires
the presence of related keywords.
See “Netherlands Driver's License Number narrow breadth” on page 994.

Netherlands Driver's License Number wide breadth

The wide breadth detects a 10-digit number without checksum validation.
 Library of system data identifiers 994
Netherlands Driver's License Number

Table 37-458 Netherlands Driver's License Number wide-breadth pattern

Pattern

\d{10}

Table 37-459 Netherlands Driver's License Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Netherlands Driver's License Number narrow breadth

The narrow breadth detects a 10-digit number without checksum validation. It also requires
the presence of related keywords.

Table 37-460 Netherlands Driver's License Number narrow-breadth pattern

Pattern

\d{10}

Table 37-461 Netherlands Driver's License Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

RIJMEWIJS, Driver License, Driver License Number,

driver license number, Driver Licence, Drivers Lic.,
Drivers License, Drivers Licence, Driver's License,
Driver's License Number, driver's license number,
Driver's Licence Number, Driving License number,
driving license number, DLNo#, dlno#, permis de
conduire, rijbewijs, Rijbewijsnummer, DL#,
RIJBEWIJSNUMMER
 Library of system data identifiers 995
Netherlands Passport Number

Netherlands Passport Number

The Dutch passports are issued to Netherlands citizens for the purpose of international travel.
The Netherlands Passport Number data identifier provides two breadths of detection:
■ The wide breadth detects a nine-digit number without checksum validation.
See “Netherlands Passport Number wide breadth” on page 995.
■ The narrow breadth detect a nine-digit number. It also requires the presence of related
keywords.
See “Netherlands Passport Number narrow breadth” on page 995.

Netherlands Passport Number wide breadth

The wide breadth detects a nine-digit number without checksum validation.

Table 37-462 Netherlands Passport Number wide-breadth pattern

Pattern

\w{9}

Table 37-463 Netherlands Passport Number wide-breadth validator

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

Netherlands Passport Number narrow breadth

The narrow breadth detect a nine-digit number. It also requires the presence of related
keywords.

Table 37-464 Netherlands Passport Number narrow-breadth pattern

Pattern

\w{9}

Table 37-465 Netherlands Passport Number narrow-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

 Library of system data identifiers 996
Netherlands Tax Identification Number

Table 37-465 Netherlands Passport Number narrow-breadth validators (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Dutch Passport Number, Dutch passport number,

passport number, Netherlands passport number,
Nederlanden paspoort nummer, Paspoort, paspoort,
Nederlanden paspoortnummer, paspoortnummer

Netherlands Tax Identification Number

Netherlands issues a tax identification number at birth or at registration at the municipality.
The Netherlands Tax Identification Number data identifier provides three breadths of detection:
■ The wide breadth detects a 9-digit number without checksum validation.
See “Netherlands Tax Identification Number wide breadth” on page 996.
■ The medium breadth detects a 9-digit number with checksum validation.
See “Netherlands Tax Identification Number medium breadth” on page 997.
■ The narrow breadth detects a 9-digit number with checksum validation. It also requires the
presence of related keywords.
See “Netherlands Tax Identification Number narrow breadth” on page 997.

Netherlands Tax Identification Number wide breadth

The wide breadth detects a 9-digit number without checksum validation.

Table 37-466 Netherlands Tax Identification Number wide-breadth patterns

Pattern

\d{9}

\d{3}-\d{3}-\d{3}

\d{3}.\d{3}.\d{3}

\d{3} \d{3} \d{3}

\d{3} \d{3} \d{3}

 Library of system data identifiers 997
Netherlands Tax Identification Number

Table 37-467 Netherlands Tax Identification Number wide-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

Duplicate digits Ensures that a string of digits is not all the same.

Netherlands Tax Identification Number medium breadth

The medium breadth detects a 9-digit number with checksum validation.

Table 37-468 Netherlands Tax Identification Number medium-breadth patterns

Pattern

\d{9}

\d{3}-\d{3}-\d{3}

\d{3}.\d{3}.\d{3}

\d{3} \d{3} \d{3}

\d{3} \d{3} \d{3}

Table 37-469 Netherlands Tax Identification Number medium-breadth validator

Mandatory validator Description

Dutch Tax Identification Number Validation Check Computes the checksum and validates the pattern against
it.

Netherlands Tax Identification Number narrow breadth

The narrow breadth detects a 9-digit number with checksum validation. It also requires the
presence of related keywords.

Table 37-470 Netherlands Tax Identification Number narrow-breadth patterns

Pattern

\d{9}

\d{3}-\d{3}-\d{3}

\d{3}.\d{3}.\d{3}
 Library of system data identifiers 998
Netherlands Tax Identification Number

Table 37-470 Netherlands Tax Identification Number narrow-breadth patterns (continued)

Pattern

\d{3} \d{3} \d{3}

\d{3} \d{3} \d{3}

Table 37-471 Netherlands Tax Identification Number narrow-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

Duplicate digits Ensures that a string of digits is not all the same.

Dutch Tax Identification Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

netherlands tax identification number, netherlands tax

identification, netherland's tax identification number,
netherland's tax identification, tax identification
number, dutch tax id, dutch tax identification number,
tax id, tax id#, tax number, tax no#, tax#, TIN, TIN#,
tin#, tin, netherlands tin, netherland's tin, Nederlands
belasting identificatienummer, identificatienummer
van belasting, identificatienummer belasting,
Nederlands belasting identificatie, Nederlands
belasting id nummer, Nederlands belastingnummer,
btw nummer, Nederlandse belasting identificatie,
Nederlands belastingnummer, netherlands tax
identification tal, netherland's tax identification tal, tax
identification tal, tax tal, Nederlânske tax identification
tal, Hollânske tax identification, Nederlânsk tax tal,
Hollânske tax id tal, netherlands impuesto
identification number, netherland's impuesto
identification number, impuesto identification number,
impuesto number, hulandes impuesto identification
number, hulandes impuesto identification, hulandes
impuesto number, hulandes impuesto id number
 Library of system data identifiers 999
Netherlands Value Added Tax (VAT) Number

Netherlands Value Added Tax (VAT) Number

Value-added Tax (VAT) is a consumption tax that is borne by the end consumer. VAT is paid
for each transaction in the manufacturing and distribution process. For Netherlands, the Value
Added Tax is issued by VAT office for the region in which the business is established.
The Netherlands Value Added Tax (VAT) Number data identifier provides three breadths of
detection:
■ The wide breadth detects a 14-character alphanumeric pattern beginning with NL, without
checksum validation.
See “Netherlands Value Added Tax (VAT) Number wide breadth” on page 999.
■ The medium breadth detects a 14-character alphanumeric pattern beginning with NL, with
checksum validation.
See “Netherlands Value Added Tax (VAT) Number medium breadth” on page 1000.
■ The narrow breadth detects a 14-character alphanumeric pattern beginning with NL, with
checksum validation. It also requires the presence of related keywords.
See “Netherlands Value Added Tax (VAT) Number narrow breadth” on page 1000.

Netherlands Value Added Tax (VAT) Number wide breadth

The wide breadth detects a 14-character alphanumeric pattern beginning with NL, without
checksum validation

Table 37-472 Netherlands Value Added Tax (VAT) Number wide-breadth patterns

Pattern

[Nn][Ll]\d{9}[Bb]\d{2}

[Nn][Ll]-\d{9}-[Bb]\d{2}

[Nn][Ll] \d{9} [Bb]\d{2}

[Nn][Ll].\d{9}.[Bb]\d{2}

Table 37-473 Netherlands Value Added Tax (VAT) Number wide-breadth validator

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

 Library of system data identifiers 1000
Netherlands Value Added Tax (VAT) Number

Netherlands Value Added Tax (VAT) Number medium breadth

The medium breadth detects a 14-character alphanumeric pattern beginning with NL, with
checksum validation.

Table 37-474 Netherlands Value Added Tax (VAT) Number medium-breadth patterns

Pattern

[Nn][Ll]\d{9}[Bb]\d{2}

[Nn][Ll]-\d{9}-[Bb]\d{2}

[Nn][Ll] \d{9} [Bb]\d{2}

[Nn][Ll].\d{9}.[Bb]\d{2}

Table 37-475 Netherlands Value Added Tax (VAT) Number medium breadth validator

Mandatory validator Description

Netherlands VAT Number Validation Check Checksum validator for the Netherlands Value Added Tax
(VAT) Number.

Netherlands Value Added Tax (VAT) Number narrow breadth

The narrow breadth detects a 14-character alphanumeric pattern beginning with NL, with
checksum validation. It also requires the presence of related keywords.

Table 37-476 Netherlands Value Added Tax (VAT) Number narrow-breadth patterns

Pattern

[Nn][Ll]\d{9}[Bb]\d{2}

[Nn][Ll]-\d{9}-[Bb]\d{2}

[Nn][Ll] \d{9} [Bb]\d{2}

[Nn][Ll].\d{9}.[Bb]\d{2}

Table 37-477 Netherlands Value Added Tax (VAT) Number narrow-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding numbers.

Netherlands VAT Number Validation Check Checksum validator for the Netherlands Value Added Tax
(VAT) Number.
 Library of system data identifiers 1001
New Zealand National Health Index Number

Table 37-477 Netherlands Value Added Tax (VAT) Number narrow-breadth validators
(continued)

Mandatory validator Description

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

VAT Number, vat no, vat number, VAT#, vat#, BTW,

wearde tafoege tax getal, BTW nûmer, BTW-nummer

New Zealand National Health Index Number

The National Health Index number (NHI number) is a unique 7-digit alphanumeric identifier
that is assigned to every person who uses health and disability support services in New Zealand.
The New Zealand National Health Index Number data identifier provides three breadths of
detection:
■ The wide breadth detects a 7-digit alphanumeric identifier with no validation.
See “New Zealand National Health Index Number wide breadth” on page 1001.
■ The medium breadth detects a 7-digit alphanumeric identifier with checksum validation.
See “New Zealand National Health Index Number medium breadth” on page 1001.
■ The narrow breadth detects a 7-digit alphanumeric identifier with checksum validation. It
also requires the presence of NHI number-related keywords.
See “New Zealand National Health Index Number narrow breadth” on page 1002.

New Zealand National Health Index Number wide breadth

The wide breadth detects a 7-digit alphanumeric identifier with no validation.

Table 37-478 New Zealand National Health Index Number wide-breadth pattern

Pattern

\l{3}\d{4}

The wide breadth does not include any validators.

New Zealand National Health Index Number medium breadth

The medium breadth detects a 7-digit alphanumeric identifier with checksum validation.
 Library of system data identifiers 1002
New Zealand National Health Index Number

Table 37-479 New Zealand National Health Index Number medium-breadth pattern

Pattern

\l{3}\d{4}

Table 37-480 New Zealand National Health Index Number medium-breadth validators

Mandatory validator Description

New Zealand National Health Index Number Validation Computes the checksum and validates the pattern against
Check it.

Number delimiter Validates a match by checking the surrounding numbers.

New Zealand National Health Index Number narrow breadth

The narrow breadth detects a 7-digit alphanumeric identifier with checksum validation. It also
requires the presence of NHI number-related keywords.

Table 37-481 New Zealand National Health Index Number narrow-breadth patterns

Pattern

\l{3}\d{4}

Table 37-482 New Zealand National Health Index Number narrow-breadth validators

Mandatory validator Description

New Zealand National Health Index Number Validation Computes the checksum and validates the pattern against
Check it.

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

New Zealand National Health Index Number Validation

Check Find keywords: National Health Index Number,
nhi number, NHI Number, nhi no., NHI number, National
Health Index No., National Health Index Id
 Library of system data identifiers 1003
Norwegian Birth Number

Norwegian Birth Number

The Norwegian Birth Number is assigned at birth or registration with the National Population
Register. The birth number is written on identity documents, making it possible to match a
bank account or authority document to a person.
The Norwegian Birth Number system data identifier provides three breadths of detection:
■ The wide breadth detects an 11- digit number without checksum validation.
See “ Norwegian Birth Number wide breadth” on page 1003.
■ The medium breadth detects an 11-digit number with checksum validation.
See “ Norwegian Birth Number medium breadth” on page 1003.
■ The narrow breadth detects an 11-digit number that passes checksum validation. It also
requires the presence of Norwegian Birth Number-related keywords.
See “ Norwegian Birth Number narrow breadth” on page 1004.

Norwegian Birth Number wide breadth

The wide breadth detects an 11- digit number without checksum validation.

Table 37-483 Norwegian Birth Number wide breadth patterns

Pattern

[01234567]\d[012345]\d[56789]\d[567]\d{4}

[01234567]\d[012345]\d\d\d[01234]\d{4}

[01234567]\d[012345]\d[456789]\d[9]\d{4}

[01234567]\d[012345]\d[0123]\d[56789]\d{4}

Table 37-484 Norwegian Birth Number wide breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Norwegian Birth Number medium breadth

The medium breadth detects an 11-digit number with checksum validation.
 Library of system data identifiers 1004
Norwegian Birth Number

Table 37-485 Norwegian Birth Number medium breadth patterns

Pattern

[01234567]\d[012345]\d[56789]\d[567]\d{4}

[01234567]\d[012345]\d\d\d[01234]\d{4}

[01234567]\d[012345]\d[456789]\d[9]\d{4}

[01234567]\d[012345]\d[0123]\d[56789]\d{4}

Table 37-486 Norwegian Birth Number medium breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Norwegian Birth Number Validation Check Computes the
checksum and validates the pattern against it Narrow -
Norwegian Birth Number narrow breadth.

Norwegian Birth Number Validation Check Computes the checksum and validates the pattern against
it.

Norwegian Birth Number narrow breadth

The narrow breadth detects an 11-digit number that passes checksum validation. It also
requires the presence of Norwegian Birth Number-related keywords.

Table 37-487 Norwegian Birth Number narrow breadth patterns

Pattern

[01234567]\d[012345]\d[56789]\d[567]\d{4}

[01234567]\d[012345]\d\d\d[01234]\d{4}

[01234567]\d[012345]\d[456789]\d[9]\d{4}

[01234567]\d[012345]\d[0123]\d[56789]\d{4}

Table 37-488 Norwegian Birth Number narrow breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

 Library of system data identifiers 1005
People's Republic of China ID

Table 37-488 Norwegian Birth Number narrow breadth validators (continued)

Mandatory validator Description

Norwegian Birth Number Validation Check Computes the checksum and validates the pattern against
it.

Norwegian Birth Number Validation Check With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Norwegian birth number, birth number, birth no,

birthnumber#, birthbo#, fødselsnummer#, fødsel
nummer, Fødsel nr, fødsel nei, fødselnei#

People's Republic of China ID

The People's Republic of China ID is used for residential registration, army enrollment
registration, registration of marriage/divorce, traveling abroad, taking part in various national
exams, and other social or civil matters in China.
The People's Republic of China ID data identifier provides two breadths of detection:
■ The wide breadth detects an 18-digit number with the checksum validation.
See “People's Republic of China ID wide breadth” on page 1005.
■ The narrow breadth detects an 18-digit number with the checksum validation. It also requires
the presence of People's Republic of China ID-related keywords.
See “People's Republic of China ID narrow breadth” on page 1006.

People's Republic of China ID wide breadth

The wide breadth detects an 18-digit number with the checksum validation.

Table 37-489 People's Republic of China ID wide-breadth pattern

Pattern

\d{17}[Xx]

\d{18}
 Library of system data identifiers 1006
Polish Identification Number

Table 37-490 People's Republic of China ID wide-breadth validator

Mandatory validator Description

China ID checksum validator Computes the checksum and validates the pattern against
it.

People's Republic of China ID narrow breadth

The narrow breadth detects an 18-digit number with the checksum validation. It also requires
the presence of People's Republic of China ID-related keywords.

Table 37-491
Pattern

\d{17}[Xx]

\d{18}

Table 37-492
Mandatory validator Description

China ID checksum validator Computes the checksum and validates the pattern
against it.

Find keywords At least one of the following keywords or key

phrases must be present for the data to be matched
when you use this option.

Inputs:

身份证,居民信息,居民身份信息, Identity Card,

Information of resident, Information of resident
identification

Polish Identification Number

Every Polish citizen 18 years of age or older residing permanently in Poland must have an
Identity Card, with a unique personal number. The number is used as identification for almost
all purposes.
The Polish ID Number system data identifier provides three breadths of detection:
■ The wide breadth detects a 9-digit alphanumeric identifier without checksum validation.
See “Polish Identification Number wide breadth” on page 1007.
■ The medium breadth detects a 9-digit alphanumeric identifier with checksum validation.
 Library of system data identifiers 1007
Polish Identification Number

See “Polish Identification Number medium breadth” on page 1007.

■ The narrow breadth detects a 9-digit alphanumeric identifier that passes checksum
validation. It also requires the presence of Polish Identification Number-related keywords.
See “Polish Identification Number narrow breadth” on page 1007.

Polish Identification Number wide breadth

The wide breadth detects a 9-digit alphanumeric identifier without checksum validation.

Table 37-493 Polish Identification Number wide-breadth pattern

Pattern

[A-Z]{3}\d{6}

Table 37-494 Polish Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Polish Identification Number medium breadth

The medium breadth detects a 9-digit alphanumeric identifier with checksum validation.

Table 37-495 Polish Identification Number medium-breadth pattern

Pattern

[A-Z]{3}\d{6}

Table 37-496 Polish Identification Number medium-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Polish ID Number Validation Check Computes the checksum and validates the pattern against
it.

Polish Identification Number narrow breadth

The narrow breadth detects a 9-digit alphanumeric identifier that passes checksum validation.
It also requires the presence of Polish Identification Number-related keywords.
 Library of system data identifiers 1008
Polish REGON Number

Table 37-497 Polish ID Number narrow-breadth pattern

Pattern

[A-Z]{3}\d{6}

Table 37-498 Polish Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Polish ID Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

national identification number, personal identification

number, personal identity no, unique identity number,
nationalidno#, personal ID, personal identity,
personalidentityno#, uniqueid#, nationalid#,
natioanlidentity#, Dowód osobisty, Tożsamości
narodowej, osobisty numer identyfikacyjny,
niepowtarzalny numer, numer identyfikacyjny,
Dowódosobisty#, niepowtarzalnynumer#

Polish REGON Number

Each national economy entity is obligated to register in the register of business entities called
REGON in Poland. It is the only integrated register in Poland covering all of the national
economy entities. Each company has a unique REGON number.
The Polish REGON Number system data identifier provides three breadths of detection:
■ The wide breadth detects a 9- or 14-digit number without checksum validation.
See “Polish REGON Number wide breadth” on page 1009.
■ The medium breadth detects a 9- or 14-digit number with checksum validation.
See “Polish REGON Number medium breadth” on page 1009.
■ The narrow breadth detects a 9- or 14-digit number that passes checksum validation. It
also requires the presence of REGON-related keywords.
See “Polish REGON Number narrow breadth” on page 1010.
 Library of system data identifiers 1009
Polish REGON Number

Polish REGON Number wide breadth

The wide breadth detects a 9- or 14-digit number without checksum validation.

Table 37-499 Polish REGON Number wide-breadth patterns

Pattern

\d{9}

\d{3}-\d{2}-\d{2}-\d{2}

\d{14}

\d{9}-\d{5}

Table 37-500 Polish REGON Number wide breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Polish REGON Number medium breadth

The medium breadth detects a 9- or 14-digit number with checksum validation.

Table 37-501 Polish REGON Number medium-breadth patterns

Pattern

\d{9}

\d{3}-\d{2}-\d{2}-\d{2}

\d{14}

\d{9}-\d{5}

Table 37-502 Polish REGON Number medium-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Polish REGON Number Validation Check Computes the checksum and validates the pattern against
it.
 Library of system data identifiers 1010
Polish Social Security Number (PESEL)

Polish REGON Number narrow breadth

The narrow breadth detects a 9- or 14-digit number that passes checksum validation. It also
requires the presence of REGON-related keywords.

Table 37-503 Polish REGON Number narrow-breadth patterns

Pattern

\d{9}

\d{3}-\d{2}-\d{2}-\d{2}

\d{14}

\d{9}-\d{5}

Table 37-504 Polish REGON Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Polish REGON Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

REGON ID, statistical number, statistical ID, statistical

no, REGON number, regonid#, REGONID#, regonno#,
company ID, companyID#, company ID no, company
ID number, companyIDno#, numer statystyczny,
REGON, numeru REGON, numerstatystyczny#,
numeruREGON#

Polish Social Security Number (PESEL)

The Polish Social Security Number (PESEL) is the national identification number used in
Poland. The PESEL number is mandatory for all permanent residents of Poland and for
temporary residents living in Poland. It uniquely identifies a person and cannot be transferred
to another.
 Library of system data identifiers 1011
Polish Social Security Number (PESEL)

The Polish Social Security Number (PESEL) system data identifier provides three breadths of
detection:
■ The wide breadth detects an 11-digit number without checksum validation.
See “Polish Social Security Number (PESEL) wide breadth” on page 1011.
■ The medium breadth detects an 11-digit number with checksum validation.
See “Polish Social Security Number (PESEL) medium breadth” on page 1011.
■ The narrow breadth detects an 11-digit number that passes checksum validation. It also
requires the presence of PESEL-related keywords.
See “Polish Social Security Number (PESEL) narrow breadth” on page 1012.

Polish Social Security Number (PESEL) wide breadth

The wide breadth detects an 11-digit number without checksum validation.

Table 37-505 Polish Social Security Number (PESEL) wide-breadth pattern

Pattern

\d{2}[012389]\d[0-3]\d{6}

Table 37-506 Polish Social Security Number (PESEL) wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Polish Social Security Number (PESEL) medium breadth

The medium breadth detects an 11-digit number with checksum validation.

Table 37-507 Polish Social Security Number (PESEL) medium breadth pattern

Pattern

\d{2}[012389]\d[0-3]\d{6}

Table 37-508 Polish Social Security Number (PESEL) medium breadth validators

Mandatory validator Description

Polish Social Security Number Validation Check Validator computes checksum number that every Polish
Social Security Number must pass

Number Delimiter Validates a match by checking the surrounding characters.

 Library of system data identifiers 1012
Polish Tax Identification Number

Polish Social Security Number (PESEL) narrow breadth

The narrow breadth detects an 11-digit number that passes checksum validation. It also
requires the presence of PESEL-related keywords.

Table 37-509 Polish Social Security Number (PESEL) narrow breadth patterns

Pattern

\d{2}[012389]\d[0-3]\d{6}

Table 37-510 Polish Social Security Number (PESEL) narrow breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Polish Social Security Number Validation Check Validator computes checksum number that every Polish
Social Security Number must pass.

Validator computes checksum number that every Polish

Social Security Number must pass

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:
PESEL ID, polish SSN, social security number, social
security no, SSN#, PESELID#, peselno#, pesel number,
social security code, PESEL Liczba, społeczny
bezpieczeństwo liczba, społeczny bezpieczeństwo ID,
społeczny bezpieczeństwo kod, PESELliczba#,
społecznybezpieczeństwoliczba#

Polish Tax Identification Number

The Polish Tax Identification Number (NIP) is a number the government gives to every Poland
citizen who works or does business in Poland. All taxpayers have a tax identification number
called NIP.
The Polish Tax Identification Number (NIP) system data identifier provides three breadths of
detection:
■ The wide breadth detects a 10-digit number without checksum validation.
See “Polish Tax Identification Number wide breadth” on page 1013.
 Library of system data identifiers 1013
Polish Tax Identification Number

■ The medium breadth detects a 10-digit number with checksum validation.

See “Polish Tax Identification Number medium breadth” on page 1013.
■ The narrow breadth detects a 10-digit number that passes checksum validation. It also
requires the presence of NIP-related keywords.
See “Polish Tax Identification Number narrow breadth” on page 1014.

Polish Tax Identification Number wide breadth

The wide breadth detects a 10-digit number without checksum validation.

Table 37-511 Polish Tax Identification Number wide-breadth patterns

Pattern

\d{10}

\d{3}[ -]\d{3}[ -]\d{2}[ -]\d{2}

\d{3}[ -]\d{2}[ -]\d{2}[ -]\d{3}

Table 37-512 Polish Tax Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Polish Tax Identification Number medium breadth

The medium breadth detects a 10-digit number with checksum validation.

Table 37-513 Polish Tax Identification Number medium-breadth patterns

Pattern

\d{10}

\d{3}[ -]\d{3}[ -]\d{2}[ -]\d{2}

\d{3}[ -]\d{2}[ -]\d{2}[ -]\d{3}

Table 37-514 Polish Tax Identification Number medium breadth-validators

Mandatory validator Description

Polish Social Security Number Validation Check Validator computes checksum number that every Polish
Tax ID number must pass.
 Library of system data identifiers 1014
Polish Tax Identification Number

Table 37-514 Polish Tax Identification Number medium breadth-validators (continued)

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Polish Tax Identification Number narrow breadth

The narrow breadth detects a 10-digit number that passes checksum validation. It also requires
the presence of NIP-related keywords.

Table 37-515 Polish Tax Identification Number narrow-breadth patterns

Pattern

\d{10}

\d{3}[ -]\d{3}[ -]\d{2}[ -]\d{2}

\d{3}[ -]\d{2}[ -]\d{2}[ -]\d{3}

Table 37-516 Polish Tax Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Polish Tax ID Number Validation Check Validator computes checksum number that every Polish
Tax ID number must pass.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Tax Number, tax number, tax no., taxno#, taxnumber#,

taxnumber, NIP, NIP#, Tax ID, taxid#, TAXID#, NIP ID,
NIPID#, nip#, tax identification number, tax
identification no., VAT Number, VAT No., vatno#, VAT
ID, VATID#, Numer Identyfikacji Podatkowej, Polski
numer identyfikacji podatkowej,
NumerIdentyfikacjiPodatkowej#, NIP
 Library of system data identifiers 1015
Randomized US Social Security Number (SSN)

Randomized US Social Security Number (SSN)

The Randomized US Social Security Number (SSN) data identifier detects 9-digit numbers
with the pattern DDD-DD-DDDD, separated with dashes or spaces or without separators. The
number must be in valid assigned number ranges. Pattern validators eliminate common test
numbers, such as 123456789 or all the same digit. The data identifier is narrow in breadth
and requires the presence of a Social Security-related keyword.
In Symantec Data Loss Prevention version 12.5, the Randomized US SSN data identifier
replaced the US Social Security Number (SSN) data identifier. All policy templates that
implement the US SSN data identifier are updated to use the system-defined Randomized US
SSN data identifier. In addition, in version 14.0 the patterns and validators for the Randomized
US SSN data identifier were updated from the 12.5 version of the Randomized US SSN data
identifier. Symantec recommends that you update your policies to use the version 14.0 or later
Randomized US SSN data identifier.
See “Updating policies to use the Randomized US SSN data identifier” on page 665.
See “Use the Randomized US SSN data identifier to detect SSNs” on page 684.
The Randomized US SSN data identifier provides two breadths of detection:
■ The medium breadth detects a 9-digit number in the format DDD-DD-DDDD. The digits
must be in assigned number ranges.
See “Randomized US Social Security Number (SSN) medium breadth” on page 1015.
■ The narrow breadth detects a 9-digit number in the format DDD-DD-DDDD. The digits must
be in assigned number ranges. It also requires the presence of SSN-related keywords.
See “Randomized US Social Security Number (SSN) narrow breadth” on page 1016.

Randomized US Social Security Number (SSN) medium breadth

The medium breadth detects a 9-digit number in the format DDD-DD-DDDD. The digits must
be in assigned number ranges.

Table 37-517 Randomized US SSN medium-breadth patterns and normalizer

Component Value Description

Patterns Detects 9-digit numbers with the

[0-8]\d{2} \d{1}[1-9] \d{4}
[0-8]\d{3}[1-9]\d{4}
[0-8]\d{2}[1-9]\d{5}
[0-8]\d{2}-\d{1}[1-9]-\d{4}
[0-8]\d{2} [1-9]\d{1} \d{4}
[0-8]\d{2}-[1-9]\d{1}-\d{4}
pattern DDD-DD-DDDD, separated
with dashes, spaces, or none. The
number must be in valid assigned
number ranges
 Library of system data identifiers 1016
Randomized US Social Security Number (SSN)

Table 37-517 Randomized US SSN medium-breadth patterns and normalizer (continued)

Component Value Description

Data Normalizer Digits See “About data normalizers”

on page 624.

Table 37-518 Randomized US SSN medium breadth validators and input

Active Validators Input (if any) Description

Exclude beginning characters 666, 000, 123456789, 111111111, See “Using pattern validators”
222222222, 333333333, 444444444, on page 672.
555555555, 666666666, 77777777,
888888888

Number Delimiter

Exclude ending characters 0000

Randomized US Social Security Computes the checksum and validates

Number Validation Check the pattern against it.

Randomized US Social Security Number (SSN) narrow breadth

The narrow breadth detects a 9-digit number in the format DDD-DD-DDDD. The digits must
be in assigned number ranges. It also requires the presence of SSN-related keywords.

Table 37-519 Randomized US Social Security Number (SSN) narrow-breadth patterns

Pattern

[0-8]\d{2} \d{1}[1-9] \d{4}

[0-8]\d{3}[1-9]\d{4}

[0-8]\d{2}[1-9]\d{5}

[0-8]\d{2}-\d{1}[1-9]-\d{4}

[0-8]\d{2} [1-9]\d{1} \d{4}

[0-8]\d{2}-[1-9]\d{1}-\d{4}

Table 37-520
Validator Description

Number Delimiter Validates a match by checking the surrounding characters.

 Library of system data identifiers 1017
Romanian Numerical Personal Code

Table 37-520 (continued)

Validator Description

Exclude beginning characters Excludes the following beginning characters:

666, 000, 123456789, 111111111, 222222222,
333333333, 444444444, 555555555, 666666666,
77777777, 888888888

Exclude ending characters Excludes the following ending characters:

0000

Find keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

social security number, ssn, ss#

Randomized US Social Security Number Validation Computes the checksum and validates the pattern against
Check it.

Romanian Numerical Personal Code

In Romania, each citizen has a unique numerical personal code (Code Numeric Personal, or
CNP). The number is used by authorities, health care, schools, universities, banks, and
insurance companies for customer identification.
The Romanian Numerical Personal Code system data identifier provides three breadths of
detection:
■ The wide breadth detects a 13-digit number without checksum validation.
See “ Romanian Numerical Personal Code wide breadth” on page 1017.
■ The medium breadth detects a 13-digit number with checksum validation.
See “ Romanian Numerical Personal Code medium breadth” on page 1018.
■ The narrow breadth a 13-digit number that passes checksum validation. It also requires
the presence of CNP-related keywords.
See “ Romanian Numerical Personal Code narrow breadth” on page 1018.

Romanian Numerical Personal Code wide breadth

The wide breadth detects a 13-digit number without checksum validation.
 Library of system data identifiers 1018
Romanian Numerical Personal Code

Table 37-521 Romanian Numerical Personal Code wide-breadth pattern

Pattern

[1-9]\d\d[0-1]\d[0-3]\d{7}

Table 37-522 Romanian Numerical Personal Code wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Romanian Numerical Personal Code medium breadth

The medium breadth detects a 13-digit number with checksum validation.

Table 37-523 Romanian Numerical Personal Code medium-breadth pattern

Pattern

[1-9]\d\d[0-1]\d[0-3]\d{7}

Table 37-524 Romanian Numerical Personal Code medium-breadth validators

Mandatory validator Description

Romanian Numerical Personal Code Check Validator computes checksum number that every
Romanian Numerical Personal Code number must pass.

Number Delimiter Validates a match by checking the surrounding characters.

Romanian Numerical Personal Code narrow breadth

The narrow breadth a 13-digit number that passes checksum validation. It also requires the
presence of CNP-related keywords.

Table 37-525 Romanian Numerical Personal Code narrow-breadth pattern

Pattern

[1-9]\d\d[0-1]\d[0-3]\d{7}

Table 37-526 Romanian Numerical Personal Code narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.
 Library of system data identifiers 1019
Russian Passport Identification Number

Table 37-526 Romanian Numerical Personal Code narrow-breadth validators (continued)

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Romanian Numerical Personal Code Check Validator computes checksum every Romanian Numerical
Personal Code must pass.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Personal Numeric Code, unique identification number,

CNP, CNP#, PIN, PIN#, Insurance Number,
insurancenumber#, unique identity number,
uniqueidentityno#, Cod Numeric Personal, cod
identificare personal, cod unic identificare, număr
personal unic, număr identitate, număr identificare
personal, număridentitate#, CodNumericPersonal#,
numărpersonalunic#

Russian Passport Identification Number

Russia issues two types of passports: domestic and international. Every Russian citizen has
a domestic passport. It is the main document used for personal identification.
The Russian Passport Identification Number data identifier provides two breadths of detection:
■ The wide breadth detects a 10-digit number without checksum validation.
See “Russian Passport Identification Number wide breadth” on page 1019.
■ The narrow breadth detects a 10-digit number that passes checksum validation. It also
requires the presence of Russian Passport Identification Number-related keywords.
See “Russian Passport Identification Number narrow breadth” on page 1020.

Russian Passport Identification Number wide breadth

The wide breadth detects a 10-digit number without checksum validation.

Table 37-527 Russian Passport Identification Number wide-breadth patterns

Pattern

\d{10}
 Library of system data identifiers 1020
Russian Passport Identification Number

Table 37-527 Russian Passport Identification Number wide-breadth patterns (continued)

Pattern

\d{4}[ ]\d{6}

\d{2}[- ]\d{2}[ ]\d{6}

Table 37-528 Russian Passport Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Russian Passport Identification Number narrow breadth

The narrow breadth detects a 10-digit number that passes checksum validation. It also requires
the presence of Russian Passport Identification Number-related keywords.

Table 37-529 Russian Passport Identification Number narrow-breadth patterns

Pattern

\d{10}

\d{4}[ ]\d{6}

\d{2}[- ]\d{2}[ ]\d{6}

Table 37-530 Russian Passport Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

Find Keywords If you select this option, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

passport number, passport no, passport ID,

passportnumber#, passportno#, russian passport ID,
паспорт нет, паспорт, номер паспорта, паспорт ID,
Российской паспорт, Русский номер паспорта,
паспорт#, паспортID#, номерпаспорта#
 Library of system data identifiers 1021
Russian Taxpayer Identification Number

Russian Taxpayer Identification Number

The Russian Taxpayer Identification Number (TIN or INN) is a multi-digit number that enables
the tax inspectorate to identify the tax status of legal entities and individuals.
This data identifier provides the following breadths of detection:
■ The wide breadth detects a 10- or 12-digit number without checksum validation.
See “Russian Taxpayer Identification Number wide breadth” on page 1021.
■ The medium breadth validates the detected number using the final check digit and eliminates
common test numbers.
See “Russian Taxpayer Identification Number medium breadth” on page 1021.
■ The narrow breadth detects a 10- or 12-digit number that passes checksum validation. It
also requires the presence of Russian Taxpayer Identification Number-related keywords.
See “Russian Taxpayer Identification Number narrow breadth” on page 1022.

Russian Taxpayer Identification Number wide breadth

The wide breadth detects a 10- or 12-digit number without checksum validation.

Table 37-531 Russian Taxpayer Identification Number wide-breadth patterns

Pattern

\d{10}

\d{12}

\d{3}[ -]\d{3}[ -]\d{3}[ -]\d{3}

Table 37-532 Russian Taxpayer Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Russian Taxpayer Identification Number medium breadth

The medium breadth detects a 10- or 12-digit number with checksum validation.

Table 37-533 Russian Taxpayer Identification Number medium-breadth patterns

Pattern

\d{10}
 Library of system data identifiers 1022
Russian Taxpayer Identification Number

Table 37-533 Russian Taxpayer Identification Number medium-breadth patterns (continued)

Pattern

\d{12}

\d{3}[ -]\d{3}[ -]\d{3}[ -]\d{3}

Table 37-534 Russian Taxpayer Identification Number medium-breadth validators

Mandatory validator Description

Russian Taxpayer Identification Number Validation Check Validator computes checksum number that every Russian
Taxpayer Identification number must pass.

Number delimiter Validates a match by checking the surrounding numbers.

Russian Taxpayer Identification Number narrow breadth

The narrow breadth detects a 10- or 12-digit number that passes checksum validation. It also
requires the presence of Russian Taxpayer Identification Number-related keywords.

Table 37-535 Russian Taxpayer Identification Number narrow-breadth patterns

Pattern

\d{10}

\d{12}

\d{3}[ -]\d{3}[ -]\d{3}[ -]\d{3}

Table 37-536 Russian Taxpayer Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same

Russian Taxpayer Identification Number Validation Check Validator computes checksum number that every Russian
Taxpayer Identification number must pass.

Duplicate digits Ensures that a string of digits is not all the same.
 Library of system data identifiers 1023
Singapore NRIC data identifier

Table 37-536 Russian Taxpayer Identification Number narrow-breadth validators (continued)

Mandatory validator Description

Find keywords If you select this option, you have to use at least one of
the following keywords or key phrases must be present
for the data to be matched.

Inputs:

TIN, taxpayer number, taxpayer ID, taxpayer no, tax

ID, tin,tinno#, inn, inn#, taxpayerno#, taxid#,
taxpayeridno#, taxpayerid#, НДС, номер
налогоплательщика, Налогоплательщика ИД, налог
число, налогчисло#, ИНН#, НДС#

Singapore NRIC data identifier

The Singapore NRIC (National Registration Identity Card) is the identity document used in
Singapore. The NRIC is a required document for some government procedures, commercial
transactions such as the opening of a bank account, or to gain entry to premises by surrendering
or exchanging for an entry pass.
The wide breadth of the Singapore NRIC data identifier detects nine characters in the pattern
LDDDDDDDL. The last character is used to validate a checksum.

Table 37-537 Singapore NRIC wide-breadth pattern

Pattern

[SFTGsftg]\d{7}\w

Table 37-538 Singapore NRIC wide-breadth validator

Mandatory validator Description

Singapore NRIC Computes the Singapore NRIC checksum and validates

the pattern against it.

South African Personal Identification Number

Every citizen has a national identification number in South Africa. The number serves as proof
of identification.
This data identifier provides the following breadths of detection:
■ The wide breadth detects a 13-digit number without checksum validation.
 Library of system data identifiers 1024
South African Personal Identification Number

See “South African Personal Identification Number wide breadth” on page 1024.
■ The medium breadth detects a 13-digit number with checksum validation.
See “South African Personal Identification Number medium breadth” on page 1024.
■ The narrow breadth detects a 13-digit number that passes checksum validation. It also
requires the presence of South African Personal Identification Number-related keywords.
See “South African Personal Identification Number narrow breadth” on page 1025.

South African Personal Identification Number wide breadth

The wide breadth detects a 13-digit number without checksum validation.

Table 37-539 South African Personal Identification Number wide-breadth patterns

Pattern

[0123678]\d{8}

[0123678]\d{3}-\d{4}-\d

Table 37-540 South African Personal Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

South African Personal Identification Number medium breadth

The medium breadth detects a 13-digit number with checksum validation.

Table 37-541 South African Personal Identification Number medium-breadth patterns

Pattern

\d{6}[ -]\d{4}[ -][01]\d{2}

\d{10}[01]\d{2}

Table 37-542 South African Personal Identification Number medium-breadth validators

Mandatory validator Description

South African Personal Identification Number Validation Validator computes checksum number that every South
Check African Personal Identification number must pass.

Number delimiter Validates a match by checking the surrounding numbers.

 Library of system data identifiers 1025
Spain Driver's License Number

South African Personal Identification Number narrow breadth

The narrow breadth detects a 13-digit number that passes checksum validation. It also requires
the presence of South African Personal Identification Number-related keywords.

Table 37-543 South African Personal Identification Number narrow-breadth patterns

Pattern

\d{6}[ -]\d{4}[ -][01]\d{2}

\d{10}[01]\d{2}

Table 37-544 South African Personal Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

South African Personal Identification Number Validation Validator computes checksum number that every South
Check African Personal Identification number must pass.

Find Keywords If you select this option selected, at least one of the
following keywords or key phrases must be present for the
data to be matched.

Inputs:

national identification number, national identity

number, national insurance number, personal identity
number, personal identification number, insurance
number, nationalid#, personalidentityno#, unique
identity number, uniqueidentityno#, nasionale
identifikasie nommer, nasionale identiteitsnommer,
versekering aantal, persoonlike identiteitsnommer,
unieke identiteitsnommer, identiteitsnommer,
identiteitsnommer#, versekeringaantal#,
nasionaleidentiteitsnommer#

Spain Driver's License Number

Identification number for an individual's driver's licence issued by the Driver and Vehicle
Licensing Agency of the Spain.
The Spain Driver's License Number data identifier provides two breadths of detection:
 Library of system data identifiers 1026
Spain Driver's License Number

■ The wide breadth detects a nine-character alphanumeric pattern without checksum

validation. It also requires the presence of related keywords.
See “Spain Driver's License Number wide breadth” on page 1026.
■ The narrow breadth detects a nine-character alphanumeric pattern with checksum validation.
It also requires the presence of related keywords.
See “Spain Driver's License Number narrow breadth” on page 1027.

Spain Driver's License Number wide breadth

The wide breadth detects a nine-character alphanumeric pattern without checksum validation.
It also requires the presence of related keywords.

Table 37-545 Spain Driver's License Number wide-breadth pattern

Pattern

\d{8}\w

\d{8}[- ]\w

\d{8}[ ][-]\w

\d{8}[ ][-][ ]\w

Table 37-546 Spain Driver's License Number wide-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding characters.

 Library of system data identifiers 1027
Spain Driver's License Number

Table 37-546 Spain Driver's License Number wide-breadth validators (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

DLNo#, dlno#, DL#, Drivers Lic., driver licence, driver

license, drivers licence, drivers license, driver's
licence, driver's license, driving licence, driving
license, driver licence number, driver license number,
drivers licence number, drivers license number,
driver's licence number, driver's license number,
driving licence number, driving license number, driving
permit, driving permit number, permiso de conducción,
permiso conducción, Número licencia conducir,
Número de carnet de conducir, Número carnet
conducir, licencia conducir, Número de permiso de
conducir, Número de permiso conducir, Número
permiso conducir, permiso conducir, licencia de
manejo, el carnet de conducir, carnet conducir

Spain Driver's License Number narrow breadth

The narrow breadth detects a nine-character alphanumeric pattern with checksum validation.
It also requires the presence of related keywords.

Table 37-547 Spain Driver's License Number narrow-breadth patterns

Pattern

\d{8}\w

\d{8}[- ]\w

\d{8}[ ][-]\w

\d{8}[ ][-][ ]\w

Table 37-548 Spain Driver's License Number narrow-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding characters.

DNI control key check Computes the control key and checks if it is valid.
 Library of system data identifiers 1028
Spanish Customer Account Number

Table 37-548 Spain Driver's License Number narrow-breadth validators (continued)

Mandatory validator Description

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

DLNo#, dlno#, DL#, Drivers Lic., driver licence, driver

license, drivers licence, drivers license, driver's
licence, driver's license, driving licence, driving
license, driver licence number, driver license number,
drivers licence number, drivers license number,
driver's licence number, driver's license number,
driving licence number, driving license number, driving
permit, driving permit number, permiso de conducción,
permiso conducción, Número licencia conducir,
Número de carnet de conducir, Número carnet
conducir, licencia conducir, Número de permiso de
conducir, Número de permiso conducir, Número
permiso conducir, permiso conducir, licencia de
manejo, el carnet de conducir, carnet conducir

Spanish Customer Account Number

The Spanish customer account number is the standard customer bank account number used
across Spain.
This data identifier provides the following breadths of detection:
■ The wide breadth detects a 20-digit number without checksum validation.
See “Spanish Customer Account Number wide breadth” on page 1028.
■ The medium breadth detects a 20-digit number with checksum validation.
See “Spanish Customer Account Number medium breadth” on page 1029.
■ The narrow breadth detects a 20-digit number that passes checksum validation. It also
requires the presence of Spanish Customer Account Number-related keywords.
See “Spanish Customer Account Number narrow breadth” on page 1029.

Spanish Customer Account Number wide breadth

The wide breadth detects a 20-digit number without checksum validation.
 Library of system data identifiers 1029
Spanish Customer Account Number

Table 37-549 Spanish Customer Account Number wide-breadth patterns

Pattern

\d{20}

\d{4}[ -/]\d{4}[ -/]\d{2}[ -/]\d{10}

0128[ -/]\d{4}[ -/]\d{2}[ -/]\d{10}

0128\d{16}

Table 37-550 Spanish Customer Account Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Spanish Customer Account Number medium breadth

The medium breadth detects a 20-digit number with checksum validation.

Table 37-551 Spanish Customer Account Number medium-breadth patterns

Pattern

\d{20}

\d{4}[ -/]\d{4}[ -/]\d{2}[ -/]\d{10}

0128[ -/]\d{4}[ -/]\d{2}[ -/]\d{10}

0128\d{16}

Table 37-552 Spanish Customer Account Number medium-breadth validator

Mandatory validator Description

Spanish Customer Account Number Validation Check Validator computes checksum number that every Spanish
Customer Account number must pass.

Number Delimiter Validates a match by checking the surrounding characters.

Spanish Customer Account Number narrow breadth

The narrow breadth detects a 20-digit number that passes checksum validation. It also requires
the presence of Spanish Customer Account Number-related keywords.
 Library of system data identifiers 1030
Spanish DNI ID

Table 37-553 Spanish Customer Account Number narrow-breadth patterns

Pattern

\d{20}

\d{4}[ -/]\d{4}[ -/]\d{2}[ -/]\d{10}

0128[ -/]\d{4}[ -/]\d{2}[ -/]\d{10}

0128\d{16}

Table 37-554 Spanish Customer Account Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Spanish Customer Account Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords At least one of the following keywords or key phrases must
be present for he data to match when you use this option.

Inputs:

customer account number, account code, customer

account ID, customer bank account ID, bank account
number, spanish customer bank code, account
number, accountno#, accountnumber#, número cuenta
cliente, código cuenta, cuenta cliente ID, número
cuenta bancaria cliente, código cuenta bancaria

Spanish DNI ID
The Spanish DNI ID appears on the Documento nacional de identidad (DNI) and is issued by
the Spanish Hacienda Publica to every citizen of Spain. It is the most important unique identifier
in Spain used for opening accounts, signing contracts, taxes, and elections.
The Spanish DNI ID data identifier provides two breadths of detection:
■ The wide breadth detects an 8-digit number followed by a hyphen and letter. The last letter
must match a checksum algorithm.
See “Spanish DNI ID wide breadth” on page 1031.
 Library of system data identifiers 1031
Spanish DNI ID

■ The narrow breadth detects an 8-digit number followed by a hyphen and letter. The last
letter must match a checksum algorithm. It also requires the presence of Spanish DNI-related
keywords.
See “Spanish DNI ID narrow breadth” on page 1031.

Spanish DNI ID wide breadth

The wide breadth detects an 8-digit number followed by a hyphen and letter. The last letter
must match a checksum algorithm.

Table 37-555 Spanish DNI ID wide-breadth patterns

Pattern

\d{7}\w

\d{7}[- ]\w

\d{7}[ ][-]\w

\d{7}[ ][-][ ]\w

Table 37-556 Spanish DNI ID wide-breadth validator

Mandatory validator Description

DNI control key check Computes the control key and checks if it is valid.

Spanish DNI ID narrow breadth

The narrow breadth detects an 8-digit number followed by a hyphen and letter. The last letter
must match a checksum algorithm. It also requires the presence of Spanish DNI-related
keywords.

Table 37-557 Spanish DNI ID narrow-breadth patterns

Pattern

\d{7}\w

\d{7}[- ]\w

\d{7}[ ][-]\w

\d{7}[ ][-][ ]\w

 Library of system data identifiers 1032
Spanish Passport Number

Table 37-558 Spanish DNI ID narrow-breadth validators

DNI control key check Computes the control key and checks if it is valid.

Find keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

DNI, National Identification Number, national identity

number, insurance number, personal identification
number, national identity, personal identity no, unique
identity number, nationalidno#, uniqueid#, DNI#,
nationalID#, DNINúmero#, Identidadúnico#, NIE ID,
Spanish NIE ID, Spanish NIE Number, NIE, NIE#,
NIEnúmero#, NIE número, Documento Nacional de
Identidad, Identidad único, Número nacional identidad,
DNI Número

Spanish Passport Number

Spanish passports are issued to Spanish citizens for the purpose of travel outside Spain.
The Spanish Passport Number data identifier provides two breadths of detection:
■ The wide breadth detects a valid Spanish Passport Number pattern.
See “Spanish Passport Number wide breadth” on page 1032.
■ The narrow breadth detects a valid Spanish Passport Number pattern. It also requires the
presence of related keywords.
See “Spanish Passport Number narrow breadth” on page 1033.

Spanish Passport Number wide breadth

The wide breadth detects a valid Spanish Passport Number pattern.

Table 37-559 Spanish Passport Number wide-breadth patterns

Patterns

\l{2}\d{6}

\l{2}-\d{6}

\l{2} \d{6}
 Library of system data identifiers 1033
Spanish Passport Number

Table 37-559 Spanish Passport Number wide-breadth patterns (continued)

Patterns

\l{3}\d{6}

\l{3}-\d{6}

\l{3} \d{6}

Table 37-560 Spanish Passport Number wide-breadth validator

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding characters.

Spanish Passport Number narrow breadth

The narrow breadth detects a valid Spanish Passport Number pattern. It also requires the
presence of related keywords.

Table 37-561 Spanish Passport Number narrow-breadth patterns

Patterns

\l{2}\d{6}

\l{2}-\d{6}

\l{2} \d{6}

\l{3}\d{6}

\l{3}-\d{6}

\l{3} \d{6}

Table 37-562 Spanish Passport Number narrow-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding characters.

 Library of system data identifiers 1034
Spanish Social Security Number

Table 37-562 Spanish Passport Number narrow-breadth validators (continued)

Mandatory validator Description

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

passport, Passport, Spain Passport, spain passport,

passport book, Passport Book, passport number,
passport no, Passport Number, libreta pasaporte,
número pasaporte, Número Pasaporte, España
pasaporte, pasaporte

Spanish Social Security Number

The Spanish Social Security Number is a 12-digit number assigned to Spanish workers to
allow access to the Spanish healthcare system.
The Spanish Social Security Number system data identifier provides three breadths of detection:
■ The wide breadth detects a 12-digit number without checksum validation.
See “Spanish Social Security Number wide breadth” on page 1034.
■ The medium breadth detects a 12-digit number with checksum validation.
See “Spanish Social Security Number medium breadth” on page 1035.
■ The narrow breadth detects a 12-digit number that passes checksum validation. It also
requires the presence of Spanish Social Security Number-related keywords.
See “Spanish Social Security Number narrow breadth” on page 1035.

Spanish Social Security Number wide breadth

The wide breadth detects a 12-digit number without checksum validation.

Table 37-563 Spanish Social Security Number wide-breadth patterns

Pattern

\d{12}

\d{2}[/]\d{8}[/]\d{2}

\d{2}[-]\d{8}[-]\d{2}
 Library of system data identifiers 1035
Spanish Social Security Number

Table 37-564 Spanish Social Security Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Spanish Social Security Number medium breadth

The medium breadth detects a 12-digit number with checksum validation.

Table 37-565 Spanish Social Security Number medium-breadth patterns

Pattern

\d{12}

\d{2}[/]\d{8}[/]\d{2}

\d{2}[-]\d{8}[-]\d{2}

Table 37-566 Spanish Social Security Number medium-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Spanish SSN Number Validation Check Computes the checksum and validates the pattern against
it.

Spanish Social Security Number narrow breadth

The narrow breadth detects a 12-digit number that passes checksum validation. It also requires
the presence of Spanish Social Security Number-related keywords.

Table 37-567 Spanish Social Security Number narrow breadth patterns

Pattern

\d{12}

\d{2}[/]\d{8}[/]\d{2}

\d{2}[-]\d{8}[-]\d{2}
 Library of system data identifiers 1036
Spanish Tax Identification (CIF)

Table 37-568 Spanish Social Security Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Spanish SSN Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

SSN, social security number, SSN#, social security

no., socialsecurityno#, Social Security Number, Social
Security No. Número de la Seguridad Social, número
de la seguridad social

Spanish Tax Identification (CIF)

The Spanish Tax Identification corporate tax identifier (CIF) is equivalent to the VAT number,
required for running a business in Spain. This identifier is a company's identification for tax
purposes and is required for any legal transactions.
The Spanish Tax Identification (CIF) system data identifier provides three breadths of detection:
■ The wide breadth detects a 9-digit alphanumeric identifier without checksum validation.
See “Spanish Tax Identification (CIF) wide breadth” on page 1036.
■ The medium breadth detects a 9-digit alphanumeric identifier with checksum validation.
See “Spanish Tax Identification (CIF) medium breadth” on page 1037.
■ The narrow breadth detects a 9-digit alphanumeric identifier with checksum validation. It
also requires the presence of CIF-related keywords.
See “Spanish Tax Identification (CIF) narrow breadth” on page 1038.

Spanish Tax Identification (CIF) wide breadth

The wide breadth detects a 9-digit alphanumeric identifier without checksum validation.

Table 37-569 Spanish Tax Identification (CIF) wide-breadth patterns

Pattern

[KPQS]\d{7}[A-J]
 Library of system data identifiers 1037
Spanish Tax Identification (CIF)

Table 37-569 Spanish Tax Identification (CIF) wide-breadth patterns (continued)

Pattern

[KPQS]-\d{7}[A-J]

[ABEH]\d{7}[0-9]

[ABEH]-\d{7}[0-9]

[CDFGJLMNRUVW]\d{7}[A-J0-9]

[CDFGJLMNRUVW]-\d{7}[A-J0-9]

Table 37-570 Spanish Tax Identification (CIF) wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Spanish Tax Identification (CIF) medium breadth

The medium breadth detects a 9-digit alphanumeric identifier with checksum validation.

Table 37-571 Spanish Tax Identification (CIF) medium-breadth patterns

Pattern

[KPQS]\d{7}[A-J]

[KPQS]-\d{7}[A-J]

[ABEH]\d{7}[0-9]

[ABEH]-\d{7}[0-9]

[CDFGJLMNRUVW]\d{7}[A-J0-9]

[CDFGJLMNRUVW]-\d{7}[A-J0-9]

Table 37-572 Spanish Tax Identification (CIF) medium-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Spanish Tax ID Number Validation Check Computes the checksum and validates the pattern against
it.
 Library of system data identifiers 1038
Spanish Tax Identification (CIF)

Spanish Tax Identification (CIF) narrow breadth

The narrow breadth detects a 9-digit alphanumeric identifier with checksum validation. It also
requires the presence of CIF-related keywords.

Table 37-573 Spanish Tax Identification (CIF) narrow-breadth patterns

Pattern

[KPQS]\d{7}[A-J]

[KPQS]-\d{7}[A-J]

[ABEH]\d{7}[0-9]

[ABEH]-\d{7}[0-9]

[CDFGJLMNRUVW]\d{7}[A-J0-9]

[CDFGJLMNRUVW]-\d{7}[A-J0-9]

Table 37-574 Spanish Tax Identification (CIF) narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Spanish Tax ID Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

tax ID, tax ID number, CIF ID, CIF no, spanish CIF ID,
cif, tax file no, spanish CIF number, tax file number,
spanish CIF no, tax no, tax number, tax id, taxid#,
taxno#, CIFid#, CIFID#, spanishCIFID#, spanishCIFno#,
cifid#, número de contribuyente, número de impuesto
corporativo, número de Identificación fiscal, CIF
número, CIFnúmero#
 Library of system data identifiers 1039
Swedish Passport Number

Swedish Passport Number

Swedish passports are issued to nationals of Sweden for the purpose of international travel.
Besides serving as proof of Swedish citizenship, they facilitate the process of securing
assistance from Swedish consular officials abroad or other European Union member states
in case a Swedish consular is absent, if needed.
The Swedish Passport Number data identifier provides two breadths of detection:
■ The wide breadth detects a valid Swedish Passport Number pattern.
See “Swedish Passport Number wide breadth” on page 1039.
■ The narrow breadth detects a valid Swedish Passport Number pattern. It also requires the
presence of related keywords.
See “Swedish Passport Number narrow breadth” on page 1039.

Swedish Passport Number wide breadth

The wide breadth detects a valid Swedish Passport Number pattern.

Table 37-575 Swedish Passport Number wide-breadth patterns

Patterns

\d{8}

\d{2}-\d{6}

\l{2}-\d{6}

Table 37-576 Swedish Passport Number wide-breadth validator

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding characters.

Swedish Passport Number narrow breadth

The narrow breadth detects a valid Swedish Passport Number pattern. It also requires the
presence of related keywords.

Table 37-577 Swedish Passport Number narrow-breadth patterns

Patterns

\d{8}

\d{2}-\d{6}
 Library of system data identifiers 1040
Swedish Personal Identification Number

Table 37-577 Swedish Passport Number narrow-breadth patterns (continued)

Patterns

\l{2}-\d{6}

Table 37-578 Swedish Passport Number narrow-breadth validators

Mandatory validator Description

Number delimiter Validates a match by checking the surrounding characters.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

passport, Passport, Sweden Passport, Swedish

passport, passport number, passport no, Passport
Number, Passnummer, pass, sverige pass, SVERIGE
PASS, sverige Passnummer

Swedish Personal Identification Number

The Swedish Personal Identification Number is the unique national identification for Swedish
every citizen. The number is used by authorities, health care, schools, universities, banks, and
insurance companies for customer identification.
The Swedish Personal Identification Number system data identifier provides three breadths
of detection:
■ The wide breadth detects a 10- or 12-digit number without checksum validation.
See “Swedish Personal Identification Number wide breadth” on page 1040.
■ The medium breadth detects a 10- or 12-digit number with checksum validation.
See “Swedish Personal Identification Number medium breadth ” on page 1041.
■ The narrow breadth detects a 10- or 12-digit number that passes checksum validation. It
also requires the presence of Swedish Personal Identification Number-related keywords.
See “Swedish Personal Identification Number narrow breadth” on page 1042.

Swedish Personal Identification Number wide breadth

The wide breadth detects a 10- or 12-digit number without checksum validation.
 Library of system data identifiers 1041
Swedish Personal Identification Number

Table 37-579 Swedish Personal Identification Number wide-breadth patterns

Pattern

\d\d[01]\d[01236789]\d[-]\d\d\d\d

\d\d[01]\d[01236789]\d[+]\d\d\d\d

\d\d[01]\d[01236789]\d\d\d\d\d

[12][098]\d\d[01]\d[01236789]\d[-]\d\d\d\d

[12][098]\d\d[01]\d[01236789]\d[+]\d\d\d\d

[12][098]\d\d[01]\d[01236789]\d\d\d\d\d

Table 37-580 Swedish Personal Identification Number wide-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Swedish Personal Identification Number medium breadth

The medium breadth detects a 10- or 12-digit number with checksum validation.

Table 37-581 Swedish Personal Identification Number medium-breadth patterns

Pattern

\d\d[01]\d[01236789]\d[-]\d\d\d\d

\d\d[01]\d[01236789]\d[+]\d\d\d\d

\d\d[01]\d[01236789]\d\d\d\d\d

[12][098]\d\d[01]\d[01236789]\d[-]\d\d\d\d

[12][098]\d\d[01]\d[01236789]\d[+]\d\d\d\d

[12][098]\d\d[01]\d[01236789]\d\d\d\d\d

Table 37-582 Swedish Personal Identification Number medium-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Swedish Personal Identification Number Validation Check Computes the checksum and validates the pattern against
it.
 Library of system data identifiers 1042
Swedish Personal Identification Number

Swedish Personal Identification Number narrow breadth

The narrow breadth detects a 10- or 12-digit number that passes checksum validation. It also
requires the presence of Swedish Personal Identification Number-related keywords.

Table 37-583 Swedish Personal Identification Number narrow-breadth patterns

Pattern

\d\d[01]\d[01236789]\d[-]\d\d\d\d

\d\d[01]\d[01236789]\d[+]\d\d\d\d

\d\d[01]\d[01236789]\d\d\d\d\d

[12][098]\d\d[01]\d[01236789]\d[-]\d\d\d\d

[12][098]\d\d[01]\d[01236789]\d[+]\d\d\d\d

[12][098]\d\d[01]\d[01236789]\d\d\d\d\d

Table 37-584 Swedish Personal Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Swedish Personal Identification Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

personal ID number, identification number, personal

ID no, personal id no, identity no, identification no,
personal identification no, person id no,
personnummer ID, personligt id-nummer, unikt
id-nummer, personnummer, identifikationsnumret,
personnummer#, identifikationsnumret#
 Library of system data identifiers 1043
SWIFT Code

SWIFT Code
The SWIFT Code is a unique identifier for banks and is managed by the Society for Worldwide
Interbank Financial Telecommunications (SWIFT). The SWIFT Code is required for monetary
transfers between financial institutions. It is also known as the Bank Identifier Code (BIC).
The SWIFT Code data identifier detects the presence of the SWIFT Code.
This data identifier provides two breadths of validation:
■ Wide breadth
See “SWIFT Code wide breadth” on page 1043.
■ Narrow breadth
See “SWIFT Code narrow breadth” on page 1043.

SWIFT Code wide breadth

The wide breadth of the SWIFT Code data identifier detects 8- or 11-character strings. The
5th and 6th characters are the country code. This breadth also requires the presence of a
SWIFT-related keyword.

Table 37-585 SWIFT Code wide-breadth patterns

Pattern

[A-Z]{6}\w{2}

[A-Z]{6}\w{5}

Table 37-586 SWIFT Code wide-breadth validators

Mandatory validator Description

Require beginning characters With this option selected, any of the following list of values are required at the
beginning of the matched data.

Find keywords With this option selected, at least one of the following keywords or key phrases
must be present for the data to be matched.

Find keywords input bic, bic#, international organization for standardization 9362, iso 9362,
iso9362, swift, swift#, swiftcode, swiftnumber, swiftroutingnumber

SWIFT Code narrow breadth

The narrow breadth of the SWIFT Code data identifier detects 8- or 11-character strings. The
5th and 6th characters are letters referring to a country code. This breadth also requires the
presence of specific SWIFT-related keywords.
 Library of system data identifiers 1044
Swiss AHV Number

Table 37-587 SWIFT Code narrow- breadth patterns

Pattern

[A-Z]{6}\w{2}

[A-Z]{6}\w{5}

Table 37-588 SWIFT Code narrow-breadth validators

Validator Description

Require beginning characters With this option selected, any of the following list of values are required at the
beginning of the matched data.

Find keywords With this option selected, at least one of the following keywords or keyphrases
must be present for the data to be matched.

Find keywords input bic#, international organization for standardization 9362, iso 9362, iso9362,
swift#, swiftcode, swiftnumber, swiftroutingnumber, swift code, swift
number, swift routing number, bic number, bic code, bic #

Swiss AHV Number

In Switzerland the Old Age and Survivors Insurance Fund number (Alters- und
Hinterlassenenversicherungsnummer or AHV number) is the most important public ID number.
This data identifier provides the following breadths of detection:
■ The wide breadth detects an 11-digit number with checksum validation.
See “Swiss AHV Number wide breadth” on page 1044.
■ The narrow breadth detects an 11-digit number with checksum validation. It also requires
the presence of AHV-related keywords.
See “Swiss AHV Number narrow breadth” on page 1045.

Swiss AHV Number wide breadth

The wide breadth detects an 11-digit number with checksum validation.

Table 37-589 Swiss AHV Number wide-breadth patterns

Pattern

\d{3}.\d{2}.\d{3}.\d{3}

\d{11}
 Library of system data identifiers 1045
Swiss AHV Number

Table 37-590 Swiss AHV Number wide-breadth validators

Mandatory validator Description

Swiss AHV Computes the Swiss AHV Modulus 11 Checksum and

validates the pattern against it.

Number Delimiter Validates a match by checking the surrounding characters.

Swiss AHV Number narrow breadth

The narow breadth detects an 11-digit number with checksum validation. It also requires the
presence of AHV-related keywords.

Table 37-591 Swiss AHV Number narrow-breadth patterns

Pattern

\d{3}.\d{2}.\d{3}.\d{3}

\d{11}

Table 37-592 Swiss AHV Number narrow-breadth validators

Mandatory validator Description

Swiss AHV Computes the Swiss AHV Modulus 11 Checksum and

validates the pattern against it.

Number Delimiter Validates a match by checking the surrounding characters.

Find Keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

Numéro AVS, identifiant national, numéro de sécurité

sociale, Numéro AVH, AVS number, insurance number,
national identifier, national insurance number, social
security number, AVH number, AHV-Nummer,
Personenidentifikationsnummer, Schweizer
Registrierungsnummer, AHV number, Swiss
registration number, PIN, AVH, AVS, numéro
d'assurance vieillesse, numéro d'assuré
 Library of system data identifiers 1046
Swiss Social Security Number (AHV)

Swiss Social Security Number (AHV)

The Swiss Social Security (AHV) number allows Swiss citizens access to the Swiss welfare
system.
The Swiss Social Security Number system data identifier provides three breadths of detection:
■ The wide breadth detects a 13-digit number without checksum validation.
See “Swiss Social Security Number (AHV) wide breadth” on page 1046.
■ The medium breadth detects a 13-digit number without checksum validation.
See “Swiss Social Security Number (AHV) medium breadth” on page 1046.
■ The narrow breadth detects a 13-digit number that passes checksum validation. It also
requires the presence of AHV-related keywords.
See “Swiss Social Security Number (AHV) narrow breadth” on page 1047.

Swiss Social Security Number (AHV) wide breadth

The wide breadth detects a 13-digit number without checksum validation.

Table 37-593 Swiss Social Security Number (AHV) wide-breadth patterns

Pattern

[7][5][6]\d{10}

[7][5][6][.]\d{4}[.]\d{4}[.]\d{2}

Table 37-594 Swiss Social Security Number (AHV) wide-breadth validator

Validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Swiss Social Security Number (AHV) medium breadth

The medium breadth detects a 13-digit number without checksum validation.

Table 37-595 Swiss Social Security Number (AHV) medium-breadth patterns

Pattern

[7][5][6]\d{10}

[7][5][6][.]\d{4}[.]\d{4}[.]\d{2}
 Library of system data identifiers 1047
Swiss Social Security Number (AHV)

Table 37-596 Swiss Social Security Number (AHV) medium-breadth validators

Validator Description

Number Delimiter Validates a match by checking the surrounding numbers.

Swiss Social Security Number Validation Check Computes the checksum and validates the pattern against
it.

Swiss Social Security Number (AHV) narrow breadth

The narrow breadth detects a 13-digit number that passes checksum validation. It also requires
the presence of AHV-related keywords.

Table 37-597 Swiss Social Security Number (AHV) narrow-breadth patterns

Pattern

[7][5][6]\d{10}

[7][5][6][.]\d{4}[.]\d{4}[.]\d{2}

Table 37-598 Swiss Social Security Number (AHV) narrow-breadth validators

Validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding numbers.

Swiss Social Security Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

AHV, SSN, PID, Insurance Number, personalIdno#,

Social Security Number, Personal ID Number, personal
identification no., insuranceno#, uniqueIdno#, unique
identification no., AVS, AHV number, AVS number,
social security number, personalidno#, personal
identity no

Versicherungsnummer, Identifikationsnummer,
einzigartige Identität nicht,
Sozialversicherungsnummer, identification
personnelle ID, numéro de sécurité sociale
 Library of system data identifiers 1048
Taiwan ROC ID

Taiwan ROC ID
In Taiwan an ID card is mandatory for all citizens who are over 14-years old. The ID card has
been uniformly numbered since 1965.
The Taiwan ROC ID data identifier detects the presence of Taiwan identification number based
on two types of common ID patterns. The last character matched is used to validate a checksum.
The Taiwan ROC ID data identifier provides two breadths of detection:
■ The wide breadth detects a Taiwan ROC ID number with checksum validation.
See “Taiwan ROC ID wide breadth” on page 1048.
■ The narrow breadth detects a Taiwan ROC ID number with checksum validation. It also
requires the presence of Taiwan ROC ID-related keywords.
See “Taiwan ROC ID narrow breadth” on page 1048.

Taiwan ROC ID wide breadth

The wide breadth detects a Taiwan ROC ID number with checksum validation.

Table 37-599 Taiwan ROC ID wide-breadth patterns

Patterns

[A-Z][12][0-3]\d{7}

[A-Z][ABCD]\d{8}

Table 37-600 Taiwan ROC ID wide-breadth validator

Validator Description

Taiwan ID Taiwan ID checksum.

Taiwan ROC ID narrow breadth

The narrow breadth detects a Taiwan ROC ID number with checksum validation. It also requires
the presence of Taiwan ROC ID-related keywords.

Table 37-601 Taiwan ROC ID narrow-breadth patterns

Patterns

[A-Z][12][0-3]\d{7}

[A-Z][ABCD]\d{8}
 Library of system data identifiers 1049
Thailand Personal Identification Number

Table 37-602 Taiwan ROC ID narrow-breadth validators

Validator Description

Taiwan ID Taiwan ID checksum.

Find keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

中華民國國民身分證, ROC ID, National Identification

Card, ROCID#

Thailand Personal Identification Number

The Thailand Personal Identification Number is a unique personal identifier assigned at birth
or upon receiving Thai citizenship.
The Thailand Personal Identification Number system data identifier provides three breadths
of detection:
■ The wide breadth detects a 13-digit number without checksum validation.
See “Thailand Personal Identification Number wide breadth” on page 1049.
■ The medium breadth detects a 13-digit number with checksum validation.
See “Thailand Personal Identification Number medium breadth” on page 1050.
■ The narrow breadth detects a 13-digit number with checksum validation. It also requires
the presence of a Thai Personal ID Number-related keyword.
See “Thailand Personal Identification Number narrow breadth” on page 1050.

Thailand Personal Identification Number wide breadth

The wide breadth detects a 13-digit number without checksum validation.

Table 37-603 Thailand Personal Identification Number wide-breadth patterns

Pattern

[1-8]\d{12}

[1-8][ -]\d{4}[ -]\d{5}[ -]\d{2}[ -]\d

 Library of system data identifiers 1050
Thailand Personal Identification Number

Table 37-604 Thailand Personal Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Thailand Personal Identification Number medium breadth

The wide breadth detects a 13-digit number with checksum validation.

Table 37-605 Thailand Personal Identification Number medium-breadth patterns

Pattern

[1-8]\d{12}

[1-8][ -]\d{4}[ -]\d{5}[ -]\d{2}[ -]\d

Table 37-606 Thailand Personal ID Number medium-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Thailand Personal ID Number Validation Check Computes the checksum and validates the pattern against
it.

Thailand Personal Identification Number narrow breadth

The narrow breadth detects a 13-digit number with checksum validation. It also requires the
presence of a Thai Personal ID Number-related keyword.

Table 37-607 Thailand Personal Identification Number narrow-breadth patterns

Pattern

[1-8]\d{12}

[1-8][ -]\d{4}[ -]\d{5}[ -]\d{2}[ -]\d

Table 37-608 Thailand Personal Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

 Library of system data identifiers 1051
Turkish Identification Number

Table 37-608 Thailand Personal Identification Number narrow-breadth validators (continued)

Mandatory validator Description

Thailand Personal ID Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

PID, Insurance Number, Personal ID Number, personal

identification no., unique identification no.,
personalidno#, insuranceno#, personalIdno#,
uniqueIdno#, personal identity no

ประกันภัยจำนวน, หมายเลขประจำตัวส่วนบุคคล,
หมายเลขประจำตัวที่ไม่ซ้ำกัน, ประกันภัยจำนวน#,
หมายเลขประจำตัวส่วนบุคคล#, หมายเลขประจำตัวทีไ ่ มซ้ำกัน#

Turkish Identification Number

The Turkish Identification Number (T.C. Kimlik No.) is a unique 11-digit personal identification
number that is assigned to every citizen of Turkey.
■ The wide breadth detects an 11-digit number without checksum validation.
See “ Turkish Identification Number wide breadth” on page 1051.
■ The medium breadth detects an 11-digit number with checksum validation.
See “Turkish Identification Number medium breadth” on page 1052.
■ The narrow breadth detects an 11-digit number with checksum validation. It also requires
the presence of Turkish Identification Number-related keywords
See “Turkish Identification Number narrow breadth” on page 1052.

Turkish Identification Number wide breadth

The wide breadth detects an 11-digit number without checksum validation.

Table 37-609 Turkish Identification Number wide-breadth pattern

Pattern

[123456789]\d{10}
 Library of system data identifiers 1052
Turkish Identification Number

Table 37-610 Turkish Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Turkish Identification Number medium breadth

The medium breadth detects an 11-digit number with checksum validation.

Table 37-611 Turkish Identification Number medium-breadth pattern

Pattern

[123456789]\d{10}

Table 37-612 Turkish Identification Number medium-breadth validators

Mandatory validator Description

Turkish Identification Number Validation Check Computes the checksum and validates the pattern against
it.

Number delimiter Validates a match by checking the surrounding numbers.

Turkish Identification Number narrow breadth

The narrow breadth detects an 11-digit number with checksum validation. It also requires the
presence of Turkish Identification Number-related keywords

Table 37-613 Turkish Identification Number narrow-breadth patterns

Pattern

[123456789]\d{10}

Table 37-614 Turkish Identification Number narrow-breadth validators

Mandatory validator Description

Turkish Identification Number Validation Check Computes the checksum and validates the pattern against
it.

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

 Library of system data identifiers 1053
UK Drivers Licence Number

Table 37-614 Turkish Identification Number narrow-breadth validators (continued)

Mandatory validator Description

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Identification Number, Personal identification number,

Citizen ID, personal id no, id no#, citizen id no, identity
number, Personal identity no., Kimlik Numarası,
Türkiye Cumhuriyeti Kimlik Numarası, vatandaş kimliği,
kişisel kimlik no, kimlik Numarası#, vatandaş kimlik
numarası, Kişisel kimlik Numarası

UK Drivers Licence Number

The UK Drivers Licence Number is the identification number for an individual's driver's license
issued by the Driver and Vehicle Licensing Agency of the United Kingdom.
The UK Drivers Licence Number data identifier detects the presence of UK Drivers Licence
numbers.
This data identifier provides three breadths of validation:
■ Wide
See “UK Drivers Licence Number wide breadth” on page 1053.
■ Medium
See “UK Drivers Licence Number medium breadth” on page 1054.
■ Narrow
See “UK Drivers Licence Number narrow breadth” on page 1054.

UK Drivers Licence Number wide breadth

The wide breadth detects 16-character strings of the following format:
AAAAAD[0,1,5,6]DDDDAAALL, where A is an alphanumeric character, D a digit, and L a letter.

Note: This breadth option does not include any validators.

 Library of system data identifiers 1054
UK Drivers Licence Number

Table 37-615 UK Drivers Licence Number wide-breadth patterns

Pattern

\w{5}\d[0156]\d{4}\w{3}\l{2}

\w{5} \d[0156]\d{4} \w{3}\l{2}

\w{5}\d[0156]\d{4}\w{3}\l{2}\d{2}

\w{5} \d[0156]\d{4} \w{3}\l{2}\d{2}

UK Drivers Licence Number medium breadth

The medium breadth detects 16-character strings of the following format:
AAAAAD[0,1,5,6]DDDDAAALL, where A is an alphanumeric character, D a digit, and L a letter.
The first digit in the numeric section is restricted to 0,1,5, or 6. In addition, the 4th and 5th
digits in the numeric section must be between 01 and 31, inclusive.

Table 37-616 UK Drivers Licence Number medium-breadth patterns

Pattern

\w{5}\d[0156]\d{4}\w{3}\l{2}

\w{5} \d[0156]\d{4} \w{3}\l{2}

\w{5}\d[0156]\d{4}\w{3}\l{2}\d{2}

\w{5} \d[0156]\d{4} \w{3}\l{2}\d{2}

Table 37-617 UK Drivers Licence Number medium-breadth validator

Mandatory validator Description

UK Drivers License Every UK drivers license must be 16 characters and the number at the 8th and 9th
position must be larger than 00 and smaller than 32.

UK Drivers Licence Number narrow breadth

The narrow breadth detects 16-character strings of the following format:
AAAAAD[0,1,5,6]DDDDAAALL, where A is an alphanumeric character, D is a digit, and L is
a letter.
The first digit is restricted to 0,1,5, or 6. In addition, the 4th and 5th digits in the numeric section
must be between 01 and 31, inclusive.
 Library of system data identifiers 1055
UK Electoral Roll Number

In addition, the narrow breadth also requires the presence of both a driver's license-related
keyword AND a UK-related keyword.

Table 37-618 UK Drivers Licence Number narrow-breadth patterns

Pattern

\w{5}\d[0156]\d{4}\w{3}\l{2}

\w{5} \d[0156]\d{4} \w{3}\l{2}

\w{5}\d[0156]\d{4}\w{3}\l{2}\d{2}

\w{5} \d[0156]\d{4} \w{3}\l{2}\d{2}

Table 37-619 UK Drivers Licence Number narrow-breadth validators

Mandatory validator Description

UK Drivers License Every UK drivers license must be 16 characters and the number at the 8th and 9th
position must be larger than 00 and smaller than 32.

Find keywords: driver's At least one of the following keywords or key phrases must be present for the data
license-related to match:

driver license, drivers license, driver's license, driver licenses, drivers

licenses, driver's licenses, driver licence, drivers licence, driver's licence,
driver licences, drivers licences, driver's licences, dl#, dls#, lic#, lics#

Find keywords: UK-related At least one of the following keywords or keyphrases must be present for the data
to match:

british, the united kingdom, uk, united kingdom, unitedkingdom

UK Electoral Roll Number

The Electoral Roll Number is the identification number issued to an individual for UK election
registration. The format of this number is specified by the UK Government Standards of the
UK Cabinet Office.
The UK Electoral Roll Number data identifier detects the presence of UK Electoral Roll Number.
It implements a pattern to detect strings consisting of 2 to 3 letters, followed by 1 to 4 digits.

Table 37-620 UK Electoral Roll Number narrow-breadth pattern

Pattern

\l{2,3}\d{1,4}
 Library of system data identifiers 1056
UK National Health Service (NHS) Number

The narrow breadth of the Electoral Roll Number data identifier implements two validators to
require the presence of an electoral number-related keyword and a UK-related keyword.

Table 37-621 UK Electoral Roll Number narrow-breadth validators

Validator Description

Find keywords: electoral At least one of the following keywords or key phrases must be present for the data
number-related to match:

electoral #, electoral number, electoral roll #, electoral roll no., electoral roll
number, electoral roll#, electoral#, electoralnumber, electoralroll#,
electoralrollno

Find keywords: UK-related At least one of the following keywords or key phrases must be present for the data
to match:

british, the united kingdom, uk, united kingdom, unitedkingdom

UK National Health Service (NHS) Number

The UK National Health Service (NHS) Number is the personal identification number issued
by the U.K. National Health Service (NHS) for administration of medical care.
The UK National Health Service (NHS) Number data identifier detects the presence of the UK
National Health Service (NHS) Number.
This data identifier provides two breadths of validation:
■ Medium
See “UK National Health Service (NHS) Number medium breadth” on page 1056.
■ Narrow
See “UK National Health Service (NHS) Number narrow breadth” on page 1057.

Note: This data identifier does not provide a wide breadth option.

UK National Health Service (NHS) Number medium breadth

The medium breadth implements patterns to detect numbers in the currently defined NHS
format, DDD-DDD-DDDD (where D is a digit), with various separators.
 Library of system data identifiers 1057
UK National Health Service (NHS) Number

Table 37-622 UK National Health Service (NHS) Number medium-breadth patterns

Pattern Description

\d{3}.\d{3}.\d{4} Pattern for detecting the format DDD-DDD-DDDD

separated by periods.

\d{3} \d{3} \d{4} Pattern for detecting the format DDD-DDD-DDDD

separated by spaces.

\d{3}-\d{3}-\d{4} Pattern for detecting the format DDD-DDD-DDDD

separated by dashes.

The medium breadth implements three validators: one to validate the NHS checksum, another
to perform numerical validation using the final digit, and a third to check for the presence of
an NHS-related keyword.

Table 37-623 UK National Health Service (NHS) Number medium-breadth validators

Validator Description

UK NHS UK NHS checksum.

Number Delimiter Validates a match by checking the surrounding numbers.

Find keywords: NHS-related At least one of the following keywords or key phrases must
be present for the data to match:

national health service, NHS

UK National Health Service (NHS) Number narrow breadth

The narrow breadth implements patterns to detect numbers in the currently defined format:
DDD-DDD-DDDD (where D is a digit), separated with dashes or spaces.

Table 37-624 UK National Health Service (NHS) Number narrow-breadth patterns

Pattern Description

\d{3} \d{3} \d{4} Pattern for detecting the format DDD-DDD-DDDD

separated by spaces.

\d{3}-\d{3}-\d{4} Pattern for detecting the format DDD-DDD-DDDD

separated by dashes.

The narrow breadth implements four validators: one to validate the NHS checksum, another
to perform numerical validation using the final digit, a third to require the presence of an
NHS-related keyword, and a fourth to require the presence of a UK-related keyword.
 Library of system data identifiers 1058
UK National Insurance Number

Table 37-625 UK National Health Service (NHS) Number narrow-breadth validators

Mandatory validator Description

UK NHS UK NHS checksum.

Number Delimiter Validates a match by checking the surrounding numbers.

Find keywords: NHS-related At least one of the following keywords or key phrases must
be present for the data to match:

national health service, NHS

Find keywords: UK-related At least one of the following keywords or key phrases must
be present for the data to match:

uk, united kingdom, britain, england, gb

UK National Insurance Number

The UK National Insurance Number is issued by the United Kingdom Department for Work
and Pensions (DWP) to identify an individual for the national insurance program. It is also
known as a NI number, NINO or NINo.
The UK National Insurance Number data identifier detects the presence of the UK National
Insurance Number.
This data identifier provides three breadths of validation:
■ Wide
See “UK National Insurance Number wide breadth” on page 1058.
■ Medium
See “UK National Insurance Number medium breadth” on page 1059.
■ Narrow
See “UK National Insurance Number narrow breadth” on page 1059.

UK National Insurance Number wide breadth

The wide breadth implements patterns to detect 9-digit numbers of the format LL DD DD DD
L (where L is a letter and D is a digit), separated by spaces, periods, dashes, or together in a
string.
The first and second letter cannot be D, F, I, Q, U and V. The second letter also cannot be O.
 Library of system data identifiers 1059
UK National Insurance Number

Table 37-626 UK National Insurance Number wide-breadth patterns

Pattern Description

[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z].\d{2}.\d{2}.\d{2}-[ABCD] Separated by periods.

[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z]\d{2}\d{2}\d{2}[ABCD] Not separated.

[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z] \d{2} \d{2} \d{2} [ABCD] Separated by spaces.

[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z]-\d{2}-\d{2}-\d{2}-[ABCD] Separated by dashes.

[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z] \d{6} [ABCD] Digits in a string.

UK National Insurance Number medium breadth

The medium breadth implements patterns to detect 9-digit numbers of the format LL DD DD
DD L (where L is a letter and D is a digit), separated by spaces or together in a string.
The first and second letter cannot be D, F, I, Q, U and V; the second letter cannot be O.

Table 37-627 UK National Insurance Number medium-breadth patterns

Pattern Description

[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z]\d{2}\d{2}\d{2}[ABCD] Not delimited.

[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z] \d{2} \d{2} \d{2} [ABCD] Separated by spaces.

[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z] \d{6} [ABCD] Characters in a string.

UK National Insurance Number narrow breadth

The narrow breadth implements patterns to detect 9-digit numbers of the format LL DD DD
DD L (where L is a letter and D is a digit), separated by spaces or together in a string.
The first and second letter cannot be D, F, I, Q, U and V. The second letter also cannot be O.

Table 37-628 UK National Insurance Number narrow-breadth patterns

Pattern Description

[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z]\d{2}\d{2}\d{2}[ABCD] Not delimited.

[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z] \d{2} \d{2} \d{2} [ABCD] Separated by spaces.

[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z] \d{6} [ABCD] Characters in a string.

 Library of system data identifiers 1060
UK Passport Number

The narrow breadth implements a validator that requires the presence of a national
insurance-related keyword.

Table 37-629 UK National Insurance Number narrow-breadth validator

Mandatory validator Description

Find keywords: Insurance-related At least one of the following keywords or key phrases must be present for the
data to match:

insurance no., insurance number, insurance#, insurancenumber, national

insurance number, nationalinsurance#, nationalinsurancenumber, nin,
nino

UK Passport Number
The UK Passport Number identifies a United Kingdom passport using the current official
specification of the UK Government Standards of the UK Cabinet Office.
The UK Passport Number data identifier detects the presence of the UK Passport Number.
This data identifier provides three breadths of validation:
■ Wide
See “UK Passport Number wide breadth” on page 1060.
■ Medium
See “UK Passport Number medium breadth” on page 1061.
■ Narrow
See “UK Passport Number narrow breadth” on page 1061.

UK Passport Number wide breadth

The wide breadth detects 9-digit numbers.

Note: The wide breadth does not include any validators.

Table 37-630 UK Passport Number wide-breadth pattern

Pattern Description

\d{9} Pattern for detecting 9-digit numbers.

 Library of system data identifiers 1061
UK Passport Number

UK Passport Number medium breadth

The medium breadth detects 9-digit numbers.

Table 37-631 UK Passport Number medium-breadth pattern

Pattern Description

\d{9} Pattern for detecting 9-digit numbers.

The medium breadth implements three validators: one to eliminate common test numbers,
such as 123456789; another to eliminate numbers with all the same digits; and a third that
requires the presence of a passport-related keyword.

Table 37-632 UK Passport Number medium-breadth validators

Mandatory validator Description

Exclude beginning characters Data beginning with any of the following list of values will not be matched:

123456789

Duplicate digits Ensures that a string of digits is not all the same.

Find keywords: Passport-related At least one of the following keywords or key phrases must be present for the
data to match:

passport, passport#, passportID, passportno, passportnumber

UK Passport Number narrow breadth

The narrow breadth detects 9-digit numbers.

Table 37-633 UK Passport Number narrow-breadth pattern

Pattern Description

\d{9} Pattern for detecting 9-digit numbers.

The narrow breadth implements four validators: one to eliminate common test numbers, such
as 123456789; another to eliminate numbers with all the same digits; a third that requires the
presence of a passport-related keyword; and a fourth that requires the presence of a UK-related
keyword.
 Library of system data identifiers 1062
UK Tax ID Number

Table 37-634 UK Passport Number narrow-breadth validators

Mandatory validator Description

Exclude beginning characters Data beginning with any of the following list of values will not be matched:
123456789

Duplicate digits Ensures that a string of digits is not all the same.

Find keywords: Passport-related At least one of the following keywords or key phrases must be present for the
data to match:

passport, passport#, passportID, passportno, passportnumber

Find keywords: UK-related At least one of the following keywords or key phrases must be present for the
data to match:

uk, united kingdom, britain, england, gb

UK Tax ID Number
The UK Tax ID Number is a personal identification number provided by the UK Government
Standards of the UK Cabinet Office.
The UK Tax ID Number data identifier detects the presence of the UK Tax ID numbers.
This data identifier provides three breadths of validation:
■ Wide
See “UK Tax ID Number wide breadth” on page 1062.
■ Medium
See “UK Tax ID Number medium breadth” on page 1063.
■ Narrow
See “UK Tax ID Number narrow breadth” on page 1063.

UK Tax ID Number wide breadth

The wide breadth detects 10-digit numbers.

Note: The wide breadth of the UK Tax ID Number data identifier does not include any validators.

Table 37-635 UK Passport Number wide-breadth pattern

Pattern Description

\d{10} Pattern for detecting 10-digit numbers.

 Library of system data identifiers 1063
UK Tax ID Number

UK Tax ID Number medium breadth

The medium breadth detects 10-digit numbers.

Table 37-636 UK Tax ID Number medium-breadth pattern

Pattern Description

\d{10} Pattern for detecting 10-digit numbers.

The medium breadth implements two validators: one to eliminates common test numbers,
such as 1234567890, and another to eliminate numbers with all the same digit.

Table 37-637 UK Tax ID Number medium-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Exclude beginning characters Data beginning with any of the following list of values will
not be matched:

0123456789, 1234567890, 9876543210, 0987654321

UK Tax ID Number narrow breadth

The narrow breadth detects 10-digit numbers.

Table 37-638 UK Tax ID Number narrow-breadth pattern

Pattern Description

\d{10} Pattern for detecting 10-digit numbers.

The narrow breadth implements three validators: one to eliminates common test numbers,
such as 1234567890; another to eliminate numbers with all the same digit; and a third that
requires the presence of a tax identification-related keyword.

Table 37-639 UK Tax ID Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Exclude beginning characters Data beginning with any of the following list of values will
not be matched:

0123456789, 1234567890, 9876543210, 0987654321

 Library of system data identifiers 1064
Ukraine Passport (Domestic)

Table 37-639 UK Tax ID Number narrow-breadth validators (continued)

Mandatory validator Description

Find keywords: Tax ID-related At least one of the following keywords or key phrases must
be present for the data to match:

tax id, tax id no., tax id number, tax identification, tax

identification#, tax no., tax#, taxid#

Ukraine Passport (Domestic)

An identity document issued to citizens of Ukraine for domestic use. It has been replaced by
the Ukraine Identity Card as of 2016, but any existing passports are still valid.
The Ukraine Passport (Domestic) data identifier provides two breadths of detection:
■ The wide breadth detects a nine-digit number without checksum validation.
See “Ukraine Passport (Domestic) wide breadth” on page 1064.
■ The narrow breadth detects a nine-digit number. It also requires the presence of related
keywords.
See “Ukraine Passport (Domestic) narrow breadth” on page 1064.

Ukraine Passport (Domestic) wide breadth

The wide breadth detects a nine-digit number without checksum validation.

Table 37-640 Ukraine Passport (Domestic) wide-breadth pattern

Pattern

\d{9}

Table 37-641 Ukraine Passport (Domestic) wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits are not all the same.

Ukraine Passport (Domestic) narrow breadth

The narrow breadth detects a nine-digit number. It also requires the presence of related
keywords.
 Library of system data identifiers 1065
Ukraine Identity Card

Table 37-642 Ukraine Passport (Domestic) narrow-breadth pattern

Pattern

\d{9}

Table 37-643 Ukraine Passport (Domestic) narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits are not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

passport, Ukraine Passport, passport number,

passport no, паспорт, паспорт України, номер
паспорта, персональний

Ukraine Identity Card

A Ukraine Identity Card has a 15-digit record number issued to citizens of Ukraine. It is used
as a form of identification taking the place of Ukraine's domestic passport as of January 2016.
The Ukraine Identity Card data identifier provides three breadths of detection:
■ The wide breadth detects a 15-digit number without checksum validation.
See “Ukraine Identity Card wide breadth” on page 1065.
■ The medium breadth detects a 15-digit number with checksum validation.
See “Ukraine Identity Card medium breadth” on page 1066.
■ The narrow breadth detects a 15-digit number with checksum validation. It also requires
the presence of related keywords.
See “Ukraine Identity Card narrow breadth” on page 1066.

Ukraine Identity Card wide breadth

The wide breadth detects a 15-digit number without checksum validation.
 Library of system data identifiers 1066
Ukraine Identity Card

Table 37-644 Ukraine Identity Card wide-breadth patterns

Pattern

\d{4}[01]\d[0123]\d-\d{7}

\d{4}[01]\d[0123]\d{8}

\d{4}[01]\d[0123]\d \d{7}

Table 37-645 Ukraine Identity Card wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits are not all the same.

Ukraine Identity Card medium breadth

The medium breadth detects a 15-digit number with checksum validation.

Table 37-646 Ukraine Identity Card medium-breadth patterns

\d{4}[01]\d[0123]\d-\d{7}

\d{4}[01]\d[0123]\d{8}

\d{4}[01]\d[0123]\d \d{7}

Table 37-647 Ukraine Identity Card medium-breadth validators

Duplicate digits Ensures that a string of digits are not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

Ukraine Identity Card Check Validates that the first eight digits are a correctly formatted
date.

Ukraine Identity Card narrow breadth

The narrow breadth detects a 15-digit number with checksum validation. It also requires the
presence of related keywords.
 Library of system data identifiers 1067
Ukraine Passport (International)

Table 37-648 Ukraine Identity Card narrow-breadth patterns

Pattern

\d{4}[01]\d[0123]\d-\d{7}

\d{4}[01]\d[0123]\d{8}

\d{4}[01]\d[0123]\d \d{7}

Table 37-649 Ukraine Identity Card narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits are not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

Ukraine Identity Card Check Validates that the first eight digits are a correctly formatted
date.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

Ukraine Identity Card, identity card, посвідчення

особи України

Ukraine Passport (International)

The Ukraine Passport (International) data identifier provides two breadths of detection:
■ The wide breadth detects an eight-character alphanumeric pattern without checksum
validation.
See “Ukraine Passport (International) wide breadth” on page 1067.
■ The narrow breadth detects an eight-character alphanumeric pattern without checksum
validation. It also requires the presence of related keywords.
See “Ukraine Passport (International) narrow breadth” on page 1068.

Ukraine Passport (International) wide breadth

The wide breadth detects an eight-character alphanumeric pattern without checksum validation.
 Library of system data identifiers 1068
United Arab Emirates Personal Number

Table 37-650 Ukraine Passport (International) wide-breadth pattern

Pattern

\w{2}\d{6}

Table 37-651 Ukraine Passport (International) wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits are not all the same.

Ukraine Passport (International) narrow breadth

The narrow breadth detects an eight-character alphanumeric pattern without checksum
validation. It also requires the presence of related keywords.

Table 37-652 Ukraine Passport (International) narrow-breadth pattern

Pattern

\w{2}\d{6}

Table 37-653 Ukraine Passport (International) narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits are not all the same.

Number delimiter Validates a match by checking the surrounding numbers.

Find Keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

passport, Ukraine Passport, passport number,

passport no, паспорт, паспорт України, номер
паспорта

United Arab Emirates Personal Number

In United Arab Emirates, every citizen or resident has a unique personal identification number.
The United Arab Emirates Personal Number is used for identity verification by the government
and some private entities.
The United Arab Emirates Number system data identifier provides three breadths of detection:
 Library of system data identifiers 1069
United Arab Emirates Personal Number

■ The wide breadth detects a 15-digit number without checksum validation.

See “United Arab Emirates Personal Number wide breadth ” on page 1069.
■ The medium breadth detects a 15-digit number with checksum validation.
See “United Arab Emirates Personal Number medium breadth” on page 1069.
■ The narrow breadth detects a 15-digit number with checksum validation. It also requires
the presence of United Arab Emirates Personal Number-related keywords.
See “United Arab Emirates Personal Number narrow breadth” on page 1070.

United Arab Emirates Personal Number wide breadth

The wide breadth detects a 15-digit number without checksum validation.

Table 37-654 United Arab Emirates Personal Number wide-breadth patterns

Pattern

\d{15}

\d{3}-\d{4}-\d{7}-\d{1}

Table 37-655 United Arab Emirates Personal Number wide breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

United Arab Emirates Personal Number medium breadth

The medium breadth detects a 15-digit number with checksum validation.

Table 37-656 United Arab Emirates Personal Number medium breadth patterns

Pattern

\d{15}

\d{3}-\d{4}-\d{7}-\d{1}

Table 37-657 United Arab Emirates Personal Number medium breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Luhn Check Computes the Luhn checksum and validates the pattern
against it.
 Library of system data identifiers 1070
US Individual Tax Identification Number (ITIN)

United Arab Emirates Personal Number narrow breadth

The narrow breadth detects a 15-digit number with checksum validation. It also requires the
presence of United Arab Emirates Personal Number-related keywords.

Table 37-658 United Arab Emirates Personal Number narrow-breadth patterns

Pattern

\d{15}

\d{3}-\d{4}-\d{7}-\d{1}

Table 37-659 United Arab Emirates Personal Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Luhn Check Computes the Luhn checksum and validates the pattern
against it.

Find Keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

PID, Insurance Number, Personal ID Number, personal

identification no., unique identification no., personal
identity no, personalidno#, insuranceno#,
personalIdno#, uniqueIdno#

,‫ هوية فريدة‬,‫ التأمين رقم‬,‫ فريدة من نوعها هوية رقم‬,‫الهوية الشخصية رقم‬
‫التأمينرقم‬#

US Individual Tax Identification Number (ITIN)

The US Individual Tax Identification Number (ITIN) is used for tax processing and is issued
by the United States Internal Revenue Service (IRS). The IRS issues ITINs to track individuals
who are not eligible to obtain Social Security Numbers (SSNs).
The US Individual Tax Identification Number (ITIN) data identifier detects the presence of US
ITIN numbers.
This data identifier provides three breadths of validation:
■ Wide
 Library of system data identifiers 1071
US Individual Tax Identification Number (ITIN)

See “US Individual Tax Identification Number (ITIN) wide breadth” on page 1071.
■ Medium
See “US Individual Tax Identification Number (ITIN) medium breadth” on page 1071.
■ Narrow
See “US Individual Tax Identification Number (ITIN) narrow breadth” on page 1072.

US Individual Tax Identification Number (ITIN) wide breadth

The wide breadth implements patterns to detect 9-digit numbers with the pattern DDD-DD-DDDD
separated with dashes, spaces, periods, slashes, or without separators.
The number must begin with a 9 and have a 7 or 8 as the fourth digit.

Note: The wide breadth of the US Individual Tax Identification Number (ITIN) data identifier
does not include any validators.

Table 37-660 US Individual Tax Identification Number (ITIN) wide-breadth patterns

Pattern Description

9\\d{2}[78]\\d\\d{4} Pattern for detecting the ITIN format without separators.

9\\d{2}\\\\[78]\\d\\\\\\d{4} Pattern for detecting the ITIN format without separators.

9\d{2}/[78]\d/\d{4} Pattern for detecting the ITIN format separated by slashes.

9\d{2}.[78]\d.\d{4} Pattern for detecting the ITIN format separated by periods.

9\d{2} [78]\d \d{4} Pattern for detecting the ITIN format separated by spaces.

9\d{2}-[78]\d-\d{4} Pattern for detecting the ITIN format separated by dashes.

US Individual Tax Identification Number (ITIN) medium breadth

The medium breadth implements patterns to detect 9-digit numbers with the pattern
DDD-DD-DDDD separated with dashes, spaces, or periods.
The number must begin with a 9 and have a 7 or 8 as the fourth digit.

Table 37-661 US Individual Tax Identification Number (ITIN) medium-breadth patterns

Pattern Description

9\d{2}.[78]\d.\d{4} Pattern for detecting the ITIN format separated by periods.

9\d{2} [78]\d \d{4} Pattern for detecting the ITIN format separated by spaces.
 Library of system data identifiers 1072
US Individual Tax Identification Number (ITIN)

Table 37-661 US Individual Tax Identification Number (ITIN) medium-breadth patterns

(continued)

Pattern Description

9\d{2}-[78]\d-\d{4} Pattern for detecting the ITIN format separated by dashes.

The medium breadth implements a single validator to check the surrounding characters.

Table 37-662 US Individual Tax Identification Number (ITIN) medium-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

US Individual Tax Identification Number (ITIN) narrow breadth

The narrow breadth implements patterns to detect 9-digit numbers with the pattern
DDD-DD-DDDD separated with dashes or spaces.
The number must begin with a 9 and have a 7 or 8 as the fourth digit.

Table 37-663 US Individual Tax Identification Number (ITIN) narrow-breadth patterns

Pattern Description

9\d{2} [78]\d \d{4} Pattern for detecting the ITIN format separated by spaces.

9\d{2}-[78]\d-\d{4} Pattern for detecting the ITIN format separated by dashes.

The narrow breadth implements three validators: one to check the surrounding characters,
another to ensure that the digits in the ITIN string are not all the same, and a third that requires
the presence of a ITIN-related keyword.

Table 37-664 US Individual Tax Identification Number (ITIN) narrow-breadth validators

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Duplicate digits Ensures that a string of digits is not all the same.

Find keywords: ITIN-related At least one of the following keywords or key phrases must
be present for the data to be matched.

individual taxpayer identification number, itin, i.t.i.n.

 Library of system data identifiers 1073
US Passport Number

US Passport Number
United States passports are passports issued to citizens and non-citizen nationals of the United
States of America. They are issued exclusively by the U.S. Department of State.
The US Passport Number data identifier provides two breadths of detection:
■ The wide breadth detects a valid US Passport Number pattern.
See “US Passport Number wide breadth” on page 1073.
■ The narrow breadth detects a valid US Passport Number pattern. It also requires the
presence of related keywords.
See “US Passport Number narrow breadth” on page 1073.

US Passport Number wide breadth

The wide breadth detects a valid US Passport Number pattern.

Table 37-665
Patterns

\d{8}

\d{9}

Table 37-666
Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding characters.

US Passport Number narrow breadth

The narrow breadth detects a valid US Passport Number pattern. It also requires the presence
of related keywords.

Table 37-667 US Passport Number narrow-breadth patterns

Patterns

\d{8}

\d{9}
 Library of system data identifiers 1074
US Social Security Number (SSN)

Table 37-668 US Passport Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number delimiter Validates a match by checking the surrounding characters.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.

Inputs:

passport, Passport, U.S. Passport, u.s. passport,

Passport Card, Passport Book, passport card, passport
book

US Social Security Number (SSN)

Note: Starting with Symantec Data Loss Prevention version 12.5, the US Social Security
Number (SSN) data identifier is replaced by the Randomized US Social Security Number
(SSN) data identifier. Policy templates that use the US SSN data identifier are updated to use
the Randomized US SSN data identifier. Symantec recommends that you update your SSN
policies to use the Randomized US SSN data identifier. See “Randomized US Social Security
Number (SSN)” on page 1015.

The US Individual Tax Identification Number (ITIN) is a personal identification number issued
by the Social Security Administration of the United States government. Although primarily used
for administering the Social Security program, it is widely used as a personal identification
number in many purposes.
The US Social Security Number (SSN) data identifier detects the presence of US Social Security
numbers.
This data identifier provides three breadths of validation:
■ Wide
See “US Social Security Number (SSN) wide breadth” on page 1075.
■ Medium
See “US Social Security Number (SSN) medium breadth” on page 1075.
■ Narrow
See “US Social Security Number (SSN) narrow breadth” on page 1076.
 Library of system data identifiers 1075
US Social Security Number (SSN)

US Social Security Number (SSN) wide breadth

The wide breadth implements patterns to detect 9-digit numbers with the pattern DDD-DD-DDDD
separated with dashes, spaces, periods, slashes, or without separators.
The number must begin with a 9 and have a 7 or 8 as the fourth digit.

Table 37-669 Social Security Number (SSN) wide-breadth patterns

Pattern Description

\d{3}-\d{2}-\d{4} Matches the standard SSN format, which is any three digits followed by a hyphen,
two digits, a hyphen, and any four digits.

\d{3}.\d{2}.\d{4} Matches the SSN format delimited by periods.

\d{3} \d{2} \d{4} Matches the SSN format delimited by spaces.

\d{3}\\\d{2}\\\d{4} Matches the SSN format delimited by backslashes.

\d{3}/\d{2}/\d{4} Matches the SSN format delimited by forward slashes.

\d{9} Matches any 9-digit number that is not delimited.

The wide breadth implements three validators to ensure that the detected SSN is within validly
assigned number ranges, eliminate common test numbers, such as 123456789, and all the
same digit.

Table 37-670 Social Security Number (SSN) wide-breadth validators

Validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Advanced SSN Checks whether SSN contains zeros in any group, the area number (first group)
is less than 773 and not 666, the delimiter between the groups is the same, the
number does not consist of all the same digits, and the number is not reserved
for advertising (123-45-6789, 987-65-432x).

SSN Area-Group number For a given area number (first group), not all group numbers (second group) might
have been assigned by the SSA. Validator eliminates SSNs with invalid group
numbers.

US Social Security Number (SSN) medium breadth

The medium breadth implements patterns to detects 9-digit numbers with the pattern
DDD-DD-DDDD separated with dashes, spaces, or periods.
 Library of system data identifiers 1076
US Social Security Number (SSN)

Table 37-671 Social Security Number (SSN) medium-breadth patterns

Pattern Description

\d{3}-\d{2}-\d{4} Matches the standard SSN format, which is any three digits followed by a hyphen,
two digits, a hyphen, and any four digits.

\d{3}.\d{2}.\d{4} Matches the SSN format delimited by periods.

\d{3} \d{2} \d{4} Matches the SSN format delimited by spaces.

The medium breadth implements three validators to ensure that the detected SSN is within
validly assigned number ranges, is not a common test number (such as 123456789), and is
not all the same digit.

Table 37-672 Social Security Number (SSN) medium-breadth validators

Validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Advanced SSN Checks whether SSN contains zeros in any group, the area number (first group)
is less than 773 and not 666, the delimiter between the groups is the same, the
number does not consist of all the same digits, and the number is not reserved
for advertising (123-45-6789, 987-65-432x).

SSN Area-Group number For a given area number (first group), not all group numbers (second group) might
have been assigned by the SSA. Validator eliminates SSNs with invalid group
numbers.

US Social Security Number (SSN) narrow breadth

The narrow breadth implements patterns to detects 9-digit numbers with the pattern
DDD-DD-DDDD separated with dashes or spaces or without separators.

Table 37-673 US Social Security Number (SSN) narrow-breadth patterns

Pattern Description

\d{3}-\d{2}-\d{4} Matches the standard SSN format, which is any three digits followed by a hyphen,
two digits, a hyphen, and any four digits.

\d{3} \d{2} \d{4} Matches the SSN format delimited by spaces.

\d{9} Matches any 9-digit number not delimited.

 Library of system data identifiers 1077
US ZIP+4 Postal Codes

The narrow breadth implements four validators to ensure that the detected SSN is within validly
assigned number ranges, is not a common test number (such as 123456789), is not all the
same digit, and the message containing the SSN includes a keyword.

Table 37-674 Social Security Number (SSN) narrow-breadth validators

Mandatory Validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Advanced SSN Checks whether SSN contains zeros in any group, the area number (first group)
is less than 773 and not 666, the delimiter between the groups is the same, the
number does not consist of all the same digits, and the number is not reserved
for advertising (123-45-6789, 987-65-432x).

SSN Area-Group number For a given area number (first group), not all group numbers (second group)
might have been assigned by the SSA. Validator eliminates SSNs with invalid
group numbers.

Find keywords: Social At least one of the following keywords or key phrases must be present for the
security-related data to be matched:

social security number, ssn, ss#

US ZIP+4 Postal Codes

In the United States, a ZIP+4 code uses the basic 5-digit code plus 4 additional digits to identify
a geographic segment within the 5-digit delivery area that could use an extra identifier to aid
in efficient mail sorting and delivery.
The US ZIP+4 Postal Codes data identifier provides three breadths of detection:
■ The wide breadth detects a valid US ZIP+4 Postal Code pattern.
See “US ZIP+4 Postal Codes wide breadth” on page 1077.
■ The medium breadth detects a valid US ZIP+4 Postal Code pattern. It also validates the
checksum.
See “US ZIP+4 Postal Codes medium breadth” on page 1078.
■ The narrow breadth detects a valid US ZIP+4 Postal Code pattern. It also validates the
checksum and requires the presence of related keywords.
See “US ZIP+4 Postal Codes narrow breadth” on page 1079.

US ZIP+4 Postal Codes wide breadth

The wide breadth detects a valid US ZIP+4 Postal Code pattern.
 Library of system data identifiers 1078
US ZIP+4 Postal Codes

Table 37-675 US ZIP+4 Postal Codes wide-breadth patterns

Pattern

\l{2}[ ]\d{5}[-]\d{4}

\l{2}[ ]\d{9}

Table 37-676 US ZIP+4 Postal Codes wide-breadth validator

Mandatory validator Description

Exclude ending characters Any number ending with the following characters is
excluded from matching:

000000000, 111111111, 222222222, 333333333,

444444444, 555555555, 666666666, 777777777,
888888888, 999999999

US ZIP+4 Postal Codes medium breadth

The medium breadth detects a valid US ZIP+4 Postal Code pattern. It also validates the
checksum.

Table 37-677 US ZIP+4 Postal Codes medium-breadth patterns

Patterns

\l{2}[ ]\d{5}[-]\d{4}

\l{2}[ ]\d{9}

Table 37-678 US ZIP+4 Postal Codes medium-breadth validators

Mandatory validator Description

Exclude ending characters Any number ending with the following characters is
excluded from matching:

000000000, 111111111, 222222222, 333333333,

444444444, 555555555, 666666666, 777777777,
888888888, 999999999

Zip+4 Postal Codes Validation Check Computes the checksum and validates the pattern against
it.
 Library of system data identifiers 1079
Venezuela National Identification Number

US ZIP+4 Postal Codes narrow breadth

The narrow breadth detects a valid US ZIP+4 Postal Code pattern. It also validates the
checksum and requires the presence of related keywords.

Table 37-679 US ZIP+4 Postal Codes narrow-breadth patterns

Patterns

\l{2}[ ]\d{5}[-]\d{4}

\l{2}[ ]\d{9}

Table 37-680 US ZIP+4 Postal Codes narrow breadth validators

Mandatory validator Description

Exclude ending characters Any number ending with the following characters is
excluded from matching:

000000000, 111111111, 222222222, 333333333,

444444444, 555555555, 666666666, 777777777,
888888888, 999999999

Zip+4 Postal Codes Validation Check Computes the checksum and validates the pattern against
it.

Find keywords With this option selected, at least one of the following
keywords or key phrases must be present for the data to
be matched.
Inputs:

US zip code, zip code, zip+4 code, US zip+4 code

Venezuela National Identification Number

In Venezuela, every citizen and resident has a unique Venezuela National Identification Number
(Venezuela Cédula de Identidad). The Venezuela National Identification Number is used on
identity documents, making it possible to match the number to a person.
This data identifier provides the following breadths of detection:
■ The wide breadth detects a 10-digit alphanumeric identifier without checksum validation.
See “Venezuela National Identification Number wide breadth” on page 1080.
■ The medium breadth detects a 10-digit alphanumeric identifier with checksum validation.
See “Venezuela National Identification Number medium breadth ” on page 1080.
 Library of system data identifiers 1080
Venezuela National Identification Number

■ The narrow breadth detects a 10-digit alphanumeric identifier that passes checksum
validation. It also requires the presence of a Venezuela National ID Number-related keyword.
See “Venezuela National Identification Number narrow breadth” on page 1081.

Venezuela National Identification Number wide breadth

The wide breadth detects a 10-digit alphanumeric identifier without checksum validation.

Table 37-681 Venezuela National Identification Number wide-breadth patterns

Pattern

[VEJPGvejpg][-]\d{2}.\d{3}.\d{3}[-]\d

[VEJPGvejpg][-]\d{8}[-]\d

[VEJPGvejpg]\d{9}

Table 37-682 Venezuela National Identification Number wide-breadth validator

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Venezuela National Identification Number medium breadth

The medium breadth detects a 10-digit alphanumeric identifier with checksum validation.

Table 37-683 Venezuela National Identification Number medium-breadth patterns

Pattern

[VEJPGvejpg][-]\d{2}.\d{3}.\d{3}[-]\d

[VEJPGvejpg][-]\d{8}[-]\d

[VEJPGvejpg]\d{9}

Table 37-684 Venezuela National Identification Number medium-breadth validator

Mandatory validator Description

Number Delimiter Validates a match by checking the surrounding characters.

Venezuela National ID Number Validation Check Computes the checksum and validates the pattern against
it.
 Library of system data identifiers 1081
Venezuela National Identification Number

Venezuela National Identification Number narrow breadth

The narrow breadth detects a 10-digit alphanumeric identifier that passes checksum validation.
It also requires the presence of a Venezuela National Identification Number-related keyword.

Table 37-685 Venezuela National Identification Number narrow-breadth patterns

Pattern

[VEJPGvejpg][-]\d{2}.\d{3}.\d{3}[-]\d

[VEJPGvejpg][-]\d{8}[-]\d

[VEJPGvejpg]\d{9}

Table 37-686 Venezuela National Identification Number narrow-breadth validators

Mandatory validator Description

Duplicate digits Ensures that a string of digits is not all the same.

Number Delimiter Validates a match by checking the surrounding characters.

Venezuela National ID Number Validation Check Computes the checksum and validates the pattern against
it.

Find Keywords At least one of the following keywords or key phrases must
be present for the data to be matched when you use this
option.

Inputs:

national ID number, NID, national identification

number, national ID no, PID, insurance number,
personal ID number, personal identification no, unique
identification no, personalidno#, uniqueIDno#,
nationalidno#, nationalidentityno#, cédula de identidad
número, clave única de identidad, personal de
identidad clave, personal de identidad, número de
identificación nacional, número ID nacional
 Chapter 38
Library of policy templates
This chapter includes the following topics:

■ Caldicott Report policy template

■ Canadian Social Insurance Numbers policy template

■ CAN-SPAM Act policy template

■ Colombian Personal Data Protection Law 1581 policy template

■ Common Spyware Upload Sites policy template

■ Competitor Communications policy template

■ Confidential Documents policy template

■ Credit Card Numbers policy template

■ Customer Data Protection policy template

■ Data Protection Act 1998 policy template

■ Data Protection Directives (EU) policy template

■ Defense Message System (DMS) GENSER Classification policy template

■ Design Documents policy template

■ Employee Data Protection policy template

■ Encrypted Data policy template

■ Export Administration Regulations (EAR) policy template

■ FACTA 2003 (Red Flag Rules) policy template

■ Financial Information policy template

 Library of policy templates 1083

■ Forbidden Websites policy template

■ Gambling policy template

■ General Data Protection Regulation (Banking and Finance)

■ General Data Protection Regulation (Digital Identity)

■ General Data Protection Regulation (Government Identification)

■ General Data Protection Regulation (Healthcare and Insurance)

■ General Data Protection Regulation (Personal Profile)

■ General Data Protection Regulation (Travel)

■ Gramm-Leach-Bliley policy template

■ HIPAA and HITECH (including PHI) policy template

■ Human Rights Act 1998 policy template

■ Illegal Drugs policy template

■ Individual Taxpayer Identification Numbers (ITIN) policy template

■ International Traffic in Arms Regulations (ITAR) policy template

■ Media Files policy template

■ Merger and Acquisition Agreements policy template

■ NASD Rule 2711 and NYSE Rules 351 and 472 policy template

■ NASD Rule 3010 and NYSE Rule 342 policy template

■ NERC Security Guidelines for Electric Utilities policy template

■ Network Diagrams policy template

■ Network Security policy template

■ Offensive Language policy template

■ Office of Foreign Assets Control (OFAC) policy template

■ OMB Memo 06-16 and FIPS 199 Regulations policy template

■ Password Files policy template

■ Payment Card Industry (PCI) Data Security Standard policy template

■ PIPEDA policy template

 Library of policy templates 1084

■ Price Information policy template

■ Project Data policy template

■ Proprietary Media Files policy template

■ Publishing Documents policy template

■ Racist Language policy template

■ Restricted Files policy template

■ Restricted Recipients policy template

■ Resumes policy template

■ Sarbanes-Oxley policy template

■ SEC Fair Disclosure Regulation policy template

■ Sexually Explicit Language policy template

■ Source Code policy template

■ State Data Privacy policy template

■ SWIFT Codes policy template

■ Symantec DLP Awareness and Avoidance policy template

■ UK Drivers License Numbers policy template

■ UK Electoral Roll Numbers policy template

■ UK National Health Service (NHS) Number policy template

■ UK National Insurance Numbers policy template

■ UK Passport Numbers policy template

■ UK Tax ID Numbers policy template

■ US Intelligence Control Markings (CAPCO) and DCID 1/7 policy template

■ US Social Security Numbers policy template

■ Violence and Weapons policy template

■ Webmail policy template

■ Yahoo Message Board Activity policy template

■ Yahoo and MSN Messengers on Port 80 policy template

 Library of policy templates 1085
Caldicott Report policy template

Caldicott Report policy template

The UK Chief Medical Officer commissioned the Caldicott Report (December, 1997) to improve
the way the National Health Service handles and protects patient information. The Caldicott
Committee reviewed the confidentiality of data throughout the NHS for purposes other than
direct care, medical research, or where there is a statutory requirement for information. Its
recommendations are now being put into practice throughout the NHS and in the Health
Protection Agency.
The Drug, and Disease, and the Treatment keyword lists are updated with recent keywords
based on information from the U.S. Federal Drug Administration (FDA) and other sources.
See “Keep the keyword lists for your HIPAA and Caldicott policies up to date” on page 698.

Table 38-1 Caldicott Report policy template rules

Rule Type Description

Patient Data and Compound EDM and This compound rule looks for a match among the following EDM data
Drug Keywords Keyword Rule fields in combination with a keyword from the "Prescription Drug
Names" dictionary. Both conditions must be satisfied for the rule to
trigger an incident.

■ Account number
■ Email
■ ID card number
■ Last name
■ Phone
■ UK NHS (National Health Service) number
■ UK NIN (National Insurance Number)

Patient Data and Compound EDM and This compound rule looks for a match among the following EDM data
Disease Keywords Keyword Rule fields in combination with a keyword from the "Disease Names"
dictionary. Both conditions must be satisfied for the rule to trigger an
incident.

■ Account number
■ Email
■ ID card number
■ Last name
■ Phone
■ UK NHS (National Health Service) number
■ UK NIN (National Insurance Number)
 Library of policy templates 1086
Canadian Social Insurance Numbers policy template

Table 38-1 Caldicott Report policy template rules (continued)

Rule Type Description

Patient Data and Compound EDM and This compound rule looks for a match among the following EDM data
Treatment Keyword Rule fields in combination with a keyword from the "Medical Treatment
Keywords Keywords" dictionary. Both conditions must be satisfied for the rule
to trigger an incident:

■ Account number
■ Email
■ ID card number
■ Last name
■ Phone
■ UK NHS (National Health Service) number
■ UK NIN (National Insurance Number)

UK NHS Number Simple DCM Rule This rule looks for a keyword from "UK NIN Keywords" dictionary in
and Drug Keywords combination with a pattern matching the UK NIN data identifier and a
keyword from the "Prescription Drug Names" dictionary.

UK NHS Number Simple DCM Rule This rule looks for a keyword from "UK NIN Keywords" dictionary in
and Disease combination with a pattern matching the UK NIN data identifier and a
Keywords keyword from the "Disease Names" dictionary.

UK NHS Number Simple DCM Rule This rule looks for a keyword from "UK NIN Keywords" dictionary in
and Treatment combination with a pattern matching the UK NIN data identifier and a
Keywords keyword from the "Medical Treatment Keywords" dictionary.

See “Choosing an Exact Data Profile” on page 371.

See “Configuring policies” on page 376.
See “Exporting policy detection as a template” on page 405.

Canadian Social Insurance Numbers policy template

This policy detects patterns indicating Canadian social insurance numbers (SINs) at risk of
exposure.

DCM Rule Canadian Social Insurance Numbers

This rule looks for a match to the Canadian Social Insurance Number data identifier
and a keyword from the "Canadian Social Ins. No. Words" dictionary.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.
 Library of policy templates 1087
CAN-SPAM Act policy template

CAN-SPAM Act policy template

The Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM)
establishes requirements for those who send commercial email.
The CAN-SPAM Act template detects activity from an organization's bulk mailer to help ensure
compliance with the CAN-SPAM Act requirements.
The detection exception Exclude emails that contain the mandated keywords allows
messages to pass that have one or more keywords from the user-defined "CAN-SPAM
Exception Keywords" dictionary.

Table 38-2 Detection exception: Exclude emails that contain the mandated keywords

Method Condition Configuration

Simple exception Content Matches Exclude emails that contain the mandated keywords (Keyword Match):
Keyword (DCM)
■ Match keyword from "[physical postal address]" or "advertisement".
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.
Note: After you define the keywords, you can choose to count all
matches and require 2 keywords from the list to be matched.

The detection exception CAN-SPAM Compliant Emails excludes from detection document
content from the selected IDM index with at least 100% match.

Table 38-3 Detection exception: CAN-SPAM Compliant Emails

Method Condition Configuration

Simple exception Content Matches Exception for CAN-SPAM compliant emails (IDM):
Document Profile
■ Exact content match (100%)
(IDM)
■ Look in the message body and attachments.
■ Check for existence.

See “Choosing an Indexed Document Profile” on page 373.

If an exception is not met, the detection rule Monitor Email From Bulk Mailer looks for a
sender's email address that matches one from the "Bulk Mailer Email Address" list, which is
user-defined.
 Library of policy templates 1088
Colombian Personal Data Protection Law 1581 policy template

Table 38-4 Detection rule: Monitor Email From Bulk Mailer

Method Condition Configuration

Simple rule Sender/User Matches Monitor Email From Bulk Mailer (Sender):
Pattern (DCM)
■ Match sender pattern(s): [bulk-mailer@company.com] (user defined)
■ Severity: High.

See “Creating a policy from a template” on page 360.

See “Exporting policy detection as a template” on page 405.

Colombian Personal Data Protection Law 1581 policy

template
The Colombian Personal Data Protection Law 1581 policy template detects the personal data
of Colombian citizens at risk of exposure.

Table 38-5
Rule Type Description

Colombian Address Number DCM Rule This rule detects Colombian street addresses using the Colombian
(Data Identifiers) Addresses data identifier.

Colombian Cell Phone Number DCM Rule This rule detects Colombian cell phone numbers using the Colombian
(Data Identifiers) Cell Phone Number data identifier.

Colombian Personal DCM Rule This rule detects Colombian personal identification numbers using the
Identification Number (Data Colombian Personal Identification Number data identifier.
Identifiers)

Colombian Tax Identification DCM Rule This rule detects Colombian tax identification numbers using the
Number (Data Identifiers) Colombian Tax Identification Number data identifier.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Common Spyware Upload Sites policy template

The Common Spyware Upload Sites policy detects access to common spyware upload Web
sites.
 Library of policy templates 1089
Competitor Communications policy template

DCM Rule Forbidden Websites 1

This is a compound rule that looks for either specified IP addresses or URLs in the
"Forbidden Websites 1" dictionary.

DCM Rule Forbidden Websites 2

This rule looks for a match of a specified URL in the "Forbidden Websites 2"
dictionary.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Competitor Communications policy template

The Competitor Communications policy detects forbidden communications with competitors.

DCM Rule Competitor List

This rule looks for keywords (domains) from the "Competitor Domains" dictionary,
which is user-defined.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Confidential Documents policy template

This policy detects company-confidential documents at risk of exposure.

Table 38-6 Rules comprising the Confidential Documents template

Rule Type Description

Confidential Documents, Simple IDM Rule with one This rule looks for content from specific documents
Indexed condition registered as confidential; returns a match if 80% or more
of the source document is found. If you do not have an
Indexed Document Profile configured this rule is dropped.
 Library of policy templates 1090
Credit Card Numbers policy template

Table 38-6 Rules comprising the Confidential Documents template (continued)

Rule Type Description

Confidential Documents Compound DCM Rule: This rule looks for a combination of keywords from the
Attachment/File Type and "Confidential Keywords" list and the following file types:
Keyword Match. Both
■ Microsoft Excel Macro
conditions must match for
■ Microsoft Excel
the rule to trigger an
incident. ■ Microsoft Works Spreadsheet
■ SYLK Spreadsheet
■ Corel Quattro Pro
■ Multiplan Spreadsheet
■ Comma Separate Values
■ Applix Spreadsheets
■ Lotus 1-2-3
■ Microsoft Word
■ Adobe PDF
■ Microsoft PowerPoint

Proprietary Documents Compound DCM Rule: This compound rule looks for a combination of keywords
Attachment/File Type and from the "Proprietary Keywords" dictionary and the above
Keyword Match referenced file types.

Internal Use Only Compound DCM Rule: This compound rule looks for a combination of keywords
Documents Attachment/File Type and from the "Internal Use Only Keywords" dictionary and the
Keyword Match above referenced file types.

Documents Not For Compound DCM Rule: This compound rule looks for a combination of keywords
Distribution Attachment/File Type and from the "Not For Distribution Words" dictionary and the
Keyword Match above referenced file types.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Credit Card Numbers policy template

This policy detects patterns indicating credit card numbers at risk of exposure.

DCM Rule Credit Card Numbers, All

This rule looks for a match to the credit card number system pattern and a keyword
from the "Credit Card Number Keywords" dictionary.

See “Configuring policies” on page 376.

 Library of policy templates 1091
Customer Data Protection policy template

See “Exporting policy detection as a template” on page 405.

Customer Data Protection policy template

This policy detects customer data at risk of exposure.

Table 38-7 EDM conditions for the Customer Data Protection policy template

Rule name Type Description Details

Username/Password EDM Rule This rule looks for usernames and However, the following
Combinations passwords in combination with three or combinations are not a
more of the following fields: violation:

■ SSN ■ Phone, email, and last

■ Phone name
■ Email ■ Email, first name, and
■ First Name last name
■ Last Name ■ Phone, first name, and
last name
■ Bank Card number
■ Account Number
■ ABA Routing Number
■ Canadian Social Insurance Number
■ UK National Insurance Number

Date of Birth EDM Rule This rule looks for any three of the However, the following
following data fields in combination: combinations are not a
violation:
■ SSN
■ Phone ■ Phone, email, and first
■ Email name
■ First Name ■ Phone, email, and last
name
■ Last Name
■ Email, first name, and
■ Bank Card number
last name
■ Account Number
■ Phone, first name, and
■ ABA Routing Number
last name
■ Canadian Social Insurance Number
■ UK National Insurance Number
■ Date of Birth

Exact SSN or CCN EDM Rule This rule looks for an exact social
security number or bank card number.

Customer Directory EDM Rule This rule looks for Phone or Email.
 Library of policy templates 1092
Data Protection Act 1998 policy template

Table 38-8 DCM conditions for the Customer Data Protection policy template

Rule name Type Description Details

US Social Security Compound DCM This rule looks for a match to the See “Randomized US Social
Number Patterns Rule Randomized US Social Security Security Number (SSN)”
number data identifier and a keyword on page 1015.
from the "US SSN Keywords"
dictionary.

Credit Card Numbers, All Compound DCM This rule looks for a match to the credit See “Credit Card Number ”
Rule card number system pattern and a on page 863.
keyword from the "Credit Card Number
Keywords" dictionary.

ABA Routing Numbers Compound DCM This rule looks for a match to the ABA See “ABA Routing Number”
Rule Routing number data identifier and a on page 798.
keyword from the "ABA Routing
Number Keywords" dictionary.

See “About the Exact Data Profile and index” on page 426.
See “Configuring policies” on page 376.
See “Exporting policy detection as a template” on page 405.

Data Protection Act 1998 policy template

The Data Protection Act 1998 (replacement of Data Protection Act 1984) set standards which
must be satisfied when obtaining, holding, using, or disposing of personal data in the UK. The
Data Protection Act 1998 covers anything with personal identifiable information (such as data
about personal health, employment, occupational health, finance, suppliers, and contractors).
 Library of policy templates 1093
Data Protection Act 1998 policy template

Table 38-9 Data Protection Act 1998, Personal Data detection rule

Description

This EDM rule looks for three of the following columns of data: However, the following combinations are not an
incident:
■ NIN (National Insurance Number)
■ Account number ■ First name, last name, pin
■ Pin ■ First name, last name, password
■ Bank card number ■ First name, last name, email
■ First name ■ First name, last name, phone
■ Last name ■ First name, last name, mother's maiden name
■ Drivers license
■ Password
■ Tax payer ID
■ UK NHS number
■ Date of birth
■ Mother's maiden name
■ Email address
■ Phone number

Table 38-10 Additional detection rules in the Data Protection Act 1998 policy template

Description

The UK Electoral Roll Numbers rule implements the UK Electoral Roll Number data identifier.

See “UK Electoral Roll Number” on page 1055.

The UK National Insurance Numbers rule implements the narrow breadth edition of the UK National Insurance
Number data identifier.

See “UK National Insurance Number” on page 1058.

The UK Tax ID Numbers rule implements the narrow edition of the UK Tax ID Number data identifier.

See “UK Tax ID Number” on page 1062.

The UK Drivers License Numbers rule implements the narrow breadth edition of the UK Driver's License number
data identifier.

See “UK Drivers Licence Number” on page 1053.

The UK Passport Numbers rule implements the narrow breadth edition of the UK Passport Number data identifier.

See “UK Passport Number” on page 1060.

 Library of policy templates 1094
Data Protection Directives (EU) policy template

Table 38-10 Additional detection rules in the Data Protection Act 1998 policy template
(continued)

Description

The UK NHS Numbers rule implements the narrow breadth edition of the UK National Health Service (NHS) Number
data identifier.

See “UK National Health Service (NHS) Number” on page 1056.

See “Choosing an Exact Data Profile” on page 371.

See “Configuring policies” on page 376.
See “Exporting policy detection as a template” on page 405.

Data Protection Directives (EU) policy template

Directives 95/46/EC of the European Parliament deal with the protection of individuals with
regard to the processing and free movement of personal data. This policy detects personal
data specific to the EU directives.
 Library of policy templates 1095
Data Protection Directives (EU) policy template

Table 38-11
Method Description

EDM Rule EU Data Protection Directives

This rule looks for any two of the following data columns:

■ Last Name
■ Bank Card number
■ Drivers license number
■ Account Number
■ PIN
■ Medical account number
■ Medical ID card number
■ User name
■ Password
■ ABA Routing Number
■ Email
■ Phone
■ Mother's maiden name
However, the following combinations do not create a match:

■ Last name, email

■ Last name, phone
■ Last name, account number
■ Last name, username

EDM Rule EU Data Protection, Contact Info

This rule looks for any two of the following data columns: last name, phone, account number,
username, and email.

Exception Except for email internal to the EU

This rule is an exception if the recipient is within the EU. This covers recipients with any of the country
codes from the "EU Country Codes" dictionary.

See “Choosing an Exact Data Profile” on page 371.

See “Configuring policies” on page 376.
See “Exporting policy detection as a template” on page 405.
 Library of policy templates 1096
Defense Message System (DMS) GENSER Classification policy template

Defense Message System (DMS) GENSER

Classification policy template
The Defense Information Systems Agency has established guidelines for Defense Message
System (DMS) General Services (GENSER) message classifications, categories, and markings.
These standards specify how to mark classified and sensitive documents according to U.S.
standards. These standards also provide interoperability with NATO countries and other U.S.
allies.
The GENSER policy template enforces GENSER guidelines by detecting information that is
classified as confidential. The template contains four simple (single condition) keyword matching
(DCM) detection rules. If any rule condition matches, the policy reports an incident.
The detection rule Top Secret Information (Keyword Match) looks for any keywords in the
"Top Secret Information" dictionary.

Table 38-12 Detection rule: Top Secret Information (Keyword Match)

Method Condition Configuration

Simple rule Content Matches Top Secret Information (Keyword Match):

Keyword (DCM)
■ Keyword dictionary: "TOP SECRET//"
■ Severity: High
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case sensitive.
■ Match on whole or partial words.

The detection rule Secret Information (Keyword Match) looks for any keywords in the "Secret
Information" dictionary.

Table 38-13 Detection rule: Secret Information (Keyword Match)

Method Condition Configuration

Simple rule Content Matches Secret Information (Keyword Match):

Keyword (DCM)
■ Keyword dictionary: "SECRET//"
■ Severity: High
■ Check for existence
■ Look in envelope, subject, body, attachments
■ Case sensitive
■ Match on whole or partial words.
 Library of policy templates 1097
Design Documents policy template

The detection rule Classified or Restricted Information (Keyword Match) looks for any
keywords in the "Classified or Restricted Information" dictionary.

Table 38-14 Detection rule: Classified or Restricted Information (Keyword Match)

Method Condition Configuration

Simple rule Content Matches Classified or Restricted Information (Keyword Match):

Keyword (DCM)
■ Keyword dictionary: "CLASSIFIED//,//RESTRICTED//"
■ Severity: High
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case sensitive.
■ Match on whole or partial words.

The detection rule Other Sensitive Information looks for any keywords in the "Other Sensitive
Information" dictionary.

Table 38-15 Other Sensitive Information detection rule

Method Condition Configuration

Simple rule Content Matches Other Sensitive Information (Keyword Match):

Keyword (DCM)
■ Keyword dictionary: FOR OFFICIAL USE ONLY, SENSITIVE BUT
UNCLASSIFIED,DOD UNCLASSIFIED CONTROLLED NUCLEAR
INFORMATION
■ Severity: High
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case sensitive.
■ Match on whole words only.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Design Documents policy template

This policy detects various types of design documents, such as CAD/CAM, at risk of exposure.

IDM Rule Design Documents, Indexed

This rule looks for content from specific design documents registered as proprietary.
It returns a match if the engine detects 80% or more of the source document.
 Library of policy templates 1098
Employee Data Protection policy template

DCM Rule Design Document Extensions

This rule looks for the specified file name extensions found in the "Design Document
Extensions" dictionary.

DCM Rule Design Documents

This rule looks for the following specified file types:

■ cad_draw
■ dwg

Note: Both file types and file name extensions are used because the policy does not detect
the true file type for all the required documents.

See “Choosing an Indexed Document Profile” on page 373.

See “Configuring policies” on page 376.
See “Exporting policy detection as a template” on page 405.

Employee Data Protection policy template

This policy detects employee data at risk of exposure.

Table 38-16 EDM rules for Employee Data Protection

Name Type Description

Username/Password Combinations EDM Rule This rule looks for usernames and passwords in
combination with any three of the following data fields.

■ SSN
■ Phone
■ Email
■ First Name
■ Last Name
■ Bank Card Number
■ Account Number
■ ABA Routing Number
■ Canadian Social Insurance Number
■ UK National Insurance Number
■ Date of Birth

Employee Directory EDM Rule This rule looks for Phone or Email.
 Library of policy templates 1099
Encrypted Data policy template

Table 38-17 DCM rules for Employee Data Protection

Name Type Description

US Social Security Number Patterns DCM Rule This rule looks for a match from the Randomized US Social
Security Number (SSN) data identifier and a keyword from
the "US SSN Keywords" dictionary.

See “Randomized US Social Security Number (SSN)”

on page 1015.

Credit Card Numbers, All DCM Rule This rule looks for a match from the credit card number
system pattern and a keyword from the "Credit Card
Number Keywords" dictionary.

See “Credit Card Number ” on page 863.

ABA Routing Numbers DCM Rule This rule looks for a match from the ABA Routing number
data identifier and a keyword from the "ABA Routing
Number Keywords" dictionary.

See “ABA Routing Number” on page 798.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Encrypted Data policy template

This policy detects the use of encryption by a variety of methods including S/MIME, PGP,
GPG, and file password protection.

DCM Rule Password Protected Files

This rule looks for the following file types: encrypted_zip, encrypted_doc,
encrypted_xls, or encrypted_ppt.

DCM Rule PGP Files

This rule looks for the following file type: pgp.

DCM Rule GPG Files

This rule looks for a keyword from the "GPG Encryption Keywords" dictionary.

DCM Rule S/MIME

This rule looks for a keyword from the "S/MIME Encryption Keywords" dictionary.

DCM Rule HushMail Transmissions

This rule looks for a match from a list of recipient URLs.

 Library of policy templates 1100
Export Administration Regulations (EAR) policy template

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Export Administration Regulations (EAR) policy

template
The U.S. Department of Commerce enforces the Export Administration Regulations (EAR).
These regulations primarily cover technologies and technical information with commercial and
military applicability. These technologies are also known as dual-use technologies, for example,
chemicals, satellites, software, computers, and so on.
This Export Administration Regulations (EAR) template detects violations from regulated
countries and controlled technologies.
The detection rule Indexed EAR Commerce Control List Items and Recipients looks for a
country code in the recipient from the "EAR Country Codes" dictionary and for a specific "SKU"
from an Exact Data Profile index (EDM). Both conditions must match to trigger an incident.

Table 38-18 Detection rule: Indexed EAR Commerce Control List Items and Recipients

Method Condition Configuration

Compound rule Content Matches Exact See “Choosing an Exact Data Profile” on page 371.
Data (EDM)

Content Matches Keyword See “Configuring the Content Matches Keyword condition”
(DCM) on page 692.

The detection rule EAR Commerce Control List and Recipients looks for a country code in
the recipient from the "EAR Country Codes" list and a keyword from the "EAR CCL Keywords"
dictionary. Both conditions must match to trigger an incident.
 Library of policy templates 1101
FACTA 2003 (Red Flag Rules) policy template

Table 38-19 Detection rule: EAR Commerce Control List and Recipients

Method Condition Configuration

Compound rule Recipient Matches Pattern EAR Commerce Control List and Recipients (Recipient):
(DCM)
■ Match: Email address OR URL domain suffixes.
■ Severity: High.
■ Check for existence.
■ At least 1 recipient(s) must match.
■ Matches on entire message.

Content Matches Keyword EAR Commerce Control List and Recipients (Keyword Match):
(DCM)
■ Match: EAR CCL Keywords
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

FACTA 2003 (Red Flag Rules) policy template

This policy helps to address sections 114 and 315 (or Red Flag Rules) of the Fair and Accurate
Credit Transactions Act (FACTA) of 2003. These rules specify that a financial institution or
creditor that offers or maintains covered accounts must develop and implement an identity
theft prevention program. FACTA is designed to detect, prevent, and mitigate identity theft in
connection with the opening of a covered account or any existing covered account.
The Username/Password Combinations detection rule detects the presence of both a user
name and password from a profiled database index.

Table 38-20 Username/Password Combinations detection rule

Method Condition Configuration

Simple rule Content Matches This condition detects exact data containing both of the following data
Exact Data (EDM) items:

■ User name
■ Password

See “Choosing an Exact Data Profile” on page 371.

 Library of policy templates 1102
FACTA 2003 (Red Flag Rules) policy template

The Exact SSN or CCN detection rule detects the presence of either a social security number
or a credit card number from a profiled database.

Table 38-21 Exact SSN or CCN detection rule

Method Condition Configuration

Simple rule Content Matches This condition detects exact data containing either of the following data
Exact Data (EDM) columns:

■ Social security number (Taxpayer ID)

■ Bank Card Number

See “Choosing an Exact Data Profile” on page 371.

The Customer Directory detection rule detects the presence of either an email address or a
phone number from a profiled database.

Table 38-22 Customer Directory detection rule

Method Condition Configuration

Simple rule Content Matches This condition detects exact data containing either of the following data
Exact Data (EDM) columns:

■ Email address
■ Phone number

See “Choosing an Exact Data Profile” on page 371.

The Three or More Data Columns detection rule detects exact data containing three or more
of data items from a profiled database index.
 Library of policy templates 1103
FACTA 2003 (Red Flag Rules) policy template

Table 38-23 Three or More Data Columns detection rule

Method Condition Configuration

Simple rule Content Matches Detects exact data containing three or more of the following data items:
Exact Data (EDM)
■ ABA Routing Number
■ Account Number
■ Bank Card Number
■ Birth Date
■ Email address
■ First Name
■ Last Name
■ National Insurance Number
■ Password
■ Phone Number
■ Social Insurance Number
■ Social security number (Taxpayer ID)
■ User name

However, the following combinations are not a match:

■ Phone Number, Email, First Name

■ Phone Number, First Name, Last Name

See “Choosing an Exact Data Profile” on page 371.

The US Social Security Number Patterns detection rule implements the narrow breadth
edition of the Randomized US Social Security Number (SSN) system data identifier.
See “Randomized US Social Security Number (SSN)” on page 1015.
This data identifier detects nine-digit numbers with the pattern DDD-DD-DDDD separated with
dashes or spaces or without separators. The number must be in valid assigned number ranges.
This condition eliminates common test numbers, such as 123456789 or all the same digit. It
also requires the presence of a Social Security keyword.

Table 38-24 US Social Security Number Patterns detection rule

Method Condition Configuration

Simple rule Content Matches ■ Data Identifier: Randomized US Social Security Number (SSN) narrow
Data Identifier (DCM) breadth
■ Severity: High.
■ Count all matches.
■ Look in envelope, subject, body, attachments.
 Library of policy templates 1104
FACTA 2003 (Red Flag Rules) policy template

The Credit Card Numbers, All detection rule implements the narrow breadth edition of the
Credit Card Number system Data Identifier.
See “Credit Card Number ” on page 863.
This data identifier detects valid credit card numbers that are separated by spaces, dashes,
periods, or without separators. This condition performs Luhn check validation and includes
formats for American Express, Diner's Club, Discover, Japan Credit Bureau (JCB), MasterCard,
and Visa. It eliminates common test numbers, including those reserved for testing by credit
card issuers. It also requires the presence of a credit card keyword.

Table 38-25 Credit Card Numbers, All detection rule

Method Condition Configuration

Simple rule Content Matches ■ Data Identifier: Credit Card Number narrow breadth
Data Identifier (DCM) See “Credit Card Number narrow breadth” on page 867.
■ Severity: High.
■ Count all matches.
■ Look in envelope, subject, body, attachments.

The ABA Routing Numbers detection rule implements the narrow breadth edition of the ABA
Routing Number system Data Identifier.
See “ABA Routing Number” on page 798.
This data identifier detects nine-digit numbers. It validates the number using the final check
digit. This condition eliminates common test numbers, such as 123456789, number ranges
that are reserved for future use, and all the same digit. This condition also requires the presence
of an ABA keyword.

Table 38-26 ABA Routing Numbers detection rule

Method Condition Configuration

Simple rule Content Matches ■ Data Identifier: ABA Routing Number narrow breadth
Data Identifier (DCM) See “ABA Routing Number” on page 798.
■ Severity: High.
■ Count all matches.
■ Look in envelope, subject, body, attachments.

See “Creating a policy from a template” on page 360.

See “Exporting policy detection as a template” on page 405.
 Library of policy templates 1105
Financial Information policy template

Financial Information policy template

The Financial Information policy detects financial data and information.

IDM Rule Financial Information, Indexed

This rule looks for content from specific financial information files registered as
proprietary; returns a match if 80% or more of the source document is found.

DCM Rule Financial Information

This rule looks for the combination of specified file types, keywords from the
"Financial Keywords" dictionary, and keywords from the "Confidential/Proprietary
Words" dictionary.
The specified file types are as follows:

■ excel_macro
■ xls
■ works_spread
■ sylk
■ quattro_pro
■ mod
■ csv
■ applix_spread
■ 123

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Forbidden Websites policy template

The Forbidden Websites policy template is designed to detect access to specified web sites.

Note: To process HTTP GET requests appropriately, you may need to configure the Network
Prevent for Web server. See “To enable a Forbidden Website policy to process GET requests
appropriately” on page 1106.

Table 38-27 Forbidden Websites policy template

DCM Keyword Rule Description

Forbidden Websites This rule looks for any keywords in the "Forbidden
Websites" dictionary, which is user-defined.
 Library of policy templates 1106
Gambling policy template

To enable a Forbidden Website policy to process GET requests appropriately

1 Configure your web proxy server to forward GET requests to the Network Prevent for Web
server.
2 Set the L7.processGets Advanced Server Setting on the Network Prevent for Web server
to "true" (which is the default).
3 Reduce the L7.minSizeofGetURL Advanced Server Setting on the Network Prevent for
Web server from the default of 100 to a number of bytes (characters) smaller than the
length of the shortest web site that the policy specifies

Note: Reducing the minimum size of GETs increases the number of URLs that have to
be processed, which increases server traffic load. One approach is to calculate the number
of characters in the shortest URL specified in the list of forbidden URLs and set the
minimum size to that number. Another approach is to set the minimum URL size to 10 as
that should cover all cases.

4 You may need to adjust the "Ignore Requests Smaller Than" setting in the ICAP
configuration of the Network Prevent server from the default 4096 bytes. This value stops
processing of incoming web pages that contain fewer bytes than the number specified. If
a page of a forbidden web site URL might be smaller than that number, the setting should
be reduced appropriately.
See “Configuring policies” on page 376.
See “Exporting policy detection as a template” on page 405.

Gambling policy template

This policy detects any reference to gambling.

Table 38-28 Gambling policy template

DCM Keyword Rule DCM Rule

Suspicious Gambling Keywords This rule looks for five instances of keywords from the "Gambling
Keywords, Confirmed" dictionary.

Less Suspicious Gambling Keywords This rule looks for ten instances of keywords from the "Gambling
Keywords, Suspect" dictionary.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.
 Library of policy templates 1107
General Data Protection Regulation (Banking and Finance)

General Data Protection Regulation (Banking and

Finance)
This template focuses on GDPR banking and finance related keywords, Data Identifiers and
an EDM profile with related columns. The GDPR is a regulation by which the European
Commission intends to strengthen and unify data protection for individuals within the EU. It
also addresses export of personal data outside the EU. The Commission's primary objectives
of the GDPR are to give citizens back the control of their personal data and to simplify the
regulatory environment for international business by unifying the regulation within the EU.

Table 38-29 General Data Protection Regulations (Banking and Finance) detection rules

Name Type Description

GDPR Banking and Finance Related Keyword Match Matches a list of related keywords:
Keywords
account number, bank card number,
driver license number, ID card
number

Credit Card Number Data Identifiers Account number needed to process

credit card transactions. Often
abbreviated as CCN. Also known as
a Primary Account Number (PAN).

See “Credit Card Number ”

on page 863.

UK Driver's Licence Number
Data Identifiers The UK Drivers Licence Number is the
identification number for an individual's
driver's license issued by the Driver
and Vehicle Licensing Agency of the
United Kingdom.

See “UK Drivers Licence Number”

on page 1053.

UK Passport Number Data Identifiers The UK Passport Number identifies a

United Kingdom passport using the
current official specification of the UK
Government Standards of the UK
Cabinet Office.

See “UK Passport Number”

on page 1060.

Table 38-29
Name
UK Tax ID Number
Credit Card Magnetic Stripe Data
French Passport Number
Belgian National Number
Czech Personal Identification
Number
Library of policy templates 1108
General Data Protection Regulation (Banking and Finance)
General Data Protection Regulations (Banking and Finance) detection rules
(continued)
Type Description
Data Identifiers The UK Tax ID Number is a personal
identification number provided by the
UK Government Standards of the UK
Cabinet Office.
See “UK Tax ID Number” on page 1062.
Data Identifiers The magnetic stripe of a credit card
contains information about the card.
Storage of the complete version of this
data is a violation of the Payment Card
Industry (PCI) Data Security Standard.
See “Credit Card Magnetic Stripe
Data” on page 861.
Data Identifiers The French passport is an identity
document issued to French citizens.
Besides enabling the bearer to travel
internationally and serving as
indication of French citizenship, the
passport facilitates the process of
securing assistance from French
consular officials abroad or other
European Union member states in
case a French consular is absent, if
needed.
See “French Passport Number”
on page 903.
Data Identifiers All citizens of Belgium have a National
Number. Belgians 12 years of age and
older are issued a Belgian identity
card.
See “Belgian National Number”
on page 818.
Data Identifiers All citizens of the Czech Republic are
issued a unique personal identification
number by the Ministry of Interior.
See “Czech Personal Identification
Number” on page 874.
 Library of policy templates 1109
General Data Protection Regulation (Banking and Finance)

Table 38-29 General Data Protection Regulations (Banking and Finance) detection rules
(continued)

Name Type Description

French INSEE code Data Identifiers The INSEE code in France is used as
a social insurance number, a national
identification number, and for taxation
and employment purposes.

See “French INSEE Code”

on page 902.

French Social Security Number
Data Identifiers The French Social Security Number
(FSSN) is a unique number assigned
to each French citizen or resident
foreign national. It serves as a national
identification number.

See “French Social Security Number”

on page 905.

Greek Tax Identification Number
Data Identifiers The Arithmo Forologiko Mitro (AFM)
is a unique personal tax identification
number assigned to any individual
resident in Greece or person who
owns property in Greece.

See “Greek Tax Identification Number”

on page 914.

Hungarian Social Security Number Data Identifiers The Hungarian Social Security
Number (TAJ) is a unique identifier
issued by the Hungarian government.

See “Hungarian Social Security

Number” on page 918.

Hungarian Tax Identification Data Identifiers The Hungarian Tax Identification

Number Number is a 10-digit number that
always begins with the digit "8."

See “Hungarian Tax Identification

Number” on page 920.

Table 38-29
Name
Hungarian VAT Number
Irish Personal Public Service
Number
Luxembourg National Register of
Individuals Number
Polish Identification Number
Library of policy templates 1110
General Data Protection Regulation (Banking and Finance)
General Data Protection Regulations (Banking and Finance) detection rules
(continued)
Type Description
Data Identifiers All Hungarian businesses (including
non-profit organizations) upon
registration at the court of Registry are
granted a value-added tax (VAT)
number.
See “Hungarian VAT Number”
on page 922.
Data Identifiers The format of the number is a unique
8-character alphanumeric string
ending with a letter, such as
8765432A. The number is assigned at
the registration of birth of the child and
is issued on a Public Services Card
and is unique to every person.
See “Irish Personal Public Service
Number ” on page 952.
Data Identifiers The Luxembourg National Register of
Individuals Number is an 11-digit
identification number issued to all
Luxembourg citizens at age 15.
See “Luxembourg National Register
of Individuals Number ” on page 977.
Data Identifiers Every Polish citizen 18 years of age
or older residing permanently in
Poland must have an Identity Card,
with a unique personal number. The
number is used as identification for
almost all purposes.
See “Polish Identification Number”
on page 1006.
 Library of policy templates 1111
General Data Protection Regulation (Banking and Finance)

Table 38-29 General Data Protection Regulations (Banking and Finance) detection rules
(continued)

Name Type Description

Polish REGON Number Data Identifiers Each national economy entity is

obligated to register in the register of
business entities called REGON in
Poland. It is the only integrated
register in Poland covering all of the
national economy entities. Each
company has a unique REGON
number.

See “Polish REGON Number”

on page 1008.

Polish Social Security Number
(PESEL)
Data Identifiers The Polish Social Security Number
(PESEL) is the national identification
number used in Poland. The PESEL
number is mandatory for all permanent
residents of Poland and for temporary
residents living in Poland. It uniquely
identifies a person and cannot be
transferred to another.

See “Polish Social Security Number

(PESEL)” on page 1010.

Polish Tax Identification Number
Data Identifiers The Polish Tax Identification Number
(NIP) is a number the government
gives to every Poland citizen who
works or does business in Poland. All
taxpayers have a tax identification
number called NIP.

See “Polish Tax Identification Number”

on page 1012.

Romanian Numerical Personal Code Data Identifiers In Romania, each citizen has a unique
numerical personal code (Code
Numeric Personal, or CNP). The
number is used by authorities, health
care, schools, universities, banks, and
insurance companies for customer
identification.

See “Romanian Numerical Personal

Code” on page 1017.
 Library of policy templates 1112
General Data Protection Regulation (Banking and Finance)

Table 38-29 General Data Protection Regulations (Banking and Finance) detection rules
(continued)

Name Type Description

Spanish DNI ID Data Identifiers The Spanish DNI ID appears on the

Documento nacional de identidad
(DNI) and is issued by the Spanish
Hacienda Publica to every citizen of
Spain. It is the most important unique
identifier in Spain used for opening
accounts, signing contracts, taxes, and
elections.

See “Spanish DNI ID” on page 1030.

Spanish Social Security Number Data Identifiers The Spanish Social Security Number
is a 12-digit number assigned to
Spanish workers to allow access to
the Spanish healthcare system.

See “Spanish Social Security Number

” on page 1034.

Spanish Customer Account Number Data Identifiers The Spanish customer account
number is the standard customer bank
account number used across Spain.

See “Spanish Customer Account

Number” on page 1028.

Spanish Tax ID (CIF) Data Identifiers The Spanish Tax Identification

corporate tax identifier (CIF) is
equivalent to the VAT number,
required for running a business in
Spain. This identifier is a company's
identification for tax purposes and is
required for any legal transactions.

See “Spanish Tax Identification (CIF)”

on page 1036.

Table 38-29 General Data Protection Regulations (Banking and Finance) detection rules
(continued)
Name
German Passport Number
Bulgarian Uniform Civil Number
Austrian Social Security Number
Spanish Passport Number
Library of policy templates 1113
General Data Protection Regulation (Banking and Finance)
Type Description
Data Identifiers The German passport number is
issued to German nationals for the
purpose of international travel. A
German passport is an officially
recognized document that German
authorities accept as proof of identity
from German citizens.
See “German Passport Number”
on page 907.
Data Identifiers The uniform civil number (EGN) is
unique number assigned to each
Bulgarian citizen or resident foreign
national. It serves as a national
identification number. An EGN is
assigned to Bulgarians at birth, or
when a birth certificate is issued.
See “Bulgarian Uniform Civil Number
- EGN” on page 840.
Data Identifiers A social security number is allocated
to Austrian citizens who receive
available social security benefits. It is
allocated by the umbrella association
of the Austrian social security
authorities.
See “Austrian Social Security Number”
on page 816.
Data Identifiers Spanish passports are issued to
Spanish citizens for the purpose of
travel outside Spain.
See “Spanish Passport Number”
on page 1032.
 Library of policy templates 1114
General Data Protection Regulation (Banking and Finance)

Table 38-29 General Data Protection Regulations (Banking and Finance) detection rules
(continued)

Name Type Description

Swedish Passport Number Data Identifiers Swedish passports are issued to

nationals of Sweden for the purpose
of international travel. Besides serving
as proof of Swedish citizenship, they
facilitate the process of securing
assistance from Swedish consular
officials abroad or other European
Union member states in case a
Swedish consular is absent, if needed.

See “Swedish Passport Number”

on page 1039.

German Personal ID Number Data Identifiers The German Personal ID Number is

issued to all German citizens.

See “German Personal ID Number”

on page 909.

IBAN Central Data Identifiers The International Bank Account

Number (IBAN) is an international
standard for identifying bank accounts
across national borders.

The IBAN Central data identifier

detects IBAN numbers for Andorra,
Austria, Belgium, Germany, Italy,
Liechtenstein, Luxembourg, Malta,
Monaco, San Marino, and Switzerland.

See “IBAN Central” on page 924.

 Library of policy templates 1115
General Data Protection Regulation (Banking and Finance)

Table 38-29 General Data Protection Regulations (Banking and Finance) detection rules
(continued)

Name Type Description

IBAN East Data Identifiers The International Bank Account

Number (IBAN) is an international
standard for identifying bank accounts
across national borders.

The IBAN East data identifier detects

IBAN numbers for Bosnia, Bulgaria,
Croatia, Cyprus, Czech Republic,
Estonia, Greece, Hungary, Israel,
Latvia, Lithuania, Macedonia,
Montenegro, Poland, Romania, Serbia,
Slovakia, Slovenia, Turkey, and
Tunisia.

See “IBAN East” on page 928.

IBAN West Data Identifiers The International Bank Account

Number (IBAN) is an international
standard for identifying bank accounts
across national borders.

The IBAN West data identifier detects

IBAN numbers for Denmark, Faroe
Islands, Finland, France, Gibraltar,
Greenland, Iceland, Ireland,
Netherlands, Norway, Portugal, Spain,
Sweden, and the United Kingdom.

See “IBAN West” on page 934.

Burgerservicenummer Data Identifiers In the Netherlands, the

Burgerservicenummer is used to
uniquely identify citizens and is printed
on driving licenses, passports and
international ID cards under the
header Personal Number.

See “Burgerservicenummer”
on page 842.
 Library of policy templates 1116
General Data Protection Regulation (Banking and Finance)

Table 38-29 General Data Protection Regulations (Banking and Finance) detection rules
(continued)

Name Type Description

Codice Fiscale Data Identifiers The Codice Fiscale uniquely identifies

an Italian citizen or permanent resident
alien and issuance of the code is
centralized to the Ministry of Treasure.
The Codice Fiscale is issued to every
Italian at birth.

See “Codice Fiscale” on page 850.

Finnish Personal Identification Data Identifiers The Finnish Personal Identification

Number Number or Personal Identity Code is
a unique personal identifier used for
identifying citizens in government and
many other transactions.

See “Finnish Personal Identification

Number” on page 893.

Swedish Personal Identification Data Identifiers The Swedish Personal Identification

Number Number is the unique national
identification for Swedish every citizen.
The number is used by authorities,
health care, schools, universities,
banks, and insurance companies for
customer identification.

See “Swedish Personal Identification

Number” on page 1040.

Austria Passport Number Data Identifiers Austrian passports are travel

documents issued to Austrian citizens
by the Austrian Passport Office of the
Department of Foreign Affairs and
Trade, both in Austria and overseas,
and enable the passport holder to
travel internationally.

See “Austria Passport Number”

on page 813.
 Library of policy templates 1117
General Data Protection Regulation (Banking and Finance)

Table 38-29 General Data Protection Regulations (Banking and Finance) detection rules
(continued)

Name Type Description

Austria Tax Identification Number Data Identifiers Austria issues tax identification
numbers to individuals based on their
area of residence to identify taxpayers
and facilitate national taxes.

See “Austria Tax Identification

Number” on page 814.

Belgium Passport Number Data Identifiers Belgian passports are passports

issued by the Belgian state to its
citizens to facilitate international travel.
The Federal Public Service Foreign
Affairs, formerly known as the Ministry
of Foreign Affairs, is responsible for
issuing and renewing Belgian
passports.

See “Belgium Passport Number”

on page 822.

Belgium Tax Identification Number Data Identifiers Belgium issues a tax identification
number for persons who has
obligations to declare taxes in
Belgium.

See “Belgium Tax Identification

Number” on page 823.

Belgium Value Added Tax (VAT) Data Identifiers VAT is a consumption tax that is borne
Number by the end consumer. VAT is paid for
each transaction in the manufacturing
and distribution process. For Belgium,
the Value Added Tax is issued by VAT
office for the region in which the
business is established.

See “Belgium Value Added Tax (VAT)

Number” on page 825.

Belgium Driver's License Number Data Identifiers Identification number for an individual's
driver's licence issued by the Driver
and Vehicle Licensing Agency of
Belgium.

See “Belgium Driver's License

Number” on page 820.
 Library of policy templates 1118
General Data Protection Regulation (Banking and Finance)

Table 38-29 General Data Protection Regulations (Banking and Finance) detection rules
(continued)

Name Type Description

Denmark Personal Identification Data Identifiers In Denmark, every citizen has a

Number national identification number. The
number serves as proof of
identification for almost all purposes.

See “Denmark Personal Identification

Number” on page 877.

Netherlands Driver's License Data Identifiers Identification number for an individual's

Number driver's licence issued by the RDW
government agency of the
Netherlands.

See “Netherlands Driver's License

Number” on page 993.

Netherlands Passport Number Data Identifiers Dutch passports are issued to

Netherlands citizens for the purpose
of international travel.

See “Netherlands Passport Number”

on page 995.

Netherlands Value Added Tax (VAT) Data Identifiers VAT is a consumption tax that is borne
Number by the end consumer. VAT is paid for
each transaction in the manufacturing
and distribution process. For the
Netherlands, the Value Added Tax is
issued by VAT office for the region in
which the business is established.

See “Netherlands Value Added Tax

(VAT) Number” on page 999.

France Driver's License Number Data Identifiers Identification number for an individual's
driver's licence issued by the Driver
and Vehicle Licensing Agency of
France.

See “France Driver's License Number”

on page 895.
 Library of policy templates 1119
General Data Protection Regulation (Banking and Finance)

Table 38-29 General Data Protection Regulations (Banking and Finance) detection rules
(continued)

Name Type Description

France Tax Identification Number Data Identifiers France issue a tax identification
number for anyone who has
obligations to declare taxes in France.

See “France Tax Identification

Number” on page 898.

Germany Driver's License Number Data Identifiers Identification number for an individual's
driver's licence issued by the Driver
and Vehicle Licensing Agency of
Germany.

See “Germany Driver's License

Number” on page 910.

Italy Passport Number Data Identifiers Italian passports are issued to Italian
citizens for the purpose of international
travel.

See “Italy Passport Number”

on page 960.

Italy Value Added Tax (VAT) Data Identifiers VAT is a consumption tax that is borne
Number by the end consumer. VAT is paid for
each transaction in the manufacturing
and distribution process. For Italy, the
Value Added Tax is issued by VAT
office for the region in which the
business is established.

See “Italy Value Added Tax (VAT)

Number” on page 961.

Italy Driver's License Number Data Identifiers Identification number for an individual's
driver's licence issued by the Driver
and Vehicle Licensing Agency of Italy.

See “Italy Driver's License Number”

on page 956.

Netherlands Tax Identification Data Identifiers The Netherlands issues a tax

Number identification number at birth or at
registration at the municipality.

See “Netherlands Tax Identification

Number” on page 996.
 Library of policy templates 1120
General Data Protection Regulation (Banking and Finance)

Table 38-29 General Data Protection Regulations (Banking and Finance) detection rules
(continued)

Name Type Description

Spain Driver's License Number Data Identifiers Identification number for an individual's
driver's licence issued by the Driver
and Vehicle Licensing Agency of
Spain.

See “Spain Driver's License Number”

on page 1025.

Ukraine Identity Card
Data Identifiers The Ukraine Identity Card has a
15-digit record number issued to
citizens of Ukraine. It is used as a form
of identification in place of Ukraine's
domestic passport as of January 2016.

See “Ukraine Identity Card”

on page 1065.

Ukraine Domestic Passport Number Data Identifiers An identity document issued to citizens
of Ukraine for domestic use. It has
been replaced by the Ukraine Identity
Card as of 2016, but any existing
passports are still valid.

See “Ukraine Passport (Domestic)”

on page 1064.

Ukraine International Passport Data Identifiers A document used by citizens of

Number Ukraine to travel outside of Ukraine.

See “Ukraine Passport (International)”

on page 1067.

Germany Value Added Tax (VAT)
Number
Data Identifiers VAT is a consumption tax that is borne
by the end consumer. VAT is paid for
each transaction in the manufacturing
and distribution process. For Germany,
the Value Added Tax is issued by VAT
office for the region in which the
business is established.

See “Germany Driver's License

Number” on page 910.
 Library of policy templates 1121
General Data Protection Regulation (Digital Identity)

Table 38-29 General Data Protection Regulations (Banking and Finance) detection rules
(continued)

Name Type Description

France Value Added Tax (VAT) Data Identifiers The Value Added Tax (VAT), is a tax
Number levied on goods and services provided
in France and is collected from the
final customer. Companies must
register with the Register of
Commerce and Companies in France
to get VAT number allocated.

See “France Value Added Tax (VAT)

Number” on page 899.

General Data Protection Regulation (Digital Identity)

This template focuses on digital identity related keywords, Data Identifiers and an EDM profile
with related columns. The GDPR is a Regulation by which the European Commission intends
to strengthen and unify data protection for individuals within the EU. It also addresses export
of personal data outside the EU. The Commission's primary objectives of the GDPR are to
give citizens back the control of their personal data and to simplify the regulatory environment
for international business by unifying the regulation within the EU.

Table 38-30 General Data Protection Regulations (Digital Identity) detection rule

Name Type Description

International Mobile Equipment Data Identifiers The International Mobile Station

Identity Number Equipment Identity (IMEI) is a
unique identifier for 3GPP (GSM,
UMTS, and LTE) and iDEN mobile
phones and some satellite
phones.

See “International Mobile

Equipment Identity Number”
on page 944.

General Data Protection Regulation (Government

Identification)
This template focuses on government identification related keywords, data identifiers and an
EDM profile with related columns. The GDPR is a Regulation by which the European
 Library of policy templates 1122
General Data Protection Regulation (Government Identification)

Commission intends to strengthen and unify data protection for individuals within the EU. It
also addresses export of personal data outside the EU. The Commission's primary objectives
of the GDPR are to give citizens back the control of their personal data and to simplify the
regulatory environment for international business by unifying the regulation within the EU.

Table 38-31 General Data Protection Regulations (Government Identification) detection

rules

Name Type Description

GDPR Government Keyword Match Matches a list of related

Identification Keywords keywords:

driver license number, id card

number, electoral roll number

UK Driver's Licence Number Data Identifiers The UK Drivers Licence Number

is the identification number for an
individual's driver's license issued
by the Driver and Vehicle
Licensing Agency of the United
Kingdom.

See “UK Drivers Licence Number”

on page 1053.

UK Electoral Roll Number
Data Identifiers The Electoral Roll Number is the
identification number issued to an
individual for UK election
registration. The format of this
number is specified by the UK
Government Standards of the UK
Cabinet Office.

See “UK Electoral Roll Number”

on page 1055.

UK National Health Service Data Identifiers The UK National Health Service

(NHS) (NHS) Number is the personal
identification number issued by
the U.K. National Health Service
(NHS) for administration of
medical care.

See “UK National Health Service

(NHS) Number” on page 1056.
 Library of policy templates 1123
General Data Protection Regulation (Government Identification)

Table 38-31 General Data Protection Regulations (Government Identification) detection

rules (continued)

Name Type Description

UK National Insurance Number Data Identifiers The UK National Insurance

Number is issued by the United
Kingdom Department for Work
and Pensions (DWP) to identify
an individual for the national
insurance program. It is also
known as a NI number, NINO or
NINo.

See “UK National Insurance

Number” on page 1058.

UK Passport Number Data Identifiers The UK Passport Number

identifies a United Kingdom
passport using the current official
specification of the UK
Government Standards of the UK
Cabinet Office.

See “UK Passport Number”

on page 1060.

UK Tax ID Number Data Identifiers The UK Tax ID Number is a

personal identification number
provided by the UK Government
Standards of the UK Cabinet
Office.

See “UK Tax ID Number”

on page 1062.
 Library of policy templates 1124
General Data Protection Regulation (Government Identification)

Table 38-31 General Data Protection Regulations (Government Identification) detection

rules (continued)

Name Type Description

French Passport Number Data Identifiers The French passport is an identity

document issued to French
citizens. Besides enabling the
bearer to travel internationally and
serving as indication of French
citizenship, the passport facilitates
the process of securing
assistance from French consular
officials abroad or other European
Union member states in case a
French consular is absent, if
needed.

See “French Passport Number”

on page 903.

Belgian National Number Data Identifiers All citizens of Belgium have a

National Number. Belgians 12
years of age and older are issued
a Belgian identity card.

See “Belgian National Number”

on page 818.

Czech Personal Identification Data Identifiers All citizens of the Czech Republic
Number are issued a unique personal
identification number by the
Ministry of Interior.

See “Czech Personal

Identification Number”
on page 874.

French INSEE code Data Identifiers The INSEE code in France is

used as a social insurance
number, a national identification
number, and for taxation and
employment purposes.

See “French INSEE Code”

on page 902.
 Library of policy templates 1125
General Data Protection Regulation (Government Identification)

Table 38-31 General Data Protection Regulations (Government Identification) detection

rules (continued)

Name Type Description

French Social Security Number Data Identifiers The French Social Security
Number (FSSN) is a unique
number assigned to each French
citizen or resident foreign national.
It serves as a national
identification number.

See “French Social Security

Number” on page 905.

Greek Tax Identification Data Identifiers The Arithmo Forologiko Mitro

Number (AFM) is a unique personal tax
identification number assigned to
any individual resident in Greece
or person who owns property in
Greece.

See “Greek Tax Identification

Number” on page 914.

Hungarian Social Security Data Identifiers The Hungarian Social Security

Number Number (TAJ) is a unique
identifier issued by the Hungarian
government.

See “Hungarian Social Security

Number” on page 918.

Hungarian Tax Identification Data Identifiers The Hungarian Tax Identification

Number Number is a 10-digit number that
always begins with the digit "8."

See “Hungarian Tax Identification

Number” on page 920.

Hungarian VAT Number Data Identifiers All Hungarian businesses

(including non-profit
organizations) upon registration
at the court of Registry are
granted a value-added tax (VAT)
number.

See “Hungarian VAT Number”

on page 922.

Table 38-31 General Data Protection Regulations (Government Identification) detection
rules (continued)
Name
Irish Personal Public Service
Number
Luxembourg National Register Data Identifiers
of Individuals Number
Polish Identification Number
Polish REGON Number
Library of policy templates 1126
General Data Protection Regulation (Government Identification)
Type Description
Data Identifiers The format of the number is a
unique 8-character alphanumeric
string ending with a letter, such
as 8765432A. The number is
assigned at the registration of
birth of the child and is issued on
a Public Services Card and is
unique to every person.
See “Irish Personal Public Service
Number ” on page 952.
The Luxembourg National
Register of Individuals Number is
an 11-digit identification number
issued to all Luxembourg citizens
at age 15.
See “Luxembourg National
Register of Individuals Number ”
on page 977.
Data Identifiers Every Polish citizen 18 years of
age or older residing permanently
in Poland must have an Identity
Card, with a unique personal
number. The number is used as
identification for almost all
purposes.
See “Polish Identification Number”
on page 1006.
Data Identifiers Each national economy entity is
obligated to register in the register
of business entities called
REGON in Poland. It is the only
integrated register in Poland
covering all of the national
economy entities. Each company
has a unique REGON number.
See “Polish REGON Number”
on page 1008.
 Library of policy templates 1127
General Data Protection Regulation (Government Identification)

Table 38-31 General Data Protection Regulations (Government Identification) detection

rules (continued)

Name Type Description

Polish Social Security Number Data Identifiers The Polish Social Security
(PESEL) Number (PESEL) is the national
identification number used in
Poland. The PESEL number is
mandatory for all permanent
residents of Poland and for
temporary residents living in
Poland. It uniquely identifies a
person and cannot be transferred
to another.

See “Polish Social Security

Number (PESEL)” on page 1010.

Polish Tax Identification Data Identifiers The Polish Tax Identification

Number Number (NIP) is a number the
government gives to every Poland
citizen who works or does
business in Poland. All taxpayers
have a tax identification number
called NIP.

See “Polish Tax Identification

Number” on page 1012.

Romanian Numerical Personal Data Identifiers In Romania, each citizen has a

Code unique numerical personal code
(Code Numeric Personal, or
CNP). The number is used by
authorities, health care, schools,
universities, banks, and insurance
companies for customer
identification.

See “Romanian Numerical

Personal Code” on page 1017.
 Library of policy templates 1128
General Data Protection Regulation (Government Identification)

Table 38-31 General Data Protection Regulations (Government Identification) detection

rules (continued)

Name Type Description

Spanish DNI ID Data Identifiers The Spanish DNI ID appears on

the Documento nacional de
identidad (DNI) and is issued by
the Spanish Hacienda Publica to
every citizen of Spain. It is the
most important unique identifier
in Spain used for opening
accounts, signing contracts, taxes,
and elections.

See “Spanish DNI ID” on page 1030.

Spanish Social Security Data Identifiers The Spanish Social Security

Number Number is a 12-digit number
assigned to Spanish workers to
allow access to the Spanish
healthcare system.

See “Spanish Social Security

Number ” on page 1034.

Spanish Customer Account Data Identifiers The Spanish customer account

Number number is the standard customer
bank account number used
across Spain.

See “Spanish Customer Account

Number” on page 1028.

Spanish Tax ID (CIF) Data Identifiers The Spanish Tax Identification

corporate tax identifier (CIF) is
equivalent to the VAT number,
required for running a business in
Spain. This identifier is a
company's identification for tax
purposes and is required for any
legal transactions.

See “Spanish Tax Identification

(CIF)” on page 1036.
 Library of policy templates 1129
General Data Protection Regulation (Government Identification)

Table 38-31 General Data Protection Regulations (Government Identification) detection

rules (continued)

Name Type Description

German Passport Number Data Identifiers The German passport number is

issued to German nationals for
the purpose of international travel.
A German passport is an officially
recognized document that
German authorities accept as
proof of identity from German
citizens.

See “German Passport Number”

on page 907.

Bulgarian Uniform Civil Number Data Identifiers The uniform civil number (EGN)
is unique number assigned to
each Bulgarian citizen or resident
foreign national. It serves as a
national identification number. An
EGN is assigned to Bulgarians at
birth, or when a birth certificate is
issued.

See “Bulgarian Uniform Civil

Number - EGN” on page 840.

Austrian Social Security Data Identifiers A social security number is

Number allocated to Austrian citizens who
receive available social security
benefits. It is allocated by the
umbrella association of the
Austrian social security
authorities.

See “Austrian Social Security

Number” on page 816.

Spanish Passport Number Data Identifiers Spanish passports are issued to

Spanish citizens for the purpose
of travel outside Spain.

See “Spanish Passport Number”

on page 1032.
 Library of policy templates 1130
General Data Protection Regulation (Government Identification)

Table 38-31 General Data Protection Regulations (Government Identification) detection

rules (continued)

Name Type Description

Swedish Passport Number Data Identifiers Swedish passports are issued to

nationals of Sweden for the
purpose of international travel.
Besides serving as proof of
Swedish citizenship, they facilitate
the process of securing
assistance from Swedish consular
officials abroad or other European
Union member states in case a
Swedish consular is absent, if
needed.

See “Swedish Passport Number”

on page 1039.

German Personal ID Number Data Identifiers The German Personal ID Number

is issued to all German citizens.

See “German Personal ID

Number” on page 909.

Burgerservicenummer Data Identifiers In the Netherlands, the

Burgerservicenummer is used to
uniquely identify citizens and is
printed on driving licenses,
passports and international ID
cards under the header Personal
Number.

See “Burgerservicenummer”
on page 842.

Codice Fiscale Data Identifiers The Codice Fiscale uniquely

identifies an Italian citizen or
permanent resident alien and
issuance of the code is centralized
to the Ministry of Treasure. The
Codice Fiscale is issued to every
Italian at birth.

See “Codice Fiscale” on page 850.

 Library of policy templates 1131
General Data Protection Regulation (Government Identification)

Table 38-31 General Data Protection Regulations (Government Identification) detection

rules (continued)

Name Type Description

Finnish Personal Identification Data Identifiers The Finnish Personal

Number Identification Number or Personal
Identity Code is a unique personal
identifier used for identifying
citizens in government and many
other transactions.

See “Finnish Personal

Identification Number”
on page 893.

Swedish Personal Identification Data Identifiers The Swedish Personal

Number Identification Number is the
unique national identification for
Swedish every citizen. The
number is used by authorities,
health care, schools, universities,
banks, and insurance companies
for customer identification.

See “Swedish Personal

Identification Number”
on page 1040.

Austria Passport Number Data Identifiers Austrian passports are travel

documents issued to Austrian
citizens by the Austrian Passport
Office of the Department of
Foreign Affairs and Trade, both in
Austria and overseas, and enable
the passport holder to travel
internationally.

See “Austria Passport Number”

on page 813.

Austria Tax Identification Data Identifiers Austria issues tax identification

Number numbers to individuals based on
their area of residence to identify
taxpayers and facilitate national
taxes.

See “Austria Tax Identification

Number” on page 814.
 Library of policy templates 1132
General Data Protection Regulation (Government Identification)

Table 38-31 General Data Protection Regulations (Government Identification) detection

rules (continued)

Name Type Description

Belgium Passport Number Data Identifiers Belgian passports are passports

issued by the Belgian state to its
citizens to facilitate international
travel. The Federal Public Service
Foreign Affairs, formerly known
as the Ministry of Foreign Affairs,
is responsible for issuing and
renewing Belgian passports.

See “Belgium Passport Number”

on page 822.

Belgium Tax Identification Data Identifiers Belgium issues a tax identification

Number number for persons who has
obligations to declare taxes in
Belgium.

See “Belgium Tax Identification

Number” on page 823.

Belgium Value Added Tax (VAT) Data Identifiers VAT is a consumption tax that is
Number borne by the end consumer. VAT
is paid for each transaction in the
manufacturing and distribution
process. For Belgium, the Value
Added Tax is issued by VAT office
for the region in which the
business is established.

See “Belgium Value Added Tax

(VAT) Number” on page 825.

Belgium Driver's License Data Identifiers Identification number for an

Number individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of Belgium.

See “Belgium Driver's License

Number” on page 820.
 Library of policy templates 1133
General Data Protection Regulation (Government Identification)

Table 38-31 General Data Protection Regulations (Government Identification) detection

rules (continued)

Name Type Description

Denmark Personal Data Identifiers In Denmark, every citizen has a

Identification Number national identification number. The
number serves as proof of
identification for almost all
purposes.

See “Denmark Personal

Identification Number”
on page 877.

Netherlands Driver's License Data Identifiers Identification number for an

Number individual's driver's licence issued
by the RDW government agency
of the Netherlands.

See “Netherlands Driver's License

Number” on page 993.

Netherlands Passport Number Data Identifiers Dutch passports are issued to

Netherlands citizens for the
purpose of international travel.

See “Netherlands Passport

Number” on page 995.

Netherlands Value Added Tax
(VAT) Number
Data Identifiers VAT is a consumption tax that is
borne by the end consumer. VAT
is paid for each transaction in the
manufacturing and distribution
process. For the Netherlands, the
Value Added Tax is issued by
VAT office for the region in which
the business is established.

See “Netherlands Value Added

Tax (VAT) Number” on page 999.

France Driver's License Data Identifiers Identification number for an

Number individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of France.

See “France Driver's License

Number” on page 895.
 Library of policy templates 1134
General Data Protection Regulation (Government Identification)

Table 38-31 General Data Protection Regulations (Government Identification) detection

rules (continued)

Name Type Description

France Health Insurance Data Identifiers A Carte Vitale is social insurance

Number card used in France that contains
medical information for the card
holder. It has a unique 21-digit
serial number.

See “France Health Insurance

Number” on page 896.

France Tax Identification Data Identifiers France issue a tax identification

Number number for anyone who has
obligations to declare taxes in
France.

See “France Tax Identification

Number” on page 898.

Germany Driver's License Data Identifiers Identification number for an

Number individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of Germany.

See “Germany Driver's License

Number” on page 910.

Italy Passport Number Data Identifiers Italian passports are issued to

Italian citizens for the purpose of
international travel.

See “Italy Passport Number”

on page 960.

Italy Value Added Tax (VAT)
Number
Data Identifiers VAT is a consumption tax that is
borne by the end consumer. VAT
is paid for each transaction in the
manufacturing and distribution
process. For Italy, the Value
Added Tax is issued by VAT office
for the region in which the
business is established.

See “Italy Value Added Tax (VAT)

Number” on page 961.
 Library of policy templates 1135
General Data Protection Regulation (Government Identification)

Table 38-31 General Data Protection Regulations (Government Identification) detection

rules (continued)

Name Type Description

Italy Driver's License Number Data Identifiers Identification number for an

individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of Italy.

See “Italy Driver's License

Number” on page 956.

Netherlands Tax Identification Data Identifiers The Netherlands issues a tax

Number identification number at birth or at
registration at the municipality.

See “Netherlands Tax

Identification Number”
on page 996.

Spain Driver's License Number Data Identifiers Identification number for an

individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of Spain.

See “Spain Driver's License

Number” on page 1025.

Ukraine Identity Card
Data Identifiers The Ukraine Identity Card has a
15-digit record number issued to
citizens of Ukraine. It is used as
a form of identification in place of
Ukraine's domestic passport as of
January 2016.

See “Ukraine Identity Card”

on page 1065.

Ukraine Domestic Passport Data Identifiers An identity document issued to

Number citizens of Ukraine for domestic
use. It has been replaced by the
Ukraine Identity Card as of 2016,
but any existing passports are still
valid.

See “Ukraine Passport

(Domestic)” on page 1064.
 Library of policy templates 1136
General Data Protection Regulation (Healthcare and Insurance)

Table 38-31 General Data Protection Regulations (Government Identification) detection

rules (continued)

Name Type Description

Ukraine International Passport Data Identifiers A document used by citizens of

Number Ukraine to travel outside of
Ukraine.

See “Ukraine Passport

(International)” on page 1067.

Germany Value Added Tax
(VAT) Number
Data Identifiers VAT is a consumption tax that is
borne by the end consumer. VAT
is paid for each transaction in the
manufacturing and distribution
process. For Germany, the Value
Added Tax is issued by VAT office
for the region in which the
business is established.

See “Germany Driver's License

Number” on page 910.

France Value Added Tax (VAT)
Number
Data Identifiers The Value Added Tax (VAT), is a
tax levied on goods and services
provided in France and is
collected from the final customer.
Companies must register with the
Register of Commerce and
Companies in France to get VAT
number allocated.

See “France Value Added Tax

(VAT) Number” on page 899.

General Data Protection Regulation (Healthcare and

Insurance)
This template focuses on healthcare and insurance related keywords, Data Identifiers and an
EDM profile with related columns. The GDPR is a Regulation by which the European
Commission intends to strengthen and unify data protection for individuals within the EU. It
also addresses export of personal data outside the EU. The Commission's primary objectives
of the GDPR are to give citizens back the control of their personal data and to simplify the
regulatory environment for international business by unifying the regulation within the EU.
 Library of policy templates 1137
General Data Protection Regulation (Healthcare and Insurance)

Table 38-32 General Data Protection Regulations (Healthcare and Insurance) detection rules

Name Type Description

GDPR Healthcare and Keyword Match Matches a list of related

Insurance Related Keywords keywords:

account number, bank card

number, ID card number,
medical record number

UK Driver's Licence Number Data Identifiers The UK Drivers Licence Number

is the identification number for an
individual's driver's license issued
by the Driver and Vehicle
Licensing Agency of the United
Kingdom.

See “UK Drivers Licence Number”

on page 1053.

UK National Health Service Data Identifiers The UK National Health Service

(NHS) (NHS) Number is the personal
identification number issued by
the U.K. National Health Service
(NHS) for administration of
medical care.

See “UK National Health Service

(NHS) Number” on page 1056.

UK National Insurance Number Data Identifiers The UK National Insurance

Number is issued by the United
Kingdom Department for Work
and Pensions (DWP) to identify
an individual for the national
insurance program. It is also
known as a NI number, NINO or
NINo.

See “UK National Insurance

Number” on page 1058.

Belgian National Number Data Identifiers All citizens of Belgium have a

National Number. Belgians 12
years of age and older are issued
a Belgian identity card.

See “Belgian National Number”

on page 818.
 Library of policy templates 1138
General Data Protection Regulation (Healthcare and Insurance)

Table 38-32 General Data Protection Regulations (Healthcare and Insurance) detection rules
(continued)

Name Type Description

Czech Personal Identification Data Identifiers All citizens of the Czech Republic
Number are issued a unique personal
identification number by the
Ministry of Interior.

See “Czech Personal

Identification Number”
on page 874.

French INSEE code Data Identifiers The INSEE code in France is

used as a social insurance
number, a national identification
number, and for taxation and
employment purposes.

See “French INSEE Code”

on page 902.

French Social Security Number Data Identifiers The French Social Security
Number (FSSN) is a unique
number assigned to each French
citizen or resident foreign national.
It serves as a national
identification number.

See “French Social Security

Number” on page 905.

Hungarian Social Security Data Identifiers The Hungarian Social Security

Number Number (TAJ) is a unique
identifier issued by the Hungarian
government.

See “Hungarian Social Security

Number” on page 918.
 Library of policy templates 1139
General Data Protection Regulation (Healthcare and Insurance)

Table 38-32 General Data Protection Regulations (Healthcare and Insurance) detection rules
(continued)

Name Type Description

Irish Personal Public Service
Number
Data Identifiers The format of the number is a
unique 8-character alphanumeric
string ending with a letter, such
as 8765432A. The number is
assigned at the registration of
birth of the child and is issued on
a Public Services Card and is
unique to every person.

See “Irish Personal Public Service

Number ” on page 952.

Luxembourg National Register Data Identifiers The Luxembourg National

of Individuals Number Register of Individuals Number is
an 11-digit identification number
issued to all Luxembourg citizens
at age 15.

See “Luxembourg National

Register of Individuals Number ”
on page 977.

Polish Identification Number Data Identifiers Every Polish citizen 18 years of

age or older residing permanently
in Poland must have an Identity
Card, with a unique personal
number. The number is used as
identification for almost all
purposes.

See “Polish Identification Number”

on page 1006.

Polish REGON Number Data Identifiers Each national economy entity is

obligated to register in the register
of business entities called
REGON in Poland. It is the only
integrated register in Poland
covering all of the national
economy entities. Each company
has a unique REGON number.

See “Polish REGON Number”

on page 1008.
 Library of policy templates 1140
General Data Protection Regulation (Healthcare and Insurance)

Table 38-32 General Data Protection Regulations (Healthcare and Insurance) detection rules
(continued)

Name Type Description

Polish Social Security Number Data Identifiers The Polish Social Security
(PESEL) Number (PESEL) is the national
identification number used in
Poland. The PESEL number is
mandatory for all permanent
residents of Poland and for
temporary residents living in
Poland. It uniquely identifies a
person and cannot be transferred
to another.

See “Polish Social Security

Number (PESEL)” on page 1010.

Romanian Numerical Personal Data Identifiers In Romania, each citizen has a

Code unique numerical personal code
(Code Numeric Personal, or
CNP). The number is used by
authorities, health care, schools,
universities, banks, and insurance
companies for customer
identification.

See “Romanian Numerical

Personal Code” on page 1017.

Spanish DNI ID Data Identifiers The Spanish DNI ID appears on

the Documento nacional de
identidad (DNI) and is issued by
the Spanish Hacienda Publica to
every citizen of Spain. It is the
most important unique identifier
in Spain used for opening
accounts, signing contracts, taxes,
and elections.

See “Spanish DNI ID” on page 1030.

 Library of policy templates 1141
General Data Protection Regulation (Healthcare and Insurance)

Table 38-32 General Data Protection Regulations (Healthcare and Insurance) detection rules
(continued)

Name Type Description

Spanish Social Security Data Identifiers The Spanish Social Security

Number Number is a 12-digit number
assigned to Spanish workers to
allow access to the Spanish
healthcare system.

See “Spanish Social Security

Number ” on page 1034.

Bulgarian Uniform Civil Number Data Identifiers The uniform civil number (EGN)
is unique number assigned to
each Bulgarian citizen or resident
foreign national. It serves as a
national identification number. An
EGN is assigned to Bulgarians at
birth, or when a birth certificate is
issued.

See “Bulgarian Uniform Civil

Number - EGN” on page 840.

Austrian Social Security Data Identifiers A social security number is

Number allocated to Austrian citizens who
receive available social security
benefits. It is allocated by the
umbrella association of the
Austrian social security
authorities.

See “Austrian Social Security

Number” on page 816.

German Personal ID Number Data Identifiers The German Personal ID Number

is issued to all German citizens.

See “German Personal ID

Number” on page 909.
 Library of policy templates 1142
General Data Protection Regulation (Healthcare and Insurance)

Table 38-32 General Data Protection Regulations (Healthcare and Insurance) detection rules
(continued)

Name Type Description

Burgerservicenummer Data Identifiers In the Netherlands, the

Burgerservicenummer is used to
uniquely identify citizens and is
printed on driving licenses,
passports and international ID
cards under the header Personal
Number.

See “Burgerservicenummer”
on page 842.

Codice Fiscale Data Identifiers The Codice Fiscale uniquely

identifies an Italian citizen or
permanent resident alien and
issuance of the code is centralized
to the Ministry of Treasure. The
Codice Fiscale is issued to every
Italian at birth.

See “Codice Fiscale” on page 850.

Finnish Personal Identification Data Identifiers The Finnish Personal

Number Identification Number or Personal
Identity Code is a unique personal
identifier used for identifying
citizens in government and many
other transactions.

See “Finnish Personal

Identification Number”
on page 893.

Swedish Personal Identification Data Identifiers The Swedish Personal

Number Identification Number is the
unique national identification for
Swedish every citizen. The
number is used by authorities,
health care, schools, universities,
banks, and insurance companies
for customer identification.

See “Swedish Personal

Identification Number”
on page 1040.
 Library of policy templates 1143
General Data Protection Regulation (Healthcare and Insurance)

Table 38-32 General Data Protection Regulations (Healthcare and Insurance) detection rules
(continued)

Name Type Description

Belgium Driver's License Data Identifiers Identification number for an

Number individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of Belgium.

See “Belgium Driver's License

Number” on page 820.

Denmark Personal Data Identifiers In Denmark, every citizen has a

Identification Number national identification number. The
number serves as proof of
identification for almost all
purposes.

See “Denmark Personal

Identification Number”
on page 877.

Netherlands Driver's License Data Identifiers Identification number for an

Number individual's driver's licence issued
by the RDW government agency
of the Netherlands.

See “Netherlands Driver's License

Number” on page 993.

France Driver's License Data Identifiers Identification number for an

Number individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of France.

See “France Driver's License

Number” on page 895.

France Health Insurance Data Identifiers A Carte Vitale is social insurance

Number card used in France that contains
medical information for the card
holder. It has a unique 21-digit
serial number.

See “France Health Insurance

Number” on page 896.
 Library of policy templates 1144
General Data Protection Regulation (Healthcare and Insurance)

Table 38-32 General Data Protection Regulations (Healthcare and Insurance) detection rules
(continued)

Name Type Description

Germany Driver's License Data Identifiers Identification number for an

Number individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of Germany.

See “Germany Driver's License

Number” on page 910.

Italy Health Insurance Number Data Identifiers The Italian Health Insurance Card
is issued to every Italian citizen
by the Italian Ministry of Economy
and Finance in cooperation with
the Italian Agency of Revenue.
The objective of the card is to
improve the social security
services through expenditure
control and performance, and to
optimize the use health services
to citizens.

See “Italy Health Insurance

Number” on page 958.

Italy Driver's License Number Data Identifiers Identification number for an

individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of Italy.

See “Italy Driver's License

Number” on page 956.

Spain Driver's License Number Data Identifiers Identification number for an

individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of Spain.

See “Spain Driver's License

Number” on page 1025.
 Library of policy templates 1145
General Data Protection Regulation (Personal Profile)

Table 38-32 General Data Protection Regulations (Healthcare and Insurance) detection rules
(continued)

Name Type Description

Ukraine Identity Card
Data Identifiers The Ukraine Identity Card has a
15-digit record number issued to
citizens of Ukraine. It is used as
a form of identification in place of
Ukraine's domestic passport as of
January 2016.

See “Ukraine Identity Card”

on page 1065.

General Data Protection Regulation (Personal Profile)

This template focuses on personal profile related keywords, Data Identifiers and an EDM profile
with related columns. The GDPR is a Regulation by which the European Commission intends
to strengthen and unify data protection for individuals within the EU. It also addresses export
of personal data outside the EU. The Commission's primary objectives of the GDPR are to
give citizens back the control of their personal data and to simplify the regulatory environment
for international business by unifying the regulation within the EU.

Table 38-33 General Data Protection Regulations (Personal Profile) detection rule

Name Type Description

GDPR Personal Profile Keyword Match Matches a list of related

Keywords keywords:

academic details, work history,

professional qualification,
summary of qualifications, bio
data, bio-data, CV, curriculum
vitae

General Data Protection Regulation (Travel)

This template focuses on travel related keywords, Data Identifiers and an EDM profile with
related columns. The GDPR is a Regulation by which the European Commission intends to
strengthen and unify data protection for individuals within the EU. It also addresses export of
personal data outside the EU. The Commission's primary objectives of the GDPR are to give
citizens back the control of their personal data and to simplify the regulatory environment for
international business by unifying the regulation within the EU.
 Library of policy templates 1146
General Data Protection Regulation (Travel)

Table 38-34 General Data Protection Regulations (Travel) detection rules

Name Type Description

Keyword Match Matches a list of related

keywords:

account number, bank card

number, driver license number,
ID card number, passenger
name, seat number, luggage
details, journey details,
purchase details, purchase
invoice, travel ticket, travel
invoice, passenger details,
tourist details

UK Driver's Licence Number Data Identifiers The UK Drivers Licence Number

is the identification number for an
individual's driver's license issued
by the Driver and Vehicle
Licensing Agency of the United
Kingdom.

See “UK Drivers Licence Number”

on page 1053.

UK Passport Number Data Identifiers The UK Passport Number

identifies a United Kingdom
passport using the current official
specification of the UK
Government Standards of the UK
Cabinet Office.

See “UK Passport Number”

on page 1060.
 Library of policy templates 1147
General Data Protection Regulation (Travel)

Table 38-34 General Data Protection Regulations (Travel) detection rules (continued)

Name Type Description

French Passport Number Data Identifiers The French passport is an identity

document issued to French
citizens. Besides enabling the
bearer to travel internationally and
serving as indication of French
citizenship, the passport facilitates
the process of securing
assistance from French consular
officials abroad or other European
Union member states in case a
French consular is absent, if
needed.

See “French Passport Number”

on page 903.

German Passport Number Data Identifiers The German passport number is

issued to German nationals for
the purpose of international travel.
A German passport is an officially
recognized document that
German authorities accept as
proof of identity from German
citizens.

See “German Passport Number”

on page 907.

Spanish Passport Number Data Identifiers Spanish passports are issued to

Spanish citizens for the purpose
of travel outside Spain.

See “Spanish Passport Number”

on page 1032.
 Library of policy templates 1148
General Data Protection Regulation (Travel)

Table 38-34 General Data Protection Regulations (Travel) detection rules (continued)

Name Type Description

Swedish Passport Number Data Identifiers Swedish passports are issued to

nationals of Sweden for the
purpose of international travel.
Besides serving as proof of
Swedish citizenship, they facilitate
the process of securing
assistance from Swedish consular
officials abroad or other European
Union member states in case a
Swedish consular is absent, if
needed.

See “Swedish Passport Number”

on page 1039.

Austria Passport Number Data Identifiers Austrian passports are travel

documents issued to Austrian
citizens by the Austrian Passport
Office of the Department of
Foreign Affairs and Trade, both in
Austria and overseas, and enable
the passport holder to travel
internationally.

See “Austria Passport Number”

on page 813.

Belgium Passport Number Data Identifiers Belgian passports are passports

issued by the Belgian state to its
citizens to facilitate international
travel. The Federal Public Service
Foreign Affairs, formerly known
as the Ministry of Foreign Affairs,
is responsible for issuing and
renewing Belgian passports.

See “Belgium Passport Number”

on page 822.

Belgium Driver's License Data Identifiers Identification number for an

Number individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of Belgium.

See “Belgium Driver's License

Number” on page 820.
 Library of policy templates 1149
General Data Protection Regulation (Travel)

Table 38-34 General Data Protection Regulations (Travel) detection rules (continued)

Name Type Description

Netherlands Driver's License Data Identifiers Identification number for an

Number individual's driver's licence issued
by the RDW government agency
of the Netherlands.

See “Netherlands Driver's License

Number” on page 993.

Netherlands Passport Number Data Identifiers Dutch passports are issued to

Netherlands citizens for the
purpose of international travel.

See “Netherlands Passport

Number” on page 995.

France Driver's License Data Identifiers Identification number for an

Number individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of France.

See “France Driver's License

Number” on page 895.

Germany Driver's License Data Identifiers Identification number for an

Number individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of Germany.
See “Germany Driver's License
Number” on page 910.

Italy Passport Number Data Identifiers Italian passports are issued to

Italian citizens for the purpose of
international travel.

See “Italy Passport Number”

on page 960.

Italy Driver's License Number Data Identifiers Identification number for an

individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of Italy.

See “Italy Driver's License

Number” on page 956.
 Library of policy templates 1150
Gramm-Leach-Bliley policy template

Table 38-34 General Data Protection Regulations (Travel) detection rules (continued)

Name Type Description

Spain Driver's License Number Data Identifiers Identification number for an

individual's driver's licence issued
by the Driver and Vehicle
Licensing Agency of Spain.

See “Spain Driver's License

Number” on page 1025.

Ukraine Domestic Passport Data Identifiers An identity document issued to

Number citizens of Ukraine for domestic
use. It has been replaced by the
Ukraine Identity Card as of 2016,
but any existing passports are still
valid.

See “Ukraine Passport

(Domestic)” on page 1064.

Ukraine International Passport Data Identifiers A document used by citizens of

Number Ukraine to travel outside of
Ukraine.

See “Ukraine Passport

(International)” on page 1067.

Gramm-Leach-Bliley policy template

The Gramm-Leach-Bliley (GLB) Act gives consumers the right to limit some sharing of their
information by financial institutions.
The Gramm-Leach-Bliley policy template detects transmittal of customer data.

Table 38-35 Gramm-Leach-Bliley policy template conditions

Detection method Type Description

Username/Password Simple rule: EDM This rule looks for user names and passwords in combination.
Combinations
See “Choosing an Exact Data Profile” on page 371.

Exact SSN or CCN Simple rule: EDM This rule looks for SSN or Credit Card Number.

Customer Directory Simple rule: EDM This rule looks for Phone or Email.

Table 38-35
Detection method
3 or more critical customer
fields
ABA Routing Numbers
US Social Security Numbers Simple rule: DCM This rule looks for social security numbers. For this rule to match,
(DI)
Library of policy templates 1151
Gramm-Leach-Bliley policy template
Gramm-Leach-Bliley policy template conditions (continued)
Type Description
Simple rule: EDM This rule looks for a match among any three of the following fields:
■ Account number
■ Bank card number
■ Email address
■ First name
■ Last name
■ PIN number
■ Phone number
■ Social security number
■ ABA Routing Number
■ Canadian Social Insurance Number
■ UK National Insurance Number
■ Date of Birth
However, the following combinations are not a match:
■ Phone, email, and first name
■ Phone, email, and last name
■ Email, first name, and last name
■ Phone, first name, and last name
Simple rule: DCM This condition detects nine-digit numbers. It validates the number
(DI) using the final check digit. This condition eliminates common test
numbers, such as 123456789, number ranges that are reserved for
future use, and all the same digit. This condition also requires the
presence of an ABA-related keyword.
See “ABA Routing Number” on page 798.
there must be a number that fits the Randomized US SSN data
identifier. There must also be a keyword or phrase that indicates the
presence of a US SSN with a keyword from "US SSN Keywords"
dictionary. The keyword condition is included to reduce false positives
with any numbers that may match the SSN format.
See “Randomized US Social Security Number (SSN)” on page 1015.
 Library of policy templates 1152
HIPAA and HITECH (including PHI) policy template

Table 38-35 Gramm-Leach-Bliley policy template conditions (continued)

Detection method Type Description

Credit Card Numbers Simple rule: DCM This condition detects valid credit card numbers that are separated
(DI) by spaces, dashes, periods, or without separators. This condition
performs Luhn check validation and includes the following credit
card formats:

■ American Express
■ Diner's Club
■ Discover
■ Japan Credit Bureau (JCB)
■ MasterCard
■ Visa

This rule eliminates common test numbers, including those reserved

for testing by credit card issuers, and also requires the presence of
a credit card-related keyword.

See “Credit Card Number narrow breadth” on page 867.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

HIPAA and HITECH (including PHI) policy template

The HIPAA and HITECH (including PHI) policy strictly enforces the US Health Insurance
Portability and Accountability Act (HIPAA). Health Information Technology for Economic and
Clinical Health Act (HITECH) is the first national law that mandates breach notification for
protected health information (PHI).
This policy template detects data concerning prescription drugs, diseases, and treatments in
combination with PHI. Organizations that are not subject to HIPAA can also use this policy to
control PHI data.
The HIPAA and HITECH (including PHI) policy template is updated with recent Drug, and
Disease, and Treatment keyword lists based on information from the U.S. Federal Drug
Administration (FDA) and other sources. The policy template is also updated to use the
Randomized US Social Security Number (SSN) data identifier, which detects both traditional
and randomized SSNs.
See “Keep the keyword lists for your HIPAA and Caldicott policies up to date” on page 698.
See “Updating policies to use the Randomized US SSN data identifier” on page 665.
Table 38-36 describes the TPO exception that is provided by the template. TPOs (Treatment,
Payment, or health care Operations) are service providers to health care organizations and
 Library of policy templates 1153
HIPAA and HITECH (including PHI) policy template

have an exception for HIPAA information restrictions. The template requires that you enter the
allowed email addresses. If implemented the exception is evaluated before detection rules
and the policy does not trigger an incident if the protected information is sent to one of the
allowed partners.

Table 38-36 TPO exception

Name Type Configuration

TPO Exception Content Matches Keyword Simple exception (single condition match).
(DCM)
Looks for a recipient email address matching one from
the "TPO Email Addresses" user-defined keyword
dictionary.

Table 38-37 is a rule that looks for an exact data match against any single column from a
profiled Patient Data database record.

Table 38-37 Patient Data detection rule

Name Type Configuration

Patient Data Content Matches Exact Data Match data from any single field:
(EDM)
■ Last name
■ Tax payer ID (SSN)
■ Email address
■ Account number
■ ID card number
■ Phone number

See “Choosing an Exact Data Profile” on page 371.

Table 38-38 is a compound detection rule that requires a Patient Data exact match and a
match from the "Drug Code" data identifier.

Table 38-38 Patient Data and Drug Codes detection rule

Name Condition types Configuration

Patient Data and Drug Codes Content Matches Exact Data Looks for a match against any single column from a
(EDM) profiled Patient Data database record and a match from
the National Drug Code data identifier.
And
See Table 38-37 on page 1153.
Content Matches Data
Identifier See “National Drug Code (NDC)” on page 989.
 Library of policy templates 1154
HIPAA and HITECH (including PHI) policy template

Table 38-39 is a compound detection rule that requires a Patient Data exact match and a
keyword match from the "Prescription Drug Names" dictionary.

Table 38-39 Patient Data and Prescription Drug Names detection rule

Name Condition type Configuration

Patient Data and Prescription Content Matches Exact Data Looks for a match against any single column from a
Drug Names (EDM) profiled Patient Data database record and a keyword
match from the Prescription Drug Names dictionary
AND
See Table 38-37 on page 1153.
Content Matches Keyword
(DCM) See “Updating policies after upgrading to the latest
version” on page 410.

Table 38-40 is a compound detection rule that requires a Patient Data exact match and keyword
match from the "Medical Treatment Keywords" dictionary.

Table 38-40 Patient Data and Treatment Keywords detection rule

Name Condition type Configuration

Patient Data and Treatment Content Matches Exact Data Looks for a match against any single column from a
Keywords (EDM) profiled Patient Data database record and a keyword
match from the Medical Treatment Keywords dictionary.
And
See Table 38-37 on page 1153.
Content Matches Keyword
(DCM) See “Updating policies after upgrading to the latest
version” on page 410.

Table 38-41 is a compound detection rule that requires a Patient Data exact match and a
keyword match from the "Disease Names" dictionary.

Table 38-41 Patient Data and Disease Keywords detection rule

Name Condition type Configuration

Patient Data and Disease Content Matches Exact Data Looks for a match against any single column from a
Keywords (EDM) profiled Patient Data database record and a keyword
match from the Disease Names dictionary.
And
See Table 38-37 on page 1153.
Content Matches Keyword
(DCM) See “Updating policies after upgrading to the latest
version” on page 410.
 Library of policy templates 1155
HIPAA and HITECH (including PHI) policy template

Table 38-42 is a compound detection rule that looks for SSNs using the Randomized US Social
Security Number (SSN) data identifier and for a keyword from the "Prescription Drug Names"
dictionary.

Table 38-42 SSN and Drug Keywords detection rule

Name Condition type Configuration

SSN and Drug Keywords Content Matches Data Randomized US Social Security Number (SSN) data
Identifier identifier (narrow breadth)

And See “Randomized US Social Security Number (SSN)”

on page 1015.
Content Matches Keyword
Prescription Drug Names keyword dictionary

See “Updating policies after upgrading to the latest

version” on page 410.

Table 38-43 is a compound detection rule that looks for SSNs using the Randomized US Social
Security Number (SSN) data identifier and for a keyword match from the "Medical Treatment
Keywords" dictionary.

Table 38-43 SSN and Treatment Keywords detection rule

Name Condition type Configuration

SSN and Treatment Content Matches Data Randomized US Social Security Number (SSN) data
Keywords Identifier identifier (narrow breadth)

And See “Randomized US Social Security Number (SSN)”

on page 1015.
Content Matches Keyword
Medical Treatment Keywords keyword dictionary.

See “Updating policies after upgrading to the latest

version” on page 410.

Table 38-44 is a compound detection rule that looks for SSNs using the Randomized US Social
Security Number (SSN) data identifier and for a keyword match from the "Disease Names"
dictionary.
 Library of policy templates 1156
Human Rights Act 1998 policy template

Table 38-44 SSN and Disease Keywords detection rule

Name Condition type Configuration

SSN and Disease Keywords Content Matches Data Randomized US Social Security Number (SSN) data
Identifier identifier (narrow breadth)

And See “Randomized US Social Security Number (SSN)”

on page 1015.
Content Matches Keyword
Disease Names keyword dictionary

See “Updating policies after upgrading to the latest

version” on page 410.

Table 38-45 is a compound detection rule that looks for SSNs using the Randomized US Social
Security Number (SSN) data identifier and for a drug code using the Drug Code data identifier.

Table 38-45 SSN and Drug Code detection rule

Name Condition type Configuration

SSN and Drug Code Content Matches Data Randomized US Social Security Number (SSN) data
Identifier identifier (narrow breadth)

And See “Randomized US Social Security Number (SSN)”

on page 1015.
Content Matches Keyword
Drug Code data identifier (narrow breadth)

See “National Drug Code (NDC)” on page 989.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Human Rights Act 1998 policy template

The Human Rights Act 1998 allows UK citizens to assert their rights under the European
Convention on Human Rights in UK courts and tribunals. The Act states that "so far as possible
to do so, legislation must be read and given effect in a way which is compatible with convention
rights." The Human Rights Act 1998 policy enforces Article 8 by ensuring that the private lives
of British citizens stay private.

EDM Rule UK Data Protection Act, Personal Data

This compound rule looks for two data types, last name and electoral roll number,
in combination with a keyword from the "UK Personal Data Keywords" dictionary.
 Library of policy templates 1157
Illegal Drugs policy template

DCM Rule UK Electoral Roll Numbers

This rule looks for a single compound condition with four parts:

■ A single keyword from the "UK Keywords" dictionary

■ A pattern matching that of the UK Electoral Roll Number data identifier
■ A single keyword from the "UK Electoral Roll Number Words" dictionary
■ A single keyword from the "UK Personal Data Keywords" dictionary

See “Choosing an Exact Data Profile” on page 371.

See “Configuring policies” on page 376.
See “Exporting policy detection as a template” on page 405.

Illegal Drugs policy template

This policy detects conversations about illegal drugs and controlled substances.

DCM Rule Street Drugs

This rule looks for five instances of keywords from the "Street Drug Names"
dictionary.

DCM Rule Mass Produced Controlled Substances

This rule looks for five instances of keywords from the "Manufactured Controlled
Substances" dictionary.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Individual Taxpayer Identification Numbers (ITIN)

policy template
An Individual Taxpayer Identification Number (ITIN) is a tax-processing number issued by the
US Internal Revenue Service (IRS). The IRS issues ITINs to track individuals are not eligible
to obtain Social Security Numbers (SSNs).

Table 38-46 ITIN policy template conditions

DCM Keyword Rule Description

ITIN This rule looks for a match to the US ITIN data identifier and a keyword from the
"US ITIN Keywords" dictionary.
 Library of policy templates 1158
International Traffic in Arms Regulations (ITAR) policy template

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

International Traffic in Arms Regulations (ITAR) policy

template
The International Traffic in Arms Regulations (ITAR) are enforced by the US Department of
State. Exporters of defense services or related technical data are required to register with the
federal government and may need export licenses. This policy detects potential violations
based on countries and controlled assets designated by the ITAR.
The Indexed ITAR Munition Items and Recipients detection rule looks for a country code in
the recipient from the "ITAR Country Codes" dictionary and for a specific "SKU" from an indexed
EDM file.

Table 38-47 Indexed ITAR Munition Items and Recipients detection rule

Method Conditions (both Configuration

must match)

Compound rule Recipient Matches Match recipient email or URL domain from ITAR Country
Pattern (DCM) Codes list:

■ Severity: High.
■ Check for existence.
■ At least 1 recipient(s) must match.

Content Matches Exact See “Choosing an Exact Data Profile” on page 371.
Data (EDM)

The ITAR Munitions List and Recipients detection rule looks for both a country code in the
recipient from the "ITAR Country Codes" dictionary and a keyword from the "ITAR Munition
Names" dictionary.
 Library of policy templates 1159
Media Files policy template

Table 38-48 ITAR Munitions List and Recipients detection rule

Method Conditions (both Configuration

must match)

Compound rule Recipient Matches Match recipient email or URL domain from ITAR Country
Pattern (DCM) Codes list:

■ Severity: High.
■ Check for existence.
■ At least 1 recipient pattern must match.

Content Matches Match any keyword from the ITAR Munitions List:
Keyword (DCM)
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.
■ Severity: High.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Media Files policy template

The Media Files policy detects various types of video and audio files (including mp3).

DCM Rule Media Files

This rule looks for the following media file types:

■ qt
■ riff
■ macromedia_dir
■ midi
■ mp3
■ mpeg_movie
■ quickdraw
■ realaudio
■ wav
■ video_win
■ vrml
 Library of policy templates 1160
Merger and Acquisition Agreements policy template

DCM Rule Media Files Extensions

This rule looks for file name extensions from the "Media Files Extensions" dictionary.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Merger and Acquisition Agreements policy template

The Mergers and Acquisition Agreements policy template detects contracts and official
documentation concerning merger and acquisition activity.
You can modify this template with company-specific code words to detect specific deals.
The Merger and Acquisition Agreements template provides a single compound detection rule.
All conditions in the rule must match for the rule to trigger an incident.

Table 38-49 Merger and Acquisition Agreements compound detection rule

Condition Configuration

Contract Specific Keywords
(Keyword Match)
■ Match any keyword: merger, agreement, contract, letter of intent, term sheet,
plan of reorganization
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

Acquisition Corporate Structure ■ Match any keyword: subsidiary, subsidiaries, affiliate, acquiror, merger sub,
Keywords (Keyword Match) covenantor, acquired company, acquiring company, surviving corporation,
surviving company
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.
 Library of policy templates 1161
NASD Rule 2711 and NYSE Rules 351 and 472 policy template

Table 38-49 Merger and Acquisition Agreements compound detection rule (continued)

Condition Configuration

Merger Consideration
Keywords (Keyword Match)
■ Match any keyword: merger stock, merger consideration, exchange shares,
capital stock, dissenting shares, capital structure, escrow fund, escrow
account, escrow agent, escrow shares, escrow cash, escrow amount, stock
consideration, break-up fee, goodwill
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

Legal Contract Keywords
(Keyword Match)
■ Match any keyword: recitals, in witness whereof, governing law, Indemnify,
Indemnified, indemnity, signature page, best efforts, gross negligence, willful
misconduct, authorized representative, severability, material breach
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

NASD Rule 2711 and NYSE Rules 351 and 472 policy
template
This policy protects the name(s) of any companies involved in an upcoming stock offering,
internal project names for the offering, and the stock ticker symbols for the offering companies.
The NASD Rule 2711 Documents, Indexed detection rule looks for content from specific
documents registered as sensitive and known to be subject to NASD Rule 2711 or NYSE
Rules 351 and 472. This rule returns a match if 80% or more of the source document is found.
 Library of policy templates 1162
NASD Rule 2711 and NYSE Rules 351 and 472 policy template

Table 38-50 NASD Rule 2711 Documents, Indexed detection rule

Method Condition Configuration

Simple rule Content Matches NASD Rule 2711 Documents, Indexed (IDM):
Document
■ Detect documents in selected Indexed Document Profile
Signature (IDM)
■ Require at least 80% content match.
■ Severity: High.
■ Check for existence.
■ Look in body, attachments.

See “Choosing an Indexed Document Profile” on page 373.

The NASD Rule 2711 and NYSE Rules 351 and 472 detection rule is a compound rule that
contains a sender condition and a keyword condition. The sender condition is based on a
user-defined list of email addresses of research analysts at the user's company ("Analysts'
Email Addresses" dictionary). The keyword condition looks for any upcoming stock offering,
internal project names for the offering, and the stock ticker symbols for the offering companies
("NASD 2711 Keywords" dictionary). Like the sender condition, it requires editing by the user.

Table 38-51 NASD Rule 2711 and NYSE Rules 351 and 472 detection rule

Method Condition Configuration

Compound rule Sender/User NASD Rule 2711 and NYSE Rules 351 and 472 (Sender):
Matches Pattern
■ Match sender pattern(s) [research_analyst@company.com] (user defined)
(DCM)
■ Severity: High.
■ Matches on entire message.

Content Matches NASD Rule 2711 and NYSE Rules 351 and 472 (Keyword Match):
Keyword (DCM)
■ Match "[company stock symbol]", "[name of offering company]", "[offering
name (internal name)]".
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.
 Library of policy templates 1163
NASD Rule 3010 and NYSE Rule 342 policy template

NASD Rule 3010 and NYSE Rule 342 policy template

NASD Rule 3010 and NYSE Rule 342 require brokers-dealers to supervise certain brokerage
employees' communications. The NASD Rule 3010 and NYSE Rule 342 policy monitors the
communications of registered principals who are subject to these regulations.
The Stock Recommendation detection rule looks for a keyword from the "NASD 3010 Stock
Keywords" dictionary and the "NASD 3010 Buy/Sell Keywords" dictionary. In addition, this rule
requires evidence of a stock recommendation in combination with a buy or sell action.

Table 38-52 Stock Recommendation detection rule

Method Conditions (all must Configuration

match)

Compound rule Content Matches Keyword Match keyword: "recommend"

(DCM)
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

Content Matches Keyword Match keyword: "buy" or "sell"

(DCM)
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

Content Matches Keyword Match keyword: "stock, stocks, security, securities, share, shares"
(DCM)
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

The NASD Rule 3010 and NYSE Rule 342 Keywords detection rule looks for keywords in the
"NASD 3010 General Keywords" dictionary, which look for any general stock broker activity,
and stock keywords.
 Library of policy templates 1164
NERC Security Guidelines for Electric Utilities policy template

Table 38-53 NASD Rule 3010 and NYSE Rule 342 Keywords detection rule

Method Conditions (both must Configuration

match)

Compound rule Content Matches Keyword Match keyword: "authorize", "discretion", "guarantee", "options"
(DCM)
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

Content Matches Keyword Match keyword: "stock, stocks, security, securities, share, shares"
(DCM)
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

NERC Security Guidelines for Electric Utilities policy

template
The North American Electric Reliability Council (NERC) Guideline for Protecting Potentially
Sensitive Information describes how to protect and secure data about critical electricity
infrastructure.
This policy detects the information outlined in the NERC security guidelines for the electricity
sector.

Table 38-54 Key Response Personnel detection rule

Detection method Match condition Configuration

Simple rule Content Matches Exact Data Match any three of the following data items:
(EDM)
■ First name
■ Last name
■ Phone
■ Email

See “Choosing an Exact Data Profile” on page 371.

 Library of policy templates 1165
Network Diagrams policy template

Table 38-55 Network Infrastructure Maps detection rule

Detection method Match condition Configuration

Simple rule Content Matches Indexed This rule requires an exact binary match.
Documents (IDM)
See “Choosing an Indexed Document Profile” on page 373.

The Sensitive Keywords and Vulnerability Keywords detection rule looks for any keyword
matches from the "Sensitive Keywords" dictionary and the "Vulnerability Keywords" dictionary.

Table 38-56 Sensitive Keywords and Vulnerability Keywords detection rule

Detection method Match conditions Configuration

Compound rule Content Matches Keyword Match any Sensitive Keyword:

(DCM)
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

Content Matches Keyword Match any Vulnerability Keyword:

(DCM)
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Network Diagrams policy template

The Network Diagrams policy detects computer network diagrams at risk of exposure.

IDM Rule Network Diagrams, Indexed

This rule looks for content from specific network diagrams that are registered as
confidential. This rule returns a match if 80% or more of the source document is
detected.

DCM Rule Network Diagrams with IP Addresses

This rule looks for a Visio file type in combination with an IP address data identifier.
 Library of policy templates 1166
Network Security policy template

DCM Rule Network Diagrams with IP Address Keyword

This rule looks for a Visio file type in combination with phrase variations of "IP
address" with a data identifier.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Network Security policy template

The Network Security policy detects evidence of hacking tools and attack planning.

DCM Rule GoToMyPC Activity

This rule looks for a GoToMyPC command format with a data identifier.

DCM Rule Hacker Keywords

This rule looks for a keyword from the "Hacker Keywords" dictionary.

DCM Rule KeyLoggers Keywords

This rule looks for a keyword from the "Keylogger Keywords" dictionary.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Offensive Language policy template

The Offensive Language policy detects the use of offensive language.

DCM Rule Offensive Language, Explicit

This rule looks for any single keyword in the "Offensive Language, Explicit" dictionary.

DCM Rule Offensive Language, General

This rule looks for any three instances of keywords in the "Offensive Language,
General" dictionary.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.
 Library of policy templates 1167
Office of Foreign Assets Control (OFAC) policy template

Office of Foreign Assets Control (OFAC) policy

template
The Office of Foreign Assets Control of the U.S. Department of the Treasury administers and
enforces economic and trade sanctions. These sanctions are based on US foreign policy and
national security goals against certain countries, individuals, and organizations. The Office of
Foreign Assets Control (OFAC) policy detects communications involving these targeted groups.
The OFAC policy has two primary parts. The first deals with the Specially Designated Nationals
(SDN) list, and the second deals with general OFAC policy restrictions.
The SDN list refers to specific people or organizations that are subject to trade restrictions.
The U.S. Treasury Department provides text files with specific names, last known addresses,
and known aliases for these individuals and entities. The Treasury Department stipulates that
the addresses may not be correct or current, and different locations do not change the
restrictions on people and organizations.
In the OFAC policy template, Symantec Data Loss Prevention has scrubbed the list to make
it more usable and practical. This includes extracting keywords and key phrases from the list
of names and aliases, since names do not always appear in the same format as the list. Also,
common names have been removed to reduce false positives. For example, one organization
on the SDN list is known as "SARA." Leaving this on the list would generate a high false positive
rate. "SARA Properties" is another entry on the list. It is used as a key phrase in the template
because the incidence of this phrase is much lower than "SARA" alone. The list of names and
organizations is considered in combination with the commonly found countries in the SDN
address list. The top 12 countries on the list are considered, after again removing more
commonly occurring countries. The template looks for recipients with any of the listed countries
as the designated country code. This SDN list minimizes false positives while still detecting
transactions or communications with known restricted parties.
The OFAC policy also provides guidance around the restrictions the U.S. Treasury Department
has placed on general trade with specific countries. This is distinct from the SDN list, since
individuals and organizations are not specified. The list of general sanctions can be found
here: http://www.treasury.gov/offices/enforcement/ofac/programs/index.shtml
The Office of Foreign Assets Control (OFAC) template looks for recipients on the OFAC- listed
countries by designated country code.
The OFAC Special Designated Nationals List and Recipients detection rule looks for a recipient
with a country code matching entries in the "OFAC SDN Country Codes" specification in
combination with a match on a keyword from the "Specially Designated Nationals List"
dictionary.
 Library of policy templates 1168
OMB Memo 06-16 and FIPS 199 Regulations policy template

Table 38-57 OFAC Special Designated Nationals List and Recipients detection rule

Method Condition Configuration

Compound rule Recipient Matches OFAC Special Designated Nationals List and Recipients (Recipient):
Pattern (DCM)
■ Match email or URL domain by OFAC SDN Country Code.
■ Severity: High.
■ Check for existence.
■ At least 1 recipient(s) must match.
■ Matches on the entire message.

Content Matches Specially Designated Nationals List (Keyword Match):

Keyword (DCM)
■ Match keyword from the Specially Designated Nationals List.
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

The Communications to OFAC countries detection rule looks for a recipient with a country
code matching entries from the "OFAC Country Codes" list.

Table 38-58 Communications to OFAC countries detection rule

Method Condition Configuration

Simple rule Recipient Matches Communications to OFAC countries (Recipient):

Pattern (DCM)
■ Match email or URL domain by OFAC Country Code.
■ Severity: High.
■ Check for existence.
■ At least 1 recipient(s) must match.
■ Matches on the entire message.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

OMB Memo 06-16 and FIPS 199 Regulations policy

template
This policy detects information classified as confidential according to the guidelines established
in the Federal Information Processing Standards (FIPS) Publication 199 from the National
Institute of Standards and Technology (NIST). NIST is responsible for establishing standards
 Library of policy templates 1169
OMB Memo 06-16 and FIPS 199 Regulations policy template

and guidelines for data security under the Federal Information Security Management Act
(FISMA).
This template contains three simple detection rules. If any rule reports a match, the policy
triggers an incident.
The High Confidentiality Indicators detection rule looks for any keywords in the "High
Confidentiality" dictionary.

Table 38-59 High Confidentiality Indicators detection rule

Method Condition Configuration

Simple rule Content Matches High Confidentiality Indicators (Keyword Match):

Keyword
■ Match "(confidentiality, high)", "(confidentiality,high)"
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

The Moderate Confidentiality Indicators detection rule looks for any keywords in the "Moderate
Confidentiality" dictionary.

Table 38-60 Moderate Confidentiality Indicators detection rule

Method Condition Configuration

Simple rule Content Matches Moderate Confidentiality Indicators (Keyword Match):

Keyword
■ Match "(confidentiality, moderate)", "(confidentiality,moderate)"
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

The Low Confidentiality Indicators detection rule looks for any keywords in the "Low
Confidentiality" dictionary.
 Library of policy templates 1170
Password Files policy template

Table 38-61 Low Confidentiality Indicators detection rule

Method Condition Configuration

Simple rule Content Matches Low Confidentiality Indicators (Keyword Match):

Keyword
■ Match "(confidentiality, low)", "(confidentiality,low)"
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Password Files policy template

The Password Files policy detects password file formats, such as SAM, password, and shadow.

DCM Rule Password Filenames

This rule looks for the file names "passwd" or "shadow."

DCM Rule /etc/passwd Format

This rule looks for a regular expression pattern with the /etc/passwd format.

DCM Rule /etc/shadow Format

This rule looks for a regular expression pattern with the /etc/shadow format.

DCM Rule SAM Passwords

This rule looks for a regular expression pattern with the SAM format.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Payment Card Industry (PCI) Data Security Standard

policy template
The Payment Card Industry (PCI) data security standards are jointly determined by Visa and
MasterCard to protect cardholders by safeguarding personally identifiable information. Visa's
Cardholder Information Security Program (CISP) and MasterCard's Site Data Protection (SDP)
 Library of policy templates 1171
Payment Card Industry (PCI) Data Security Standard policy template

program both work toward enforcing these standards. The Payment Card Industry (PCI) Data
Security Standards policy detects Visa and MasterCard credit card number data.
The Card Numbers, Exact detection rule detects exact credit card numbers profiled from a
database or other data source.

Table 38-62 Credit Card Numbers, Exact detection rule

Method Condition Configuration

Simple rule Content Matches This rule detects credit card numbers.
Exact Data (EDM)
See “Choosing an Exact Data Profile” on page 371.

The Credit Card Numbers, All detection rule detects credit card numbers using the Credit Card
Number system Data Identifier.

Table 38-63 Credit Card Numbers, All detection rule

Method Condition Configuration

Simple rule Content Matches Credit Card Numbers, All (Data Identifiers):
Data Identifier
■ Data Identifier: Credit Card Number (narrow)
(DCM)
See “Credit Card Number ” on page 863.
■ Severity: High.
■ Count all matches.
■ Look in envelope, subject, body, attachments.

The Magnetic Stripe Data for Credit Cards detection rule detects raw data from the credit card
magnetic stripe using the Credit Card Magnetic Stripe system Data Identifier.

Table 38-64 Magnetic Stripe Data for Credit Cards detection rule

Method Condition Configuration

Simple rule Content Matches Magnetic Stripe Data for Credit Cards (Data Identifiers):
Data Identifier
■ Data Identifier: Credit Card Magnetic Stripe (medium)
(DCM)
See “Credit Card Number ” on page 863.
■ Data Severity: High.
■ Count all matches.
■ Look in envelope, subject, body, attachments.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.
 Library of policy templates 1172
PIPEDA policy template

PIPEDA policy template

Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) protects
personal information in the hands of private sector organizations. This act provides guidelines
for the collection, use, and disclosure of personal information.
The PIPEDA policy detects customer data that PIPEDA regulations protect.
The PIPEDA detection rule looks for a match of two data items, with certain data combinations
excluded from matching.

Table 38-65 PIPEDA detection rule

Detection Description Excluded combinations

method

EDM Rule The PIPEDA detection rule matches any two However, the following combinations do not create a
of the following data items: match:

■ Last name ■ Last name, email

■ Bank card ■ Last name, phone
■ Medical account number ■ Last name, account number
■ Medical record ■ Last name, user name
■ Agency number
■ Account number
■ PIN
■ User name
■ Password
■ SIN
■ ABA routing number
■ Email
■ Phone
■ Mother's maiden name

See “Choosing an Exact Data Profile”

on page 371.

The PIPEDA Contact Info detection rule looks for a match of two data items, with certain data
combinations excepted from matching.
 Library of policy templates 1173
PIPEDA policy template

Table 38-66 PIPEDA Contact Info detection rule

Detection Description
method

EDM Rule This rule looks for any two of the following data columns:

■ Last name
■ Phone
■ Account number
■ User name
■ Email

See “Choosing an Exact Data Profile” on page 371.

Table 38-67 Canadian Social Insurance Numbers detection rule

Detection Description
method

DCM Rule This rule implements the narrow breadth edition of the Canadian Social Insurance Number data
identifier.

See “Canadian Social Insurance Number” on page 844.

Table 38-68 ABA Routing Numbers detection rule

Detection Description
method

DCM Rule This rule implements the narrow breadth edition of the ABA Routing Number data identifier.

See “ABA Routing Number” on page 798.

Table 38-69 Credit Card Numbers, All detection rule

Detection Description
method

DCM Rule This rule implements the narrow breadth edition of the Credit Card Number data identifier.

See “Credit Card Number narrow breadth” on page 867.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.
 Library of policy templates 1174
Price Information policy template

Price Information policy template

The Price Information policy detects specific SKU and pricing information at risk of exposure.

EDM Rule Price Information

This rule looks for the combination of user-specified Stock Keeping Unit (SKU)
numbers and the price for that SKU number.

Note: This template contains one EDM detection rule. If you do not have an EDM profile
configured, or you are using Symantec Data Loss Prevention Standard, this policy template
is empty and contains no rule to configure.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.
See “About the Exact Data Profile and index” on page 426.

Project Data policy template

The Project Data policy detects discussions of sensitive projects.

IDM Rule Project Documents, Indexed

This rule looks for content from specific project data files registered as proprietary.
It returns a match if the engine detects 80% or more of the source document.

DCM Rule Project Activity

This rule looks for any keywords in the "Sensitive Project Code Names" dictionary,
which is user-defined.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Proprietary Media Files policy template

The Proprietary Media Files policy detects various types of video and audio files that can be
proprietary intellectual property of your organization at risk for exposure.

IDM Rule Media Files, Indexed

This rule looks for content from specific media files registered as proprietary.
 Library of policy templates 1175
Publishing Documents policy template

DCM Rule Media Files

This rule looks for the following media file types:

■ qt
■ riff
■ macromedia_dir
■ midi
■ mp3
■ mpeg_movie
■ quickdraw
■ realaudio
■ wav
■ video_win
■ vrml

DCM Rule Media Files Extensions

This rule looks for file name extensions from the "Media Files Extensions" dictionary.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Publishing Documents policy template

The Publishing Documents policy detects various types of publishing documents, such as
Adobe FrameMaker files, at risk of exposure.

IDM Rule Publishing Documents, Indexed

This rule looks for content from specific publishing documents registered as
proprietary. It returns a match if the engine detects 80% or more of the source
document.

DCM Rule Publishing Documents

This rule looks for the specified file types:

■ qxpress
■ frame
■ aldus_pagemaker
■ publ

DCM Rule Publishing Documents, extensions

This rule looks for specified file name extensions found in the "Publishing Document
Extensions" dictionary.
 Library of policy templates 1176
Racist Language policy template

Note: Both file types and file name extensions are required for this policy because the detection
engine does not detect the true file type for all the required documents. As such, the file name
extension must be used with the file type.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Racist Language policy template

The Racist Language policy detects the use of racist language.

DCM Rule Racist Language

This rule looks for any single keyword in the "Racist Language" dictionary.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Restricted Files policy template

The Restricted Files policy detects various file types that are generally inappropriate to send
out of the company, such as Microsoft Access and executable files.

DCM Rule MSAccess Files and Executables

This rule looks for files of the specified types: access, exe, and exe_unix.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Restricted Recipients policy template

The Restricted Recipients policy detects communications with specified recipients, such as
former employees.

DCM Rules Restricted Recipients

This rule looks for messages to recipients with email addresses in the "Restricted
Recipients" dictionary.

See “Configuring policies” on page 376.

 Library of policy templates 1177
Resumes policy template

See “Exporting policy detection as a template” on page 405.

Resumes policy template

The Resumes policy detects active job searches.

EDM Rule Resumes, Employee

This rule is a compound rule with two conditions; both must match to trigger an
incident. This rule contains an EDM condition for first and last names of employees
provided by the user. This rule also looks for a specific file type attachment (.doc)
that is less than 50 KB and contains at least one keyword from each of the following
dictionaries:

■ Job Search Keywords, Education

■ Job Search Keywords, Work
■ Job Search Keywords, General

DCM Rule Resumes, All

This rule looks for files of a specified type (.doc) that are less than 50 KB and match
at least one keyword from each of the following dictionaries:

■ Job Search Keywords, Education

■ Job Search Keywords, Work
■ Job Search Keywords, General

DCM Rule Job Search Websites

This rule looks for URLs of Web sites that are used in job searches.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.
See “About the Exact Data Profile and index” on page 426.

Sarbanes-Oxley policy template

The US Sarbanes-Oxley Act (SOX) imposes requirements on financial accounting, including
the preservation of data integrity and the ability to create an audit trail. The Sarbanes-Oxley
policy detects sensitive financial data.
The Sarbanes-Oxley Documents, Indexed detection rule looks for content from specific
documents registered as being subject to Sarbanes-Oxley Act. This rule returns a match if
80% or more of the source document is found.
 Library of policy templates 1178
Sarbanes-Oxley policy template

Table 38-70 Sarbanes-Oxley Documents, Indexed detection rule

Method Condition Configuration

Simple rule Content Matches See “Choosing an Indexed Document Profile” on page 373.
Indexed Document
Profile

The SEC Fair Disclosure Regulation compound detection rule looks for the following conditions;
all must be satisfied for the rule to trigger an incident:
■ The SEC Fair Disclosure keywords indicate possible disclosure of advance financial
information ("SEC Fair Disclosure Keywords" dictionary).
■ An attachment or file type that is a commonly used document or spreadsheet format. The
detected file types are Microsoft Word, Excel Macro, Excel, Works Spreadsheet, SYLK
Spreadsheet, Corel Quattro Pro, WordPerfect, Lotus 123, Applix Spreadsheets, CSV,
Multiplan Spreadsheet, and Adobe PDF.
■ The company name keyword list requires editing by the user, which can include any name,
alternate name, or abbreviation that might indicate a reference to the company.
 Library of policy templates 1179
Sarbanes-Oxley policy template

Table 38-71 SEC Fair Disclosure Regulation detection rule

Method Condition Configuration

Compound rule Content Matches SEC Fair Disclosure Regulation (Keyword Match):
Keyword
■ Match keyword: earnings per share, forward guidance
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.
■ Match on same component.
The keyword must be in the attachment or file type detected by that
condition.

Message Attachment SEC Fair Disclosure Regulation (Attachment/File Type):

or File Type Match
■ File type detected: excel_macro, xls, works_spread, sylk, quattro_pro,
mod, csv, applix_spread, 123, doc, wordperfect, and pdf.
■ Severity: High.
■ Match on: Attachments and same component.

Content Matches SEC Fair Disclosure Regulation (Keyword Match):

Keyword
■ Match "[company name]"
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.
■ Match on same component.
The keyword must be in the attachment or file type detected by that
condition.

The Financial Information detection rule looks for a specific file type containing a word from
the "Financial Keywords" dictionary and a word from the "Confidential/Proprietary Words"
dictionary. The spreadsheet file types detected are Microsoft Excel Macro, Microsoft Excel,
Microsoft Works Spreadsheet, SYLK Spreadsheet, Corel Quattro Pro, and more.
 Library of policy templates 1180
SEC Fair Disclosure Regulation policy template

Table 38-72 Financial Information detection rule

Method Condition Configuration

Compound rule Content Matches Financial Information (Attachment/File Type):

Indexed Document
■ Match file type: excel_macro, xls, works_spread, sylk,
Profile
quattro_pro, mod, csv, applix_spread, Lotus 1-2-3
■ Severity: High.
■ Match on attachments, same component.

Content Matches Financial Information (Keyword Match):

Keyword
■ Match "accounts receivable turnover", "adjusted gross
margin", "adjusted operating expenses", "adjusted operating
margin", "administrative expenses", ....
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.
■ Keyword must be detected in the attachment (same
component).

Content Matches Financial Information (Keyword Match):

Keyword
■ Match "confidential", "internal use only", "proprietary".
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.
■ Keyword must be detected in the attachment (same
component).

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

SEC Fair Disclosure Regulation policy template

The US SEC Selective Disclosure and Insider Trading Rules prohibit public companies from
selectively divulging material information to analysts and institutional investors before its general
release to the public.
The SEC Fair Disclosure Regulation template detects data indicating disclosure of material
financial information.
 Library of policy templates 1181
SEC Fair Disclosure Regulation policy template

The SEC Fair Disclosure Regulation Documents, Indexed (IDM) detection rule looks for content
from specific documents subject to SEC Fair Disclosure regulation. This rule returns a match
if 80% or more of the source document content is found.

Table 38-73 SEC Fair Disclosure Regulation Documents, Indexed (IDM) detection rule

Method Condition Configuration

Simple rule Content Matches SEC Fair Disclosure Regulation Documents, Indexed (IDM):
Document
■ Detect documents from the selected Indexed Document Profile.
Signature (IDM)
See “Choosing an Indexed Document Profile” on page 373.
■ Match documents with at least 80% content match.
■ Severity: High.
■ Check for existence.
■ Look in body, attachments.

The SEC Fair Disclosure Regulation detection rule looks for the a keyword match from the
"SEC Fair Disclosure Keywords" dictionary, an attachment or file type that is a commonly used
document or spreadsheet, and a keyword match from the "Company Name Keywords"
dictionary.
All three conditions must be satisfied for the rule to trigger an incident:
■ The SEC Fair Disclosure keywords indicate possible disclosure of advance financial
information.
■ The file types detected are Microsoft Word, Excel Macro, Excel, Works Spreadsheet, SYLK
Spreadsheet, Corel Quattro Pro, WordPerfect, Lotus 123, Applix Spreadsheets, CSV,
Multiplan Spreadsheet, and Adobe PDF.
■ The company name keyword list requires editing by the user, which can include any name,
alternate name, or abbreviation that might indicate a reference to the company.
 Library of policy templates 1182
Sexually Explicit Language policy template

Table 38-74 SEC Fair Disclosure Regulation detection rule

Method Condition Configuration

Compound rule Content Matches SEC Fair Disclosure Regulation (Keyword Match):
Keyword (DCM)
■ Match "earnings per share", "forward guidance".
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case insensitive.
■ Match on whole words only.

Message Attachment SEC Fair Disclosure Regulation (Attachment/File Type):

or File Type Match
■ Match file type: excel_macro, xls, works_spread, sylk, quattro_pro,
(DCM)
mod, csv, applix_spread, 123, doc, wordperfect, pdf
■ Severity: High.
■ Match on attachments.
■ Require content match to be in the same component (attachment).

Content Matches SEC Fair Disclosure Regulation (Keyword Match):

Keyword (DCM)
■ Match "[company name]" (user defined)
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments, same component.
■ Case insensitive.
■ Match on whole words only.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Sexually Explicit Language policy template

The Sexually Explicit Language policy detects vulgar, sexually explicit, and pornographic
language content.

DCM Rule Sexually Explicit Keywords, Confirmed

This rule looks for any single keyword in the "Sex. Explicit Keywords, Confirmed"
dictionary.
 Library of policy templates 1183
Source Code policy template

DCM Rule Sexually Explicit Keywords, Suspected

This rule looks for any three instances of keywords in the "Sex. Explicit Words,
Suspect" dictionary.

DCM Rule Sexually Explicit Keywords, Possible

This rule looks for any three instances of keywords in the "Sex. Explicit Words,
Possible" dictionary.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Source Code policy template

The Source Code policy template provides match conditions for detecting various types of
source code at risk of exposure, including C, Java, Perl, and Visual Basic (VB).

Table 38-75 Source code policy template match conditions

Name Type Description

Source Code Documents IDM This rule looks for specific user-provided source code from a
Document Profile.

This rule returns a match if it detects 80% or more of the

source document.

This rule is not available if you do not select a profile when

creating the policy.

Source Code Extensions File Name Match This rule looks for a match among file name extensions from
the "Source Code Extensions" dictionary.

Java Source Code Regular Expressions This compound rule looks for matches on two different regular
expression patterns: Java Import Statements and Java Class
Files.

C Source Code Regular Expression This rule looks for matches on the C Source Code regular
expression pattern.

VB Source Code Regular Expression This rule looks for matches on the VB Source Code regular
expression pattern.

Perl Source Code Regular Expressions This compound rule looks for matches on three different
Perl-related regular expressions patterns.

See “Configuring policies” on page 376.

 Library of policy templates 1184
State Data Privacy policy template

See “Exporting policy detection as a template” on page 405.

State Data Privacy policy template

Many states in the US have adopted statutes mandating data protection and public disclosure
of information security breaches in which confidential data of individuals is compromised. The
State Data Privacy policy template is designed to address these types of confidential data
breaches.
The State Data Privacy policy template provides several individual detection rules and produces
an incident if any of these rules are violated. This policy template also provides a configurable
exception condition that allows one or more authorized email recipients to receive otherwise
confidential data.
Table 38-76 describes the acceptable use condition implemented by the State Data Privacy
policy. You must configure the exception for it to apply.

Table 38-76 Email to Affiliates policy exception

Name Type Description Configuration details

Email to Described Email to Affiliates is a policy exception that allows ■ Simple exception (single
Affiliates identity (DCM) email messages to be sent to affiliates who are condition)
(Recipient) legitimately allowed to receive information ■ Match email recipient:
Recipient
covered under the State Data Privacy regulations. [affiliate1], [affiliate2].
Matches Pattern
Policy exceptions are evaluated before detection ■ Edit the "Affiliate Domains"
match conditions. If there is an exception, in this list and enter the email
case an affiliate email address that you have address for each recipient
entered, the entire message is discarded and not who may make acceptable
available for evaluation by detection. use of the confidential data.
■ At least 1 recipient(s) must
match for the exception to
trigger.
■ Matches on the entire
message.

The State Data Privacy policy template implements Exact Data Matching (Table 38-77). If you
do not select an Exact Data profile when you first create a policy based on this template, the
EDM condition is not available for use.
See “Choosing an Exact Data Profile” on page 371.
 Library of policy templates 1185
State Data Privacy policy template

Table 38-77 State Data Privacy EDM rule

Rule name Condition type Description Configuration details

State Data Content matches This rule looks for an exact data match on three When you are creating the EDM
Privacy, Exact Data of the following: profile, you should validate it
Consumer (EDM) against the State Data Privacy
■ ABA Routing Number
Data template to ensure that the
■ Account Number
resulting index includes
■ Bank Card Number (credit card number) expected fields.
■ Birth Date
■ Simple rule (single match
■ Driver License Number
condition)
■ First Name
■ Severity: High
■ Last Name
■ Report incident if 1 match
■ Password
■ Look in envelope, body,
■ PIN Number
attachments
■ Social Security Number
■ State ID Card Number
Exception conditions: the following combinations
do not match:

■ First Name, Last Name, PIN

■ First Name, Last Name, Password

Table 38-78 lists and describes the DCM detection rules implemented by the State Data Privacy
policy. If any one of these rules is violated the policy produces an incident, unless you have
configured the exception condition and the message recipient is an acceptable use affiliate.

Table 38-78 State Data Privacy detection rules

Rule name Condition type Description Configuration details

US Social Content Matches The US Social Security Number Patterns rule is ■ Simple rule (single match
Security Data Identifier designed to detect US social security numbers condition)
Number (DCM) (SSNs). The Randomized US SSN data identifier ■ Severity: High.
Patterns detects SSN patterns, both traditional and those ■ Count all matches.
issued under the new randomization scheme. ■ Look in envelope, subject,
See “Randomized US Social Security Number body, attachments.
(SSN)” on page 1015.

ABA Routing Content Matches The ABA Routing Numbers rule is designed to ■ Simple rule (single match
Numbers Data Identifier detect ABA Routing Numbers. condition)
(DCM) Severity: High.
The ABA Routing Numbers data identifier detects ■
ABA routing numbers. ■ Count all matches.
■ Look in envelope, subject,
See “ABA Routing Number” on page 798.
body, attachments.
 Library of policy templates 1186
State Data Privacy policy template

Table 38-78 State Data Privacy detection rules (continued)

Rule name Condition type Description Configuration details

Credit Card Content Matches The Credit Card Numbers rule is designed to ■ Simple rule (single condition)
Numbers, All Data Identifier match on credit card numbers. ■ Severity: High.
(DCM) ■ Count all matches.
To detect credit card numbers, this rule
implements the Credit Card Number narrow ■ Look in envelope, subject,
breadth system data identifier. body, attachments

See “Credit Card Number narrow breadth”

on page 867.

CA Drivers Content Matches The CA Drivers License Numbers rule looks for ■ Simple rule (single condition)
License Data Identifier a match for the CA drivers license number ■ Severity: High.
Numbers (DCM) pattern, a match for a data identifier for terms ■ Count all matches.
relating to "drivers license," and a keyword from
■ Look in envelope, subject,
the "California Keywords" dictionary.
body, attachments
See “Drivers License Number – CA State ”
on page 879.

NY Drivers Content Matches The NY Drivers License Numbers rule looks for ■ Simple rule (single condition)
License Data Identifier a match for the NY drivers license number ■ Severity: High.
Numbers (DCM) pattern, a match for a regular expression for terms ■ Count all matches.
relating to "drivers license," and a keyword from
■ Look in envelope, subject,
the "New York Keywords" dictionary.
body, attachments
See “Drivers License Number - NY State”
on page 885.

FL, MI, and Content Matches The FL, MI, and MN Drivers License Numbers ■ Simple rule (single condition)
MN Drivers Data Identifier rule looks for a match for the stated drivers ■ Severity: High.
License (DCM) license number pattern, a match for a regular ■ Count all matches.
Numbers expression for terms relating to "drivers license,"
■ Look in envelope, subject,
and a keyword from the "Letter/12 Num. DLN
body, attachments
State Words" dictionary (namely, Florida,
Minnesota, and Michigan).

See “Drivers License Number - FL, MI, MN States

” on page 881.

IL Drivers Content Matches The IL Drivers License Numbers detection rule ■ Simple rule (single condition)
License Data Identifier looks for a match for the IL drivers license number ■ Severity: High.
Numbers (DCM) pattern, a match for a regular expression for terms ■ Count all matches.
relating to "drivers license," and a keyword from
■ Look in envelope, subject,
the "Illinois Keywords" dictionary.
body, attachments
See “Drivers License Number - IL State”
on page 882.
 Library of policy templates 1187
SWIFT Codes policy template

Table 38-78 State Data Privacy detection rules (continued)

Rule name Condition type Description Configuration details

NJ Drivers Content Matches The NJ Drivers License Numbers detection rule ■ Simple rule (single condition)
License Data Identifier looks for a match for the NJ drivers license ■ Severity: High.
Numbers (DCM) number pattern, a match for a regular expression ■ Count all matches.
for terms relating to "drivers license," and a
■ Look in envelope, subject,
keyword from the "New Jersey Keywords"
body, attachments
dictionary.

This condition implements the Driver's License

Number- NJ State medium breadth system Data
Identifier.

See “Drivers License Number- NJ State medium

breadth” on page 884.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

SWIFT Codes policy template

The Society for Worldwide Interbank Financial Telecommunication (SWIFT) is a cooperative
organization under Belgian law and is owned by its member financial institutions. The SWIFT
code (also known as a Bank Identifier Code, BIC, or ISO 9362) has a standard format to identify
a bank, location, and the branch involved. These codes are used when transferring money
between banks, particularly across international borders.

DCM Rule SWIFT Code Regular Expression

This rule looks for a match to the SWIFT code regular expression and a keyword
from the "SWIFT Code Keywords" dictionary.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Symantec DLP Awareness and Avoidance policy

template
The Symantec DLP Awareness & Avoidance policy detects any communications that refer to
Symantec Data Loss Prevention or data loss prevention systems and possible avoidance of
detection. The Symantec DLP Awareness & Avoidance policy is most useful for the deployments
that are not widely known among monitored users.
 Library of policy templates 1188
UK Drivers License Numbers policy template

DCM Rule Symantec DLP Awareness

Checks for a keyword match from the "Symantec DLP Awareness" dictionary.

DCM Rule Symantec DLP Avoidance

This rule is a compound rule with two conditions; both must be matched to trigger
an incident. This rule looks for a keyword match from the "Symantec DLP Awareness"
dictionary and a keyword from the "Symantec DLP Avoidance" dictionary.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

UK Drivers License Numbers policy template

The UK Drivers License Numbers policy detects UK Drivers License Numbers using the official
specification of the UK Government Standards of the UK Cabinet Office.

DCM Rule UK Drivers License Numbers

This rule is a compound rule with the following conditions:

■ A single keyword from the "UK Keywords" dictionary

■ The pattern matching that of the UK drivers license data identifier
■ Different combinations of the phrase "drivers license" using a data identifier

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

UK Electoral Roll Numbers policy template

The UK Electoral Roll Numbers policy detects UK Electoral Roll Numbers using the official
specification of the UK Government Standards of the UK Cabinet Office.

DCM Rule UK Electoral Roll Numbers

This rule is a compound rule with the following conditions:

■ A single keyword from the "UK Keywords" dictionary

■ A pattern matching the UK Electoral Roll Number data identifier
■ A single keyword from the "UK Electoral Roll Number Words" dictionary

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.
 Library of policy templates 1189
UK National Health Service (NHS) Number policy template

UK National Health Service (NHS) Number policy

template
The UK National Health Service (NHS) Number policy detects the personal identification
number issued by the U.K. National Health Service (NHS) for administration of medical care.

DCM Rule UK NHS Numbers

This rule looks for a single compound condition with two parts: either new or old
style National Health Service numbers and a single keyword from the "UK NHS
Keywords" dictionary.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

UK National Insurance Numbers policy template

The National Insurance Number is issued to individuals by the UK Department for Work and
Pensions and Inland Revenue (DWP/IR) for administering the national insurance system. The
UK National Insurance Numbers policy detects these insurance policy numbers.

DCM Rule UK National Insurance Numbers

This rule looks for a match to the UK National Insurance number data identifier and
a keyword from the dictionary "UK NIN Keywords."

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

UK Passport Numbers policy template

The UK Passport Numbers policy detects valid UK passports using the official specification of
the UK Government Standards of the UK Cabinet Office.

DCM Rule UK Passport Numbers (Old Type)

This rule looks for a keyword from the "UK Passport Keywords" dictionary and a
pattern matching the regular expression for UK Passport Numbers (Old Type).

DCM Rule UK Passport Numbers (New Type)

This rule looks for a keyword from the "UK Passport Keywords" dictionary and a
pattern matching the regular expression for UK Passport Numbers (New Type).
 Library of policy templates 1190
UK Tax ID Numbers policy template

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

UK Tax ID Numbers policy template

The UK Tax ID Numbers policy detects UK Tax ID Numbers using the official specification of
the UK Government Standards of the UK Cabinet Office.

DCM Rule UK Tax ID Numbers

This rule looks for a match to the UK Tax ID number data identifier and a keyword
from the dictionary "UK Tax ID Number Keywords."

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

US Intelligence Control Markings (CAPCO) and DCID

1/7 policy template
The US Intelligence Control Markings (CAPCO) & DCID 1/7 policy detects authorized terms
to identify classified information in the US Federal Intelligence community as defined in the
Control Markings Register, which is maintained by the Controlled Access Program Coordination
Office (CAPCO) of the Community Management Staff (CMS). The register was created in
response to the Director of Central Intelligence Directive (DCID) 1/7.
This rule looks for a keyword match on the phrase "TOP SECRET."

Table 38-79 Top Secret Information detection rule

Method Condition Configuration

Simple rule Content Matches Match "TOP SECRET//"

Keyword (DCM)
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case sensitive.
■ Match on whole or partial words.

This rule looks for a keyword match on the phrase "SECRET."

 Library of policy templates 1191
US Social Security Numbers policy template

Table 38-80 Secret Information detection rule

Method Condition Configuration

Simple rule Content Matches Match "SECRET//"

Keyword (DCM)
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case sensitive.
■ Match on whole or partial words.

This rule looks for a keyword match on the phrases "CLASSIFIED" or "RESTRICTED."

Table 38-81 Classified or Restricted Information (Keyword Match) detection rule

Method Condition Configuration

Simple rule Content Matches Match "CLASSIFIED//,//RESTRICTED//"

Keyword (DCM)
■ Severity: High.
■ Check for existence.
■ Look in envelope, subject, body, attachments.
■ Case sensitive.
■ Match on whole or partial words.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

US Social Security Numbers policy template

The US Social Security Numbers policy detects patterns indicating social security numbers at
risk of exposure.

Table 38-82 US Social Security Numbers policy template

Rule name Rule type Description Details

US Social Security DCM Rule This rule looks for a match to the social See “Randomized US Social
Number Patterns security number regular expression and Security Number (SSN)”
a keyword from the dictionary "US SSN on page 1015.
Keywords."

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.
 Library of policy templates 1192
Violence and Weapons policy template

Violence and Weapons policy template

The Violence and Weapons policy detects violent language and discussions about weapons.

Table 38-83 Violence and Weapons policy template

Name Type Description

Violence and DCM Rule This rule is a compound rule with two conditions; both must match to trigger an
Weapons incident. This rule looks for a keyword from the "Violence Keywords" dictionary
and a keyword from the "Weapons Keywords" dictionary.

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Webmail policy template

The Webmail policy detects the use of a variety of Webmail services, including Yahoo, Google,
and Hotmail.

Table 38-84 Webmail policy template rules

Name Type Condition(s) Description

Yahoo Compound Recipient Matches This condition checks for the URL domain
detection rule Pattern (DCM) mail.yahoo.com.

Content Matches This condition checks for the keyword ym/compose.

Keyword (DCM)

Hotmail Compound Recipient Matches This condition checks for the URL domain
detection rule Pattern (DCM) hotmail.msn.com.

Content Matches This condition checks for the keyword

Keyword (DCM) compose?&curmbox.

Go Compound Recipient Matches This condition checks for the URL gomailus.go.com.
detection rule Pattern (DCM)

Content Matches This condition checks for the keyword compose.

Keyword (DCM)

AOL Compound Recipient Matches This condition checks for the URL domain aol.com.
detection rule Pattern (DCM)

Content Matches This condition checks for the keyword compose.

Keyword (DCM)
 Library of policy templates 1193
Yahoo Message Board Activity policy template

Table 38-84 Webmail policy template rules (continued)

Name Type Condition(s) Description

Gmail Compound Recipient Matches This condition checks for the URL domain
detection rule Pattern (DCM) gmail.google.com.

Content Matches This condition checks for the keyword gmail.

Keyword (DCM)

See “Configuring policies” on page 376.

See “Exporting policy detection as a template” on page 405.

Yahoo Message Board Activity policy template

The Yahoo Message Board policy template detects Yahoo message board activity.
The Yahoo Message Board detection rule is a compound method that looks for messages
posted to the Yahoo message board you specify.
Table 38-85 describes its configuration details.

Table 38-85 Yahoo Message Board detection rule

Method Condition Configuration

Compound Content Matches Keyword Yahoo Message Board (Keyword Match):

rule (DCM)
■ Case insensitive.
■ Match Keyword: post.messages.yahoo.com/bbs.
■ Match on whole words only.
■ Check for existence (do not count multiple matches).
■ Look in envelope, subject, body, attachments.
■ Match must occur in the same component for both conditions.

AND

Content Matches Keyword Yahoo Message Board (Keyword Match):

(DCM)
■ Case insensitive.
■ Match Keyword: board=<enter board number>.
■ Match on whole words only.
■ Check for existence (do not count multiple matches).
■ Look in envelope, subject, body, attachments.
■ Match must occur in the same component for both conditions.
 Library of policy templates 1194
Yahoo and MSN Messengers on Port 80 policy template

The Finance Message Board URL detection rule detects messages posted to the Yahoo
Finance message board.
Table 38-86 describes its configuration.

Table 38-86 Finance Message Board URL detection rule

Method Condition Configuration

Simple rule Content Matches Keyword Finance Message Board URL (Keyword Match):
(DCM)
■ Case insensitive.
■ Match Keyword: messages.finance.yahoo.com.
■ Match on whole words only.
■ Check for existence (do not count multiple matches).
■ Look in envelope, subject, body, attachments.

The Board URLs detection rule detects messages posted to the Yahoo or Yahoo Finance
message boards by the URL of either.
Table 38-87 describes its configuration details.

Table 38-87 Board URLs detection rule

Method Condition Configuration

Simple rule Recipient Matches Pattern Board URLs (Recipient):

(DCM)
■ Recipient URL:
messages.yahoo.com,messages.finance.yahoo.com.
■ At least 1 recipient(s) must match.
■ Matches on the entire message (not configurable).

See “Creating a policy from a template” on page 360.

See “Exporting policy detection as a template” on page 405.

Yahoo and MSN Messengers on Port 80 policy

template
The Yahoo and MSN Messengers on Port 80 policy detects Yahoo and MSN Messenger
activity over port 80.
The Yahoo IM detection rule looks for keyword matches on both ymsg and
shttp.msg.yahoo.com.
 Library of policy templates 1195
Yahoo and MSN Messengers on Port 80 policy template

Table 38-88 Yahoo IM detection rule

Method Condition Configuration

Yahoo IM (Keyword Match):

■ Case insensitive.
■ Match keyword: ymsg.
Content Matches Keyword ■ Match on whole words only.
(DCM) ■ Count all matches and report an incident for each match.
■ Look for matches in the envelope, subject, body, and attachments.
■ Match must occur in the same component for both conditions in the
rule.
Compound
AND
rule
Yahoo IM (Keyword Match):

■ Case insensitive.
■ Match keyword: shttp.msg.yahoo.com.
Content Matches Keyword ■ Match on whole words only.
(DCM) ■ Count all matches and report an incident for each match.
■ Look for matches in the envelope, subject, body, and attachments.
■ Match must occur in the same component for both conditions in the
rule.

The MSN IM detection rule looks for matches on three keywords in the same message
component.
 Library of policy templates 1196
Yahoo and MSN Messengers on Port 80 policy template

Table 38-89 MSN IM detection rule

Method Condition Configuration

MSN IM (Keyword Match):

■ Case insensitive.
■ Match keyword: msg.
Content Matches Keyword
■ Match on whole words only.
(DCM)
■ Count all matches and report an incident for each match.
■ Look for matches in the envelope, subject, body, and attachments.
■ Match must occur in the same component for all conditions in the rule.

AND

MSN IM (Keyword Match):

■ Case insensitive.
■ Match keyword: x-msn.
Compound Content Matches Keyword
■ Match on whole words only.
rule (DCM)
■ Count all matches and report an incident for each match.
■ Look for matches in the envelope, subject, body, and attachments.
■ Match must occur in the same component for all conditions in the rule.

AND

MSN IM (Keyword Match):

■ Case insensitive.
■ Match keyword: charset=utf-8.
Content Matches Keyword
■ Match on whole words only.
(DCM)
■ Count all matches and report an incident for each match.
■ Look for matches in the envelope, subject, body, and attachments.
■ Match must occur in the same component for all conditions in the rule.

See “Creating a policy from a template” on page 360.

See “Exporting policy detection as a template” on page 405.
 Section 5
Configuring policy response
rules

■ Chapter 39. Responding to policy violations

■ Chapter 40. Configuring and managing response rules

■ Chapter 41. Response rule conditions

■ Chapter 42. Response rule actions

 Chapter 39
Responding to policy
violations
This chapter includes the following topics:

■ About response rules

■ About response rule actions

■ Response rule actions for all detection servers

■ Response rule actions for endpoint detection

■ Response rule actions for Network Prevent detection

■ Response rule actions for Network Protect detection

■ Response rule actions for Cloud Storage detection

■ Response rule actions for Cloud Applications and API appliance detectors

■ About response rule execution types

■ About Automated Response rules

■ About Smart Response rules

■ About response rule conditions

■ About response rule action execution priority

■ About response rule authoring privileges

■ Implementing response rules

■ Response rule best practices

 Responding to policy violations 1199
About response rules

About response rules

You can implement one or more response rules in a policy to remedy, escalate, resolve, and
dismiss incidents when a violation occurs. For example, if a policy is violated, a response rule
blocks the transmission of a file containing sensitive content.
See “About response rule actions” on page 1199.
You create, modify, and manage response rules separate from the policies that declare them.
This decoupling allows response rules to be updated and reused across policies.
See “Implementing response rules” on page 1216.
The detection server automatically executes response rules. Or, you can configure Smart
Response rules for manual execution by an incident remediator.
See “About response rule execution types” on page 1208.
You can implement conditions to control how and when response rules execute.
See “About response rule conditions” on page 1210.
You can sequence the order of execution for response rules of the same type.
See “About response rule action execution priority” on page 1211.
You must have response rule authoring privileges to create and manage response rules.
See “About response rule authoring privileges” on page 1215.

About response rule actions

Response rule actions are the components that take action when a policy violation occurs.
Response rule actions are mandatory components of response rules. If you create a response
rule, you must define at least one action for the response rule to be valid.
Symantec Data Loss Prevention provides several response rule actions. Many are available
for all types of detection servers. Others are available for specific detection servers.
See “Implementing response rules” on page 1216.
The detection server where a policy is deployed executes a response rule action any time a
policy violation occurs. Or, you can configure a response rule condition to dictate when the
response rule action executes.
See “About response rule conditions” on page 1210.
For example, any time a policy is violated, send an email to the user who violated the policy
and the manager. Or, if a policy violation severity level is medium, present the user with an
on-screen warning. Or, if the severity is high, block a file from being copied to an external
device.
 Responding to policy violations 1200
Response rule actions for all detection servers

Table 39-1 Response rule actions by server type

Server type Description

All detection servers See “Response rule actions for all detection servers” on page 1200.

Endpoint detection servers See “Response rule actions for endpoint detection” on page 1201.

Network Prevent detection servers See “Response rule actions for Network Prevent detection” on page 1202.

Network Protect detection servers See “Response rule actions for Network Protect detection” on page 1203.

Cloud storage detections servers and See “Response rule actions for Cloud Storage detection” on page 1204.
detectors

Cloud Service Connector REST See “Response rule actions for Cloud Applications and API appliance
detectors and API Detection for detectors” on page 1204.
Developer Apps Appliances

Response rule actions for all detection servers

Symantec Data Loss Prevention provides several response rule actions for Endpoint Prevent,
Endpoint Discover, Network Prevent for Web, Network Prevent for Email, and Network Protect.

Table 39-2 Available response rule actions for all detection servers

Response rule action Description

Add Note Add a field to the incident record that the remediator can annotate at the
Incident Snapshot screen.

See “Configuring the Add Note action” on page 1239.

Limit Incident Data Retention Discard or retain matched data with the incident record.

See “Configuring the Limit Incident Data Retention action” on page 1239.

Log to a Syslog Server Log the incident to a syslog server.

See “Configuring the Log to a Syslog Server action” on page 1242.

Send Email Notification Send an email you compose to recipients you specify.

See “Configuring the Send Email Notification action” on page 1243.

 Responding to policy violations 1201
Response rule actions for endpoint detection

Table 39-2 Available response rule actions for all detection servers (continued)

Response rule action Description

Server FlexResponse Execute a custom Server FlexResponse action.

See “Configuring the Server FlexResponse action” on page 1245.
Note: This response rule action is available only if you deploy one or more
custom Server FlexResponse plug-ins to Symantec Data Loss Prevention.

See “Deploying a Server FlexResponse plug-in” on page 1586.

Set Attribute Add a custom value to the incident record.

See “Configuring the Set Attribute action” on page 1246.

Set Status Change the incident status to the specified value.

See “Configuring the Set Status action” on page 1247.

See “About response rules” on page 1199.

See “Implementing response rules” on page 1216.

Response rule actions for endpoint detection

Symantec Data Loss Prevention provides several response rule actions for Endpoint Prevent
and Endpoint Discover.

Table 39-3 Available Endpoint response rule actions

Response rule action Description

Endpoint: FlexResponse Take custom action using the FlexResponse API.

See “Configuring the Endpoint: FlexResponse action” on page 1269.

Endpoint Discover: Quarantine File Quarantine a discovered sensitive file.

See “Configuring the Endpoint Discover: Quarantine File action” on page 1270.

Endpoint Prevent: Block Block the transfer of data that violates the policy.

For example, block the copy of confidential data from an endpoint to a USB
flash drive.

See “Configuring the Endpoint Prevent: Block action” on page 1272.

Endpoint Prevent: Notify Display an on-screen notification to the endpoint user when confidential
data is transferred.

See “Configuring the Endpoint Prevent: Notify action” on page 1279.

 Responding to policy violations 1202
Response rule actions for Network Prevent detection

Table 39-3 Available Endpoint response rule actions (continued)

Response rule action Description

Endpoint Prevent: User Cancel Allow the user to cancel the transfer of a confidential file. The override is
time sensitive.

See “Configuring the Endpoint Prevent: User Cancel action” on page 1282.

See “About response rules” on page 1199.

See “Implementing response rules” on page 1216.
See “Endpoint Prevent on Mac response rule features” on page 1725.

Response rule actions for Network Prevent detection

Symantec Data Loss Prevention provides several response rule actions for Network Prevent
for Web and Network Prevent for Email.

Table 39-4 Available Network response rule actions

Response rule action Description

Network Prevent: Block FTP Request Block FTP transmissions.

See “Configuring the Network Prevent for Web: Block FTP Request action”
on page 1285.
Note: Only available with Network Prevent for Web.

Network Prevent: Block HTTP/S Block Web postings.

See “Configuring the Network Prevent for Web: Block HTTP/S action”
on page 1285.
Note: Only available with Network Prevent for Web.

Network Prevent: Block SMTP Message Block email that causes an incident.

See “Configuring the Network Prevent: Block SMTP Message action”

on page 1286.

Network Prevent: Modify SMTP Message Modify sensitive email messages.

For example, change the email subject to include information about the
violation.

See “Configuring the Network Prevent: Modify SMTP Message action”

on page 1287.
 Responding to policy violations 1203
Response rule actions for Network Protect detection

Table 39-4 Available Network response rule actions (continued)

Response rule action Description

Network Prevent: Remove HTTP/S Remove confidential content from Web posts.
Content
See “Configuring the Network Prevent for Web: Remove HTTP/S Content
action” on page 1288.
Note: Only available with Network Prevent for Web.

See “About response rules” on page 1199.

See “Implementing response rules” on page 1216.

Response rule actions for Network Protect detection

Symantec Data Loss Prevention provides several response rule actions for Network Protect
(Discover).

Table 39-5 Available Network Protect response rule actions

Response rule action Description

Network Protect: Copy File Copy sensitive files to a location you specify.

See “Configuring the Network Protect: Copy File action” on page 1290.
Note: Only available with Network Protect.

Network Protect: Quarantine File Quarantine sensitive files.

See “Configuring the Network Protect: Quarantine File action” on page 1290.
Note: Only available with Network Protect.

Network Protect: Encrypt File Encrypt sensitive files using Symantec ICE.

See “Configuring the Network Protect: Encrypt File action” on page 1292.
Note: This action is available only if you have installed the Network Protect
ICE license and configured the Enforce Server to connect to the Symantec
ICE Cloud. For information about how Symantec Data Loss Prevention
interacts with Symantec ICE, refer to the Symantec Information Centric
Encryption Deployment Guide at http://www.symantec.com/docs/DOC9707.

See “About response rules” on page 1199.

See “Implementing response rules” on page 1216.
 Responding to policy violations 1204
Response rule actions for Cloud Storage detection

Response rule actions for Cloud Storage detection

Symantec Data Loss Prevention provides two response rule actions for Cloud Storage detection,
from either on-premises detection servers or on cloud detectors.

Table 39-6 Available Cloud Storage response rule actions

Response rule action Description

Cloud Storage: Add Visual Tag Add a text tag to Box cloud storage content that
violates a policy.

See “Configuring the Cloud Storage: Add Visual

Tag action” on page 1252.

Cloud Storage: Quarantine Quarantine sensitive files from a cloud storage user
account to a quarantine user account. For
on-premises Box scanning, you can also use an
on-premises quarantine location.

See “Configuring the Cloud Storage: Quarantine

action” on page 1252.

See “About response rules” on page 1199.

See “Implementing response rules” on page 1216.

Response rule actions for Cloud Applications and API

appliance detectors
The Symantec Data Loss Prevention Cloud Service Connector enables you to connect
Symantec Data Loss Prevention to your cloud access security broker (CASB) solution. You
can use the public REST API to send sensitive data from your CASB solution to Symantec
Data Loss Prevention for inspection. Symantec Data Loss Prevention responds with policy
violation information and recommendations for remediation action where appropriate.
The API Detection for Developer Apps Appliance enables you to connect with on-premises
applications. You can use the REST API to submit data from your applications to Symantec
Data Loss Prevention for inspection. Symantec Data Loss Prevention responds with policy
violation information and recommendations for remediation action where appropriate.
These Cloud Applications and API appliance response rules let you configure the remediation
recommendation messages that Symantec Data Loss Prevention includes in the detection
responses it sends back to the REST client in the customResponsePayload or message
parameters. Automated response rules are automatically executed on the target applicaion.
 Responding to policy violations 1205
Response rule actions for Cloud Applications and API appliance detectors

The response rules for the Cloud Applications and API appliances are organized in two
categories, one for each data type in the REST API: Data-at-Rest (DAR), and Data-in-Motion
(DIM).

Table 39-7 Available Cloud Applications and API appliance (Data-at-Rest) response rule
actions

Response rule action Description

Break Links in Data-at-Rest The Break Links in Data-at-Rest action returns

break links in the sensitive data..

See “Configuring the Break Links in Data-at-Rest

action” on page 1254.

Custom Action on Data-at-Rest The Custom Action on Data-at-Rest action returns

a recommendation to perform some custom action
on the sensitive data with the detection result.

See “Configuring the Custom Action on Data-at-Rest

action” on page 1255.

Delete Data-at-Rest The Delete Data-at-Rest action deletes the

sensitive data.

See “Configuring the Delete Data-at-Rest action”

on page 1256.

Encrypt Data-at-Rest The Encrypt Data-at-Rest action encrypts the

sensitive data.
See “Configuring the Encrypt Data-at-Rest action”
on page 1257.

Perform DRM on Data-at-Rest The Perform DRM on Data-at-Rest action applies

Digital Rights Management (DRM) to the sensitive
data.

See “Configuring the Perform DRM on Data-at-Rest

action” on page 1257.

Quarantine Data-at-Rest The Quarantine Data-at-Rest action quarantines

the sensitive data.

See “Configuring the Quarantine Data-at-Rest

action” on page 1258.

Tag Data-at-Rest The Tag Data-at-Rest action tags the sensitive

data.

See “Configuring the Tag Data-at-Rest action”

on page 1259.
 Responding to policy violations 1206
Response rule actions for Cloud Applications and API appliance detectors

Table 39-8 Available Cloud Applications and API appliance (Additional Data-at-Rest Actions)
response rule actions

Response rule action Description

Prevent download, copy, print The Prevent download, copy, print action
prevents download, copy, and print options for the
sensitive data.

See “Configuring the Prevent download, copy, print

action” on page 1260.

Remove Collaborator Access The Remove Collaborator Access action removes

access rights from all collaborators to the sensitive
data.

See “Configuring the Remove Collaborator Access

action” on page 1260.

Set Collaborator Access to 'Edit' The Set Collaborator Access to 'Edit' action
grants edit access to collaborators for the sensitive
data.

See “Configuring the Set Collaborator Access to

'Edit' action” on page 1261.

Set Collaborator Access to 'Preview' The Set Collaborator Access to 'Preview' action
grants preview access to collaborators for the
sensitive data.

See “Configuring the Set Collaborator Access to

'Preview' action” on page 1261.

Set Collaborator Access to 'Read' The Set Collaborator Access to 'Read' action
grants read access to collaborators for the sensitive
data.

See “Configuring the Set Collaborator Access to

'Read' action” on page 1262.

Set File Access to 'All Read' The Set File Access to 'All Read' action allows
public read access to the sensitive data.

See “Configuring the Set File Access to 'All Read'

action” on page 1262.

Set File Access to 'Internal Edit' The Set File Access to 'Internal Edit' action allows
all members of your organization editing
permissions on the sensitive data.

See “Configuring the Set File Access to 'Internal

Edit'” on page 1263.
 Responding to policy violations 1207
Response rule actions for Cloud Applications and API appliance detectors

Table 39-8 Available Cloud Applications and API appliance (Additional Data-at-Rest Actions)
response rule actions (continued)

Response rule action Description

Set File Access to 'Internal Read' The Set File Access to 'Internal Read' action
allows all members of your organization read access
to the sensitive data.

See “Configuring the Set File Access to 'Internal

Read' action” on page 1264.

Table 39-9 Available Cloud Applications and API appliance (Data-in-Motion) response rule
actions

Response rule action Description

Add two-factor authentication The Add two-factor authentication action adds

two-factor authentication to the sensitive data.

See “Configuring the Add two-factor authentication

action” on page 1264.

Block Data-in-Motion The Block Data-in-Motion action blocks the

sensitive data.

See “Configuring the Block Data-in-Motion action”

on page 1265.

Custom Action on Data-in-Motion The Custom Action on Data-in-Motion action

returns a recommendation to take some custom
action on the sensitive data with the detection result.

See “Configuring the Custom Action on

Data-in-Motion action” on page 1265.

Encrypt Data-in-Motion The Encrypt Data-in-Motion action encrypts the

sensitive data.

See “Configuring the Encrypt Data-in-Motion action”

on page 1266.

Perform DRM on Data-in-Motion The Perform DRM on Data-in-Motion action

applies Digital Rights Management (DRM) to the
sensitive data.

See “Configuring the Perform DRM on

Data-in-Motion action” on page 1267.
 Responding to policy violations 1208
About response rule execution types

Table 39-9 Available Cloud Applications and API appliance (Data-in-Motion) response rule
actions (continued)

Response rule action Description

Quarantine Data-in-Motion The Quarantine Data-in-Motion action quarantines

the sensitive data.

See “Configuring the Quarantine Data-in-Motion

action” on page 1268.

Redact Data-in-Motion The Redact Data-in-Motion action redacts the

sensitive data.

See “Configuring the Redact Data-in-Motion action”

on page 1268.

About response rule execution types

Symantec Data Loss Prevention provides two types of policy response rules: Automated and
Smart.
The detection server that reports a policy violation executes Automated Response rules. Users
such as incident remediators execute Smart Response rules on demand from the Enforce
Server administration console.
See “About recommended roles for your organization” on page 95.

Table 39-10 Response rule types

Response rule execution type Description

Automated Response rules When a policy violation occurs, the detection server automatically executes
response rule actions.

See “About Automated Response rules” on page 1209.

Smart Response rules When a policy violation occurs, an authorized user manually triggers the
response rule.

See “About Smart Response rules” on page 1209.

See “About response rule actions” on page 1199.

See “Implementing response rules” on page 1216.
 Responding to policy violations 1209
About Automated Response rules

About Automated Response rules

The system executes Automated Response rules when the detection engine reports a policy
violation. However, if you implement a response rule condition, the condition must be met for
the system to execute the response rule. Conditions let you control the automated execution
of response rule actions.
See “About response rule conditions” on page 1210.
For example, the system can automatically block certain policy violating actions, such as the
attempted transfer of high value customer data or sensitive design documents. Or, the system
can escalate an incident to a workflow management system for immediate attention. Or, you
can set a different severity level for an incident involving 1000 customer records than for one
involving only 10 records.
See “Implementing response rules” on page 1216.

About Smart Response rules

Users execute Smart Response rules on demand in response to policy violations from the
Enforce Server administration console Incident Snapshot screen.
See “About response rule actions” on page 1199.
You create Smart Response rules for the situations that require human remediation. For
example, you might create a Smart response rule to dismiss false positive incidents. An incident
remediator can review the incident, identify the match as a false positive, and dismiss it.
See “About configuring Smart Response rules” on page 1222.
Only some response rules are available for manual execution.

Table 39-11 Available Smart Response rules for manual execution

Smart response rule Description

Add Note Add a field to the incident record that the remediator can annotate at the
Incident Snapshot screen.

See “Configuring the Add Note action” on page 1239.

Log to a Syslog Server Log the incident to a syslog server for workflow remediation.

See “Configuring the Log to a Syslog Server action” on page 1242.

Quarantine Quarantine sensitive data in cloud applications.

Restore File Restore a previously quarantined cloud application file.

 Responding to policy violations 1210
About response rule conditions

Table 39-11 Available Smart Response rules for manual execution (continued)

Smart response rule Description

Send Email Notification Send an email you compose to recipients you specify.
See “Configuring the Send Email Notification action” on page 1243.

Server FlexResponse Execute a custom Server FlexResponse action.

See “Configuring the Server FlexResponse action” on page 1245.

Note: This response rule action is available only if you deploy one or more
custom Server FlexResponse plug-ins to Symantec Data Loss Prevention.

See “Deploying a Server FlexResponse plug-in” on page 1586.

Set Status Set the incident status to the specified value.

See “Configuring the Set Status action” on page 1247.

See “Implementing response rules” on page 1216.

About response rule conditions

Response rule conditions are optional response rule components. Conditions define how and
when the system triggers response rule actions. Conditions give you multiple ways to prioritize
incoming incidents to focus remediation efforts and take appropriate response.
See “Implementing response rules” on page 1216.
Response rule conditions trigger action based on detection match criteria. For example, you
can configure a condition to trigger action for high severity incidents, certain types of incidents,
or after a specified number of incidents.
See “Configuring response rule conditions” on page 1222.
Conditions are not required. If a response rule does not declare a condition, the response rule
action always executes each time an incident occurs. If a condition is declared, it must be met
for the action to trigger. If more than one condition is declared, all must be met for the system
to take action.
See “Configuring response rules” on page 1221.

Table 39-12 Available response rule conditions

Condition type Description

Endpoint Location Triggers a response action when the endpoint is on or off the corporate network.

See “Configuring the Endpoint Location response condition” on page 1229.

 Responding to policy violations 1211
About response rule action execution priority

Table 39-12 Available response rule conditions (continued)

Condition type Description

Endpoint Device Triggers a response action when an event occurs on a configured endpoint
device.

See “Configuring the Endpoint Device response condition” on page 1230.

Incident Type Triggers a response action when the specified type of detection server reports
a match.

See “Configuring the Incident Type response condition” on page 1231.

Incident Match Count Triggers a response action when the volume of policy violations exceeds a
threshold or range.

See “Configuring the Incident Match Count response condition” on page 1232.

Protocol or Endpoint Monitoring Triggers a response action when an incident is detected on a specified network
communications protocol (such as HTTP) or endpoint destination (such as
CD/DVD).

See “Configuring the Protocol or Endpoint Monitoring response condition”

on page 1233.

Severity Triggers a response action when the policy violation is a certain severity level.

See “Configuring the Severity response condition” on page 1235.

About response rule action execution priority

A Symantec Data Loss Prevention server executes response rule actions according to a
system-defined prioritized order. You cannot modify the order of execution among response
rules of different types.
In all cases, when a server executes two or more different response rules for the same policy,
the higher priority response action takes precedence.
Consider the following example(s):
■ One endpoint response rule lets a user cancel an attempted file copy and another rule
blocks the attempt.
The detection server blocks the file copy.
■ One network response rule action copies a file and another action quarantines it.
The detection server quarantines the file.
■ One network response rule action modifies the content of an email message and another
action blocks the transmission.
The detection server blocks the email transmission.
 Responding to policy violations 1212
About response rule action execution priority

You cannot change the priority execution order for different response rule action types. But,
you can modify the order of execution for the same type of response rule action with conflicting
instructions.
See “Modifying response rule ordering” on page 1227.

Table 39-13 System-defined response rule execution priority

Execution priority Description

(from highest to lowest)

Endpoint Prevent: Block See “Configuring the Endpoint Prevent: Block action”
on page 1272.

Endpoint Prevent: Encrypt See “Configuring the Endpoint Prevent: Encrypt action”
on page 1275.

Endpoint Prevent: User Cancel See “Configuring the Endpoint Prevent: User Cancel action”
on page 1282.

Endpoint: FlexResponse See “Configuring the Endpoint: FlexResponse action”

on page 1269.

Endpoint Prevent: Notify See “Configuring the Endpoint Prevent: Notify action”
on page 1279.

Endpoint Discover: Quarantine File See “Configuring the Endpoint Discover: Quarantine File action”
on page 1270.

All: Limit Incident Data Retention See “Configuring the Limit Incident Data Retention action”
on page 1239.

Network Prevent: Block SMTP Message See “Configuring the Network Prevent: Block SMTP Message
action” on page 1286.

Network Prevent: Modify SMTP See “Configuring the Network Prevent: Modify SMTP Message
Message action” on page 1287.

Network Prevent for Web: Remove See “Configuring the Network Prevent for Web: Remove
HTTP/HTTPS Content HTTP/S Content action” on page 1288.

Network Prevent for Web: Block See “Configuring the Network Prevent for Web: Block HTTP/S
HTTP/HTTPS action” on page 1285.

Network Prevent for Web: Block FTP See “Configuring the Network Prevent for Web: Block FTP
Request Request action” on page 1285.

Network Protect: Quarantine File See “Configuring the Network Protect: Quarantine File action”
on page 1290.
 Responding to policy violations 1213
About response rule action execution priority

Table 39-13 System-defined response rule execution priority (continued)

Execution priority Description

(from highest to lowest)

Network Protect: Encrypt File See “Configuring the Network Protect: Encrypt File action”
on page 1292.

Network Protect: Copy File See “Configuring the Network Protect: Copy File action”
on page 1290.

All: Set Status See “Configuring the Set Status action” on page 1247.

All: Set Attribute See “Configuring the Set Attribute action” on page 1246.

All: Add Note See “Configuring the Add Note action” on page 1239.

All: Log to a Syslog Server See “Configuring the Log to a Syslog Server action” on page 1242.

All: Send Email Notification See “Configuring the Send Email Notification action”
on page 1243.

Cloud Storage: Add Visual Tag See “Configuring the Cloud Storage: Add Visual Tag action”
on page 1252.

Cloud Storage: Quarantine See “Configuring the Cloud Storage: Quarantine action”
on page 1252.

Server FlexResponse See “Configuring the Server FlexResponse action” on page 1245.
Note: Server FlexResponse actions that are part of Automated
Response rules execute on the Enforce Server, rather than the
detection server.

Cloud Applications and API appliance See “Configuring the Block Data-in-Motion action” on page 1265.
(Data-in-Motion): Block Data-in-Motion

Cloud Applications and API appliance See “Configuring the Redact Data-in-Motion action” on page 1268.
(Data-in-Motion): Redact Data-in-Motion

Cloud Applications and API appliance See “Configuring the Encrypt Data-in-Motion action”
(Data-in-Motion): Encrypt Data-in-Motion on page 1266.

Cloud Applications and API appliance See “Configuring the Quarantine Data-in-Motion action”
(Data-in-Motion): Quarantine on page 1268.
Data-in-Motion

Cloud Applications and API appliance See “Configuring the Perform DRM on Data-in-Motion action”
(Data-in-Motion): Perform DRM on on page 1267.
Data-in-Motion
 Responding to policy violations 1214
About response rule action execution priority

Table 39-13 System-defined response rule execution priority (continued)

Execution priority Description

(from highest to lowest)

Cloud Applications and API appliance See “Configuring the Custom Action on Data-in-Motion action”
(Data-in-Motion): Custom Action on on page 1265.
Data-in-Motion

Cloud Applications and API appliance See “Configuring the Encrypt Data-at-Rest action” on page 1257.
(Data-at-Rest): Encrypt Data-at-Rest

Cloud Applications and API appliance See “Configuring the Delete Data-at-Rest action” on page 1256.
(Data-at-Rest): Delete Data-at-Rest

Cloud Applications and API appliance See “Configuring the Quarantine Data-at-Rest action”
(Data-at-Rest): Quarantine Data-at-Rest on page 1258.

Cloud Applications and API appliance See “Configuring the Tag Data-at-Rest action” on page 1259.
(Data-at-Rest): Tag Data-at-Rest

Cloud Applications and API appliance See “Configuring the Perform DRM on Data-at-Rest action”
(Data-at-Rest): Perform DRM on on page 1257.
Data-at-Rest

Cloud Applications and API appliance See “Configuring the Break Links in Data-at-Rest action”
(Data-at-Rest): Break Links in on page 1254.
Data-at-Rest

Cloud Applications and API appliance See “Configuring the Custom Action on Data-at-Rest action”
(Data-at-Rest): Custom Action on on page 1255.
Data-at-Rest

Cloud Applications and API appliance See “Configuring the Set File Access to 'All Read' action”
(Additional Data-at-Rest Actions): Set on page 1262.
File Access to 'All Read'

Cloud Applications and API appliance See “Configuring the Prevent download, copy, print action”
(Additional Data-at-Rest Actions): on page 1260.
Prevent download, copy, print

Cloud Applications and API appliance See “Configuring the Set File Access to 'Internal Read' action”
(Additional Data-at-Rest Actions): Set on page 1264.
File Access to 'Internal Read'

Cloud Applications and API appliance See “Configuring the Set File Access to 'Internal Edit'”
(Additional Data-at-Rest Actions): Set on page 1263.
File Access to 'Internal Edit'
 Responding to policy violations 1215
About response rule authoring privileges

Table 39-13 System-defined response rule execution priority (continued)

Execution priority Description

(from highest to lowest)

Cloud Applications and API appliance See “Configuring the Set Collaborator Access to 'Read' action”
(Additional Data-at-Rest Actions): Set on page 1262.
Collaborator Access to 'Read'

Cloud Applications and API appliance See “Configuring the Set Collaborator Access to 'Edit' action”
(Additional Data-at-Rest Actions): Set on page 1261.
Collaborator Access to 'Edit'

Cloud Applications and API appliance See “Configuring the Remove Collaborator Access action”
(Additional Data-at-Rest Actions): on page 1260.
Remove Collaborator Access

Cloud Applications and API appliance See “Configuring the Set Collaborator Access to 'Preview'
(Additional Data-at-Rest Actions): Set action” on page 1261.
Collaborator Access to 'Preview'

Cloud Applications and API appliance See “Configuring the Add two-factor authentication action”
(Data-in-Motion): Add two-factor on page 1264.
authentication

See “Implementing response rules” on page 1216.

See “Manage response rules” on page 1219.

About response rule authoring privileges

To manage and create response rules, you must be assigned to a role with response rule
authoring privileges. To add a response rule to a policy, you must have policy authoring
privileges.
See “Policy authoring privileges” on page 334.
For business reasons, you may want to grant response rule authoring and policy authoring
privileges to the same role. Or, you may want to keep these roles separate.
See “About recommended roles for your organization” on page 95.
If you log on to the system as a user without response rule authoring privileges, the Manage
> Policies > Response Rules screen is not available.
See “About role-based access control” on page 93.
 Responding to policy violations 1216
Implementing response rules

Implementing response rules

You define response rules independent of policies.
See “About response rules” on page 1199.
You must have response rule authoring privileges to create and manage response rules.
See “About response rule authoring privileges” on page 1215.

Table 39-14 Workflow for implementing policy response rules

Step Action Description

1 Review the available response rules. The Manage > Policies > Response Rules screen displays
all configured response rules.

See “Manage response rules” on page 1219.

The solution pack for your system provides configured

response rules. You can use these response rules in your
policies as they exist, or you can modify them.

See “Solution packs” on page 331.

2 Decide the type of response rule to Decide the type of response rules based on your business
implement: Smart, Automated, both. requirements.

See “About response rule execution types” on page 1208.

3 Determine the type of actions you want to See “About response rule conditions” on page 1210.
implement and any triggering conditions.
See “About response rule actions” on page 1199.

4 Understand the order of precedence among See “About response rule action execution priority”
response rule actions of different and the on page 1211.
same types.
See “Modifying response rule ordering” on page 1227.

5 Integrate the Enforce Server with an external Some response rules may require integration with external
system (if required for the response rule). systems.
These may include:

■ A SIEM system for the Log to a Syslog Server response

rule.
■ An SMTP email server for the Send Email Notification
response rule
■ A Web proxy host for Network Prevent for Web response
rules.
■ An MTA for Network Prevent for Email response rules.

6 Add a new response rule. See “Adding a new response rule” on page 1220.
 Responding to policy violations 1217
Response rule best practices

Table 39-14 Workflow for implementing policy response rules (continued)

Step Action Description

7 Configure response rules. See “Configuring response rules” on page 1221.

8 Configure one or more response rule See “Configuring response rule conditions” on page 1222.
conditions (optional).

9 Configure one or more response rule actions You must define at least one action for a valid response rule.
(required).
See “Configuring response rule actions” on page 1223.

The action executes when a policy violation is reported or

when a response rule condition is matched.

10 Add response rules to policies. You must have policy authoring privileges to add response
rules to policies.

See “Adding an automated response rule to a policy”

on page 405.

Response rule best practices

When implementing response rules, consider the following:
■ Response rules are not required for policy execution. In general it is best to implement and
fine-tune your policy rules and exceptions before you implement response rules. Once you
achieve the desired policy detection results, you can then implement and refine response
rules.
■ Response rules require at lease one rule action; a condition is optional. If you do not
implement a condition, the action always executes when an incident is reported. If you
configure more than one response rule condition, all conditions must match for the response
rule action to trigger.
See “About response rule actions” on page 1199.
■ Response rule conditions are derived from policy rules. Understand the type of rule and
exception conditions that the policy implements when you configure response rule conditions.
The system evaluates the response rule condition based on how the policy rule counts
matches.
See “Policy matching conditions” on page 349.
■ The system displays only the response rule name for policy authors to select when they
add response rules to policies. Be sure to provide a descriptive name that helps policy
authors identify the purpose of the response rule.
See “Configuring policies” on page 376.
 Responding to policy violations 1218
Response rule best practices

■ You cannot combine an Endpoint Prevent: Notify or Endpoint Prevent: Block response rule
action with EDM, IDM, or DGM detection methods. If you do, the system displays a warning
for the policy that it is misconfigured.
See “Manage and add policies” on page 395.
■ If you combine multiple response rules in a single policy, make sure that you understand
the order of precedence among response rules.
See “About response rule action execution priority” on page 1211.
■ Use Smart Response rules only where it is appropriate for human intervention.
See “About configuring Smart Response rules” on page 1222.
■ When sensitive files are encrypted using Symantec Information Centric Encryption, the
original file is replaced with an HTML file of the same name. You must update all existing
links and references so that they point to the new HTML file.
■ Microsoft SharePoint enables users to upload HTML files that are no larger than 256 MB
in size. To ensure that sensitive files in SharePoint can be encrypted successfully, do not
upload files that are 256 MB in size or greater.
See “Configuring the Server FlexResponse action” on page 1245.
■ If you configure multiple Server FlexResponse response rule actions for Microsoft SharePoint
scan targets, the response rule actions could be executed in order of response rule action
priority.
See “About response rule action execution priority” on page 1211.
 Chapter 40
Configuring and managing
response rules
This chapter includes the following topics:

■ Manage response rules

■ Adding a new response rule

■ Configuring response rules

■ About configuring Smart Response rules

■ Configuring response rule conditions

■ Configuring response rule actions

■ Modifying response rule ordering

■ About removing response rules

Manage response rules

The Manage > Policies > Response Rules screen is the home page for managing response
rules, and the starting point for adding new ones.
See “About response rules” on page 1199.
You must have response rule authoring privileges to manage and add response rules.
See “About response rule authoring privileges” on page 1215.
 Configuring and managing response rules 1220
Adding a new response rule

Table 40-1 Response Rules screen actions

Action Description

Add Response Rule Click Add Response Rule to define a new response rule.
See “Adding a new response rule” on page 1220.

Modify Response Rule Click Modify Response Rule Order to modify the response rule order of precedence.
Order
See “Modifying response rule ordering” on page 1227.

Edit an existing response Click the response rule to modify it.

rule
See “Configuring response rules” on page 1221.

Delete an existing response Click the red X icon next to the far right of the response rule to delete it.
rule
You must confirm the operation before deletion occurs.

See “About removing response rules” on page 1227.

Refresh the list Click the refresh arrow icon at the upper right of the Response Rules screen to fetch
the latest status of the rule.

Table 40-2 Response Rules screen display

Display column Description

Order The Order of precedence when more than one response rule is configured.

See “Modifying response rule ordering” on page 1227.

Rule The Name of the response rule.

See “Configuring response rules” on page 1221.

Actions The type of Action the response rule can take to respond to an incident (required).

See “Configuring response rule actions” on page 1223.

Conditions The Condition that triggers the response rule (if any).

See “Configuring response rule conditions” on page 1222.

See “Implementing response rules” on page 1216.

Adding a new response rule

Add a new response rule from the Manage > Policies > Response Rules > New Response
Rule screen.
See “About response rules” on page 1199.
 Configuring and managing response rules 1221
Configuring response rules

To add a new response rule

1 Click Add Response Rule at the Manage > Policies > Response Rules screen.
See “Manage response rules” on page 1219.
2 At the New Response Rule screen, select one of the following options:
■ Automated Response
The system automatically executes the response action as the server evaluates
incidents (default option).
See “About Automated Response rules” on page 1209.
■ Smart Response
An authorized user executes the response action from the Incident Snapshot screen
in the Enforce Server administration console.
See “About Smart Response rules” on page 1209.

3 Click Next to configure the response rule.

See “Configuring response rules” on page 1221.
See “Implementing response rules” on page 1216.

Configuring response rules

You configure response rules at the Manage > Policies > Response Rules > Configure
Response Rule screen.
See “About response rules” on page 1199.
To configure a response rule
1 Add a new response rule, or modify an existing one.
See “Adding a new response rule” on page 1220.
See “Manage response rules” on page 1219.
2 Enter a response Rule Name and Description.
3 Optionally, define one or more Conditions to dictate when the response rule executes.
See “Configuring response rule conditions” on page 1222.
If no condition is declared, the response rule action always executes when there is a
match (assuming that the detection rule is set the same).
Skip this step if you selected the Smart Response rule option.
See “About configuring Smart Response rules” on page 1222.
 Configuring and managing response rules 1222
About configuring Smart Response rules

4 Select and configure one or more Actions. You must define at least one action.
See “Configuring response rule actions” on page 1223.
5 Click Save to save the response rule definition.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

About configuring Smart Response rules

When implementing Smart Response rules, consider the following:
■ Smart Response rules are best suited for the incidents that warrant user review to determine
if any response action is required.
If you do not want user involvement in triggering a response rule action, use Automated
Response rules instead.
■ You cannot configure any triggering conditions with Smart Response rules.
Authorized users decide when a detection incident warrants a response.
■ You are limited in the actions you can take with Smart Response rules (note, log, email,
status).
If you need to block or modify an action, use Automated Response rules.
See “About Smart Response rules” on page 1209.
See “Implementing response rules” on page 1216.

Configuring response rule conditions

You can add one or more conditions to a response rule. An incident must meet all response
rule conditions before the system executes any response rule actions.
See “About response rule conditions” on page 1210.
To configure a response rule condition
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Click Add Condition to add a new condition.
Conditions are optional and based on detection rule matches. Each type of response rule
condition performs a different function.
See “About response rule conditions” on page 1210.
 Configuring and managing response rules 1223
Configuring response rule actions

3 Choose the condition type from the Conditions list.

See Table 39-12 on page 1210.
For example, select the condition Incident Match Count and Is Greater Than and enter
15 in the textbox. This condition triggers the response rule action after 15 policy violation
matches.
4 To add another condition, click Add Condition and repeat the process.
If all conditions do not match, no action is taken.
5 Click Save to save the condition.
Click Cancel to not save the condition and return to the previous screen.
Click the red X icon beside the condition to delete it from the response rule.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

Configuring response rule actions

You must configure at least one action for the response rule to be valid. You can configure
multiple response rule actions. Each action is evaluated independently.
See “Implementing response rules” on page 1216.
To define a response rule action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Choose an action type from the Actions list and click Add Action.
For example, add the All: Add Note action to the response rule. This action lets the
remediator annotate the incident.
3 Configure the action type by specifying the expected parameters for the chosen action
type.
See Table 40-3 on page 1224.
4 Repeat these steps for each action you want to add.
If you add additional actions, consider the execution order and possible modification of
similar types.
See “Modifying response rule ordering” on page 1227.
5 Click Save to save the response rule.
See “Manage response rules” on page 1219.
 Configuring and managing response rules 1224
Configuring response rule actions

Table 40-3 Configure a response rule action

Incident type Response rule Description

All Add Note See “Configuring the Add Note action” on page 1239.

All Limit Incident Data See “Configuring the Limit Incident Data Retention action” on page 1239.
Retention

All Log to a Syslog Server See “Configuring the Log to a Syslog Server action” on page 1242.

All Send Email Notification See “Configuring the Send Email Notification action” on page 1243.

All Server FlexResponse See “Configuring the Server FlexResponse action” on page 1245.

All Set Attribute See “Configuring the Set Attribute action” on page 1246.

All Set Status See “Configuring the Set Status action” on page 1247.

Cloud Storage Add Visual Tag See “Configuring the Cloud Storage: Add Visual Tag action”
on page 1252.

Cloud Storage Quarantine See “Configuring the Cloud Storage: Quarantine action” on page 1252.

Applications: Break Links in Data-at-Rest See “Configuring the Break Links in Data-at-Rest action” on page 1254.
Data-at-Rest
(DAR)

Applications: Custom Action on See “Configuring the Custom Action on Data-at-Rest action”
Data-at-Rest Data-at-Rest on page 1255.
(DAR)

Applications: Delete Data-at-Rest See “Configuring the Delete Data-at-Rest action” on page 1256.
Data-at-Rest
(DAR)

Applications: Encrypt Data-at-Rest See “Configuring the Encrypt Data-at-Rest action” on page 1257.
Data-at-Rest
(DAR)

Applications: Perform DRM on See “Configuring the Perform DRM on Data-at-Rest action”
Data-at-Rest Data-at-Rest on page 1257.
(DAR)

Applications: Quarantine Data-at-Rest See “Configuring the Quarantine Data-at-Rest action” on page 1258.
Data-at-Rest
(DAR)

Applications: Tag Data-at-Rest See “Configuring the Tag Data-at-Rest action” on page 1259.
Data-at-Rest
(DAR)
 Configuring and managing response rules 1225
Configuring response rule actions

Table 40-3 Configure a response rule action (continued)

Incident type Response rule Description

Applications: Add two-factor See “Configuring the Add two-factor authentication action” on page 1264.
Data-in-Motion authentication

Applications: Block Data-in-Motion See “Configuring the Block Data-in-Motion action” on page 1265.
Data-in-Motion
(DIM)

Applications: Custom Action on See “Configuring the Custom Action on Data-in-Motion action”
Data-in-Motion Data-in-Motion on page 1265.
(DIM)

Applications: Encrypt Data-in-Motion See “Configuring the Encrypt Data-in-Motion action” on page 1266.
Data-in-Motion
(DIM)

Applications: Perform DRM on See “Configuring the Perform DRM on Data-in-Motion action”
Data-in-Motion Data-in-Motion on page 1267.
(DIM)

Applications: Quarantine Data-in-Motion See “Configuring the Quarantine Data-in-Motion action” on page 1268.
Data-in-Motion
(DIM)

Applications: Redact Data-in-Motion See “Configuring the Redact Data-in-Motion action” on page 1268.
Data-in-Motion
(DIM)

Applications: Prevent download, copy, See “Configuring the Prevent download, copy, print action”
Data-at-Rest print on page 1260.
(DAR)

Applications: Remove Collaborator See “Configuring the Remove Collaborator Access action” on page 1260.
Data-at-Rest Access
(DAR)

Applications: Set Collaborator Access to See “Configuring the Set Collaborator Access to 'Edit' action”
Data-at-Rest 'Edit' on page 1261.
(DAR)

Applications: Set Collaborator Access to See “Configuring the Set Collaborator Access to 'Preview' action”
Data-at-Rest 'Preview' on page 1261.
(DAR)

Applications: Set Collaborator Access to See “Configuring the Set Collaborator Access to 'Read' action”
Data-at-Rest 'Read' on page 1262.
(DAR)
 Configuring and managing response rules 1226
Configuring response rule actions

Table 40-3 Configure a response rule action (continued)

Incident type Response rule Description

Applications: Set File Access to 'All Read' See “Configuring the Set File Access to 'All Read' action” on page 1262.
Data-at-Rest
(DAR)

Applications: Set File Access to 'Internal See “Configuring the Set File Access to 'Internal Edit'” on page 1263.
Data-at-Rest Edit'
(DAR)

Applications: Set File Access to 'Internal See “Configuring the Set File Access to 'Internal Read' action”
Data-at-Rest Read' on page 1264.
(DAR)

Endpoint FlexResponse See “Configuring the Endpoint: FlexResponse action” on page 1269.

Endpoint Quarantine File See “Configuring the Endpoint Discover: Quarantine File action”
Discover on page 1270.

Endpoint Prevent Block See “Configuring the Endpoint Prevent: Block action” on page 1272.

Endpoint Prevent Encrypt See “Configuring the Endpoint Prevent: Encrypt action” on page 1275.

Endpoint Prevent Notify See “Configuring the Endpoint Prevent: Notify action” on page 1279.

Endpoint Prevent User Cancel See “Configuring the Endpoint Prevent: User Cancel action”
on page 1282.

Network Prevent Block FTP Request See “Configuring the Network Prevent for Web: Block FTP Request
for Web action” on page 1285.

Network Prevent Block HTTP/S See “Configuring the Network Prevent for Web: Block HTTP/S action”
for Web on page 1285.

Network Prevent Block SMTP Message See “Configuring the Network Prevent: Block SMTP Message action”
for Email on page 1286.

Network Prevent Modify SMTP Message See “Configuring the Network Prevent: Modify SMTP Message action”
for Email on page 1287.

Network Prevent Remove HTTP/S Content See “Configuring the Network Prevent for Web: Remove HTTP/S
for Web Content action” on page 1288.

Network Protect Copy File See “Configuring the Network Protect: Copy File action” on page 1290.

Network Protect Quarantine File See “Configuring the Network Protect: Quarantine File action”
on page 1290.

Network Protect Encrypt File See “Configuring the Network Protect: Encrypt File action” on page 1292.
 Configuring and managing response rules 1227
Modifying response rule ordering

See “Implementing response rules” on page 1216.

Modifying response rule ordering

You cannot change the system-defined execution priority for different types of response rule
actions. But, you can modify the order of execution for response rule actions of the same type
with conflicting instructions.
See “About response rule action execution priority” on page 1211.
For example, consider a scenario where you include two response rules in a policy. Each
response rule implements a Limit Incident Data Retention action. One action discards all
attachments and the other action discards only those attachments that are not violations. In
this case, when the policy is violated, the detection server looks to the response rule order
priority to determine which action takes precedence. This type of ordering is configurable.
To modify response rule action ordering
1 Navigate to the Manage > Policies > Response Rules screen.
See “Manage response rules” on page 1219.
2 Note the Order column and number beside each configured response rule.
By default the system sorts the list of response rules by the Order column in descending
order from highest priority (1) to lowest. Initially the system orders the response rules in
the order they are created. You can modify this order.
3 To enable modification mode, click Modify Response Rule Order.
The Order column now displays a drop-down menu for each response rule.
4 To modify the ordering, for each response rule you want to reorder, select the desired
order priority from the drop-down menu.
For example, for a response rule with order priority of 2, you can modify it to be 1 (highest
priority).
Modifying an order number moves that response rule to its modified position in the list
and updates all other response rules.
5 Click Save to save the modifications to the response rule ordering.
6 Repeat these steps as necessary to achieve the desired results.
See “Implementing response rules” on page 1216.

About removing response rules

You can delete response rules at the Manage > Policies > Response Rules screen.
 Configuring and managing response rules 1228
About removing response rules

See “Manage response rules” on page 1219.

When deleting a response rule, consider the following:
■ A user must have response rule authoring privileges to delete an existing response rule.
■ A response rule author cannot delete an existing response rule while another user modifies
it.
■ A response rule author cannot delete a response rule if a policy declares that response
rule. In this case you must remove the response rule from all policies that declare the
response rule before you can delete it.
 Chapter 41
Response rule conditions
This chapter includes the following topics:

■ Configuring the Endpoint Location response condition

■ Configuring the Endpoint Device response condition

■ Configuring the Incident Type response condition

■ Configuring the Incident Match Count response condition

■ Configuring the Protocol or Endpoint Monitoring response condition

■ Configuring the Severity response condition

Configuring the Endpoint Location response condition

The Endpoint Location condition triggers response rule action based on the connection status
of the DLP Agent when an endpoint policy is violated.
See “About response rule conditions” on page 1210.

Note: This condition is specific to endpoint incidents. You should not implement this condition
for Network or Discover incidents. If you do the response rule action does not to execute.
 Response rule conditions 1230
Configuring the Endpoint Device response condition

To configure the Endpoint Location condition

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Select the Endpoint Location condition from the Conditions list.
See “Configuring response rule conditions” on page 1222.
3 Select the endpoint location requirements to trigger actions.
See Table 41-1 on page 1230.

Table 41-1 Endpoint Location condition options

Qualifier Condition Description

Is Any Of Off the corporate This combination triggers a response rule action if an incident occurs when the
network endpoint is off the corporate network.

Is None Of Off the corporate This combination does not trigger a response rule action if an incident occurs
network when the endpoint is off the corporate network.

Is Any Of On the corporate This combination triggers a response rule action if an incident occurs when the
network endpoint is on the corporate network.

Is None Of On the corporate This combination does not trigger a response rule action if an incident occurs
network when the endpoint is on the corporate network.

See “Implementing response rules” on page 1216.

See “Manage response rules” on page 1219.

Configuring the Endpoint Device response condition

The Endpoint Device condition triggers response rule action when an incident is detected from
one or more configured endpoint devices.
See “About response rule conditions” on page 1210.
You configure endpoint devices at the System > Agents > Endpoint Devices screen.
See “About endpoint device detection” on page 729.

Note: This condition is specific to endpoint incidents. You should not implement this condition
for Network or Discover incidents. If you do the response rule action does not to execute.
 Response rule conditions 1231
Configuring the Incident Type response condition

To configure the Endpoint Device response condition

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Select the Endpoint Device condition from the Conditions list.
See “Configuring response rule conditions” on page 1222.
3 Select to detect or except specific endpoint devices.
See Table 41-2 on page 1231.

Table 41-2 Endpoint Device condition parameters

Qualifier Condition Description

Is Any Of Configured Triggers a response rule action when an incident is detected on a configured
device endpoint device.

Is None Of Configured Does not trigger (excludes from executing) a response rule action when an incident
device is detected on a configured endpoint device.

See “Implementing response rules” on page 1216.

See “Manage response rules” on page 1219.

Configuring the Incident Type response condition

The Incident Type condition triggers a response rule action based on the type of detection
server that reports the incident.
See “About response rule conditions” on page 1210.
To configure the Incident Type condition
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Choose the Incident Type condition from the Conditions list.
See “Configuring response rule conditions” on page 1222.
3 Select one or more incident types.
Use the Ctrl key to select multiple types.
See Table 41-3 on page 1232.
 Response rule conditions 1232
Configuring the Incident Match Count response condition

Table 41-3 Incident Type condition parameters

Parameter Server Description

Is Any Of Cloud Service Triggers a response rule action for any incident detected by the Cloud Service
Connector or API Connector or API Detection for Developer Apps Appliance.
Detection for
Is None Of Developer Apps Does not trigger a response rule action for any incident detected by the Cloud
Appliance Service Connector or API Detection for Developer Apps Appliance.

Is Any Of Discover Triggers a response rule action for any incident that Network Discover detects.

Is None Of Does not trigger a response rule action for any incident that Network Discover
detects.

Is Any Of Endpoint Triggers a response rule action for any incident that Endpoint Prevent detects.

Is None Of Does not trigger a response rule action for any incident that Endpoint Prevent
detects.

Is Any Of Network Triggers a response rule action for any incident that Network Prevent detects.

Is None Of Does not trigger a response rule action for any incident that Network Prevent
detects.

See “Implementing response rules” on page 1216.

See “Manage response rules” on page 1219.

Configuring the Incident Match Count response

condition
The Incident Match Count condition triggers a response rule action based on the number of
policy violations reported.
See “About response rule conditions” on page 1210.
 Response rule conditions 1233
Configuring the Protocol or Endpoint Monitoring response condition

To configure the Incident Match Count condition

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Choose the Incident Match Count condition from the Conditions list.
See “Configuring response rule conditions” on page 1222.
3 In the text field, enter a numeric value that indicates the threshold above which you want
the response rule to trigger.
For example, if you enter 15 the response rule triggers after 15 policy violations have
been detected.
See Table 41-4 on page 1233.

Table 41-4 Incident Match Count condition options

Parameter Input Description

Is Greater Than User-specified Triggers a response rule action if the threshold number of incidents is
number eclipsed.

Is Greater Than or User-specified Triggers a response rule action if the threshold number of incidents is met
Equals number or eclipsed.

Is Between User-specified pair of Triggers a response rule action when the number of incidents is between
numbers the range of numbers specified.

Is Less Than User-specified Triggers a response rule action if the number of incidents is less than the
number specified number.

Is Less Than or User-specified Triggers a response rule action when the number of incidents is equal to
Equals number or less than the specified number.

See “Implementing response rules” on page 1216.

See “Manage response rules” on page 1219.

Configuring the Protocol or Endpoint Monitoring

response condition
The Protocol or Endpoint Monitoring condition triggers action based on the protocol or the
endpoint destination, device, or application where the policy violation occurred.
See “About response rule conditions” on page 1210.
 Response rule conditions 1234
Configuring the Protocol or Endpoint Monitoring response condition

To configure the Protocol or Endpoint Monitoring condition

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Choose the Protocol or Endpoint Monitoring condition from the Conditions list.
See “Configuring response rule conditions” on page 1222.
3 Use the Ctrl key to select multiple, or use the Shift key to select a range.
See Table 41-5 on page 1234.
The system lists any additional network protocols that you configure at the System >
Settings > Protocols screen.

Table 41-5 Protocol or Endpoint Destination condition options

Qualifier Condition Description

Is Any Of Triggers an action if an endpoint application file has been accessed.

Endpoint Application File
Is None Of Access Does not trigger action if an endpoint application file has been
accessed.

Is Any Of Triggers an action if an endpoint CD/DVD has been written to.

Endpoint CD/DVD
Is None Of Does not trigger action if an endpoint CD/DVD has been written to.

Is Any Of Triggers an action if the endpoint clipboard has been copied or pasted
to.
Endpoint Clipboard
Is None Of Does not trigger action if the endpoint clipboard has been copied or
pasted to.

Is Any Of Triggers an action if sensitive information is copied to or from a network

share.
Endpoint Copy to
Network Share
Is None Of Does not trigger action if sensitive information is copied to or from a
network share.

Is Any Of Triggers an action if sensitive files are discovered on the local drive.
Endpoint Local Drive
Is None Of Does not trigger action if sensitive files are discovered on the local
drive.

Is Any Of Triggers an action if an endpoint printer or fax has been sent to.
Endpoint Printer/Fax
Is None Of Does not trigger action if an endpoint printer or fax has been sent to.
 Response rule conditions 1235
Configuring the Severity response condition

Table 41-5 Protocol or Endpoint Destination condition options (continued)

Qualifier Condition Description

Is Any Of Triggers an action if sensitive data is copied to a removable storage

device.
Endpoint Removable
Storage Device
Is None Of Does not trigger action if sensitive data is copied to a removable storage
device.

Is Any Of Triggers an action if sensitive data is copied through FTP.

FTP
Is None Of Does not trigger action if sensitive data is copied through FTP.

Is Any Of Triggers an action if sensitive data is sent through HTTP.

HTTP
Is None Of Does not trigger action if sensitive data is sent through HTTP.

Is Any Of Triggers an action if sensitive data is sent through HTTPS.

HTTPS
Is None Of Does not trigger action if sensitive data is sent through HTTPS.

Is Any Of Triggers an action if sensitive data is sent through AIM.

IM:AIM
Is None Of Does not trigger action if sensitive data is sent through AIM.

Is Any Of Triggers an action if sensitive data is sent through MSN.

IM:MSN
Is None Of Does not trigger action if sensitive data is sent through MSN.

Is Any Of Triggers an action if sensitive data is sent through Yahoo IM.

IM:Yahoo
Is None Of Does not trigger action if sensitive data is sent through Yahoo IM.

Is Any Of Triggers an action if sensitive data is sent through NNTP.

NNTP
Is None Of Does not trigger action if sensitive data is sent through NNTP.

Is Any Of Triggers an action if sensitive data is sent through SMTP.

SMTP
Is None Of Does not trigger action if sensitive data is sent through SMTP.

See “Implementing response rules” on page 1216.

See “Manage response rules” on page 1219.

Configuring the Severity response condition

The Severity condition triggers a response rule action based on the severity of the policy rule
violation.
 Response rule conditions 1236
Configuring the Severity response condition

See “About response rule conditions” on page 1210.

To configure the Severity condition
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Select the Severity condition from the Conditions list.
See “Configuring response rule conditions” on page 1222.
3 Select one or more severity levels.
Use the Ctrl key to select multiple; use the Shift key to select a range.
See Table 41-6 on page 1236.

Table 41-6 Severity condition matches

Parameter Severity Description

Is Any Of High Triggers a response rule action when a detection rule with
severity set to high is matched.

Is None Of High Does not trigger a response rule action when a detection rule
with severity set to high is matched.

Is Any Of Medium Triggers a response rule action when a detection rule with
severity set to medium is matched.

Is None Of Medium Does not trigger a response rule action when a detection rule
with severity set to medium is matched.

Is Any Of Low Triggers a response rule action when a detection rule with
severity set to low is matched.

Is None Of Low Does not trigger a response rule action when a detection rule
with severity set to low is matched.

Is Any Of Info Triggers a response rule action when a detection rule with
severity set to info is matched.

Is None Of Info Does not trigger a response rule action when a detection rule
with severity set to info is matched.

See “Implementing response rules” on page 1216.

See “Manage response rules” on page 1219.
 Chapter 42
Response rule actions
This chapter includes the following topics:

■ Configuring the Add Note action

■ Configuring the Limit Incident Data Retention action

■ Configuring the Log to a Syslog Server action

■ Configuring the Send Email Notification action

■ Configuring the Server FlexResponse action

■ Configuring the Set Attribute action

■ Configuring the Set Status action

■ Configuring the Classify Enterprise Vault Content response action

■ Configuring the Cloud Storage: Add Visual Tag action

■ Configuring the Cloud Storage: Quarantine action

■ Configuring the Quarantine Smart Response action

■ Configuring the Restore File Smart Response action

■ Configuring the Break Links in Data-at-Rest action

■ Configuring the Custom Action on Data-at-Rest action

■ Configuring the Delete Data-at-Rest action

■ Configuring the Encrypt Data-at-Rest action

■ Configuring the Perform DRM on Data-at-Rest action

■ Configuring the Quarantine Data-at-Rest action

 Response rule actions 1238

■ Configuring the Tag Data-at-Rest action

■ Configuring the Prevent download, copy, print action

■ Configuring the Remove Collaborator Access action

■ Configuring the Set Collaborator Access to 'Edit' action

■ Configuring the Set Collaborator Access to 'Preview' action

■ Configuring the Set Collaborator Access to 'Read' action

■ Configuring the Set File Access to 'All Read' action

■ Configuring the Set File Access to 'Internal Edit'

■ Configuring the Set File Access to 'Internal Read' action

■ Configuring the Add two-factor authentication action

■ Configuring the Block Data-in-Motion action

■ Configuring the Custom Action on Data-in-Motion action

■ Configuring the Encrypt Data-in-Motion action

■ Configuring the Perform DRM on Data-in-Motion action

■ Configuring the Quarantine Data-in-Motion action

■ Configuring the Redact Data-in-Motion action

■ Configuring the Endpoint: FlexResponse action

■ Configuring the Endpoint Discover: Quarantine File action

■ Configuring the Endpoint Prevent: Block action

■ Configuring the Endpoint Prevent: Encrypt action

■ Configuring the Endpoint Prevent: Notify action

■ Configuring the Endpoint Prevent: User Cancel action

■ Configuring the Network Prevent for Web: Block FTP Request action

■ Configuring the Network Prevent for Web: Block HTTP/S action

■ Configuring the Network Prevent: Block SMTP Message action

■ Configuring the Network Prevent: Modify SMTP Message action

■ Configuring the Network Prevent for Web: Remove HTTP/S Content action
 Response rule actions 1239
Configuring the Add Note action

■ Configuring the Network Protect: Copy File action

■ Configuring the Network Protect: Quarantine File action

■ Configuring the Network Protect: Encrypt File action

Configuring the Add Note action

The Add Note response rule action lets an incident responder enter a note about a particular
incident. For example, if a policy violation occurs, the system presents the incident responder
with a Note dialog that the responder can annotate.
See “About response rule actions” on page 1199.
The Add Note response rule action is available for all types of detection servers.
See “Response rule actions for all detection servers” on page 1200.
To configure the Add Note action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the All: Add Note action type from the Actions list.
The system displays a Note field. Generally you leave the field blank and allow remediators
to add comments when they evaluate incidents. However, you can add comments at this
level of configuration as well.
See “Configuring response rule actions” on page 1223.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

Configuring the Limit Incident Data Retention action

The Limit Incident Data Retention response rule action lets you modify the default incident
data retention behavior of the detection server.
See “About response rule actions” on page 1199.
This response rule is available for all types of detection servers.
See “Response rule actions for all detection servers” on page 1200.
 Response rule actions 1240
Configuring the Limit Incident Data Retention action

To configure incident data retention

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the action type All: Limit Incident Data Retention from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Choose to retain Endpoint Incident data by selecting this option.
By default, the agent discards the original message and any attachments for endpoint
incidents.
See “Retaining data for endpoint incidents” on page 1240.
4 Choose to discard Network Incident data by selecting this option.
By default, the system retains the original message and any attachments for network
incidents.
See “Discarding data for network incidents” on page 1241.
5 Click Save to save the response rule configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

Retaining data for endpoint incidents

By default, the system discards original messages (including files and attachments) for endpoint
incidents. You can implement the Limit Incident Data Retention response rule action to override
this default behavior and retain original email attachments for endpoint incidents.

Note: Limit Incident Data Retention does not apply to Endpoint Print or Clipboard incidents.

See “Configuring the Limit Incident Data Retention action” on page 1239.

Table 42-1 Retaining data for endpoint incidents

Parameter Description

All Endpoint Incidents Check this option to retain the original file attachments for Endpoint Prevent
incidents and incidents Endpoint Discover captures using an endpoint target.
(including Endpoint Discover
incidents)

If you combine a server-side detection rule (EDM/IDM/DGM) with a Limit Incident Data Retention
response rule action on the endpoint, consider the network bandwidth implications. When an
Endpoint Agent sends content to an Endpoint Server for analysis, it sends text or binary data
 Response rule actions 1241
Configuring the Limit Incident Data Retention action

according to detection requirements. If possible, Symantec DLP Agents send text to reduce
bandwidth use. When you retain the original messages for endpoint incidents, in every case
the system requires agents to send binary data to the Endpoint Server. As such, make sure
that your network can handle the increased traffic between Endpoint Agents and Endpoint
Servers without degrading performance.
See “Two-tier detection for DLP Agents” on page 358.
Consider the system behavior for any policies that combine an agent-side detection rule (any
DCM rule, such as a keyword rule). If you implement the Limit Incident Data Retention response
rule action, the increased use bandwidth depends on the number of incidents the detection
engine matches. For such policies, the Endpoint Agent does not send all original files to the
Endpoint Server, but only those associated with confirmed incidents. If there are not many
incidents, the effect is small.

Discarding data for network incidents

For network incidents, by default the detection server retains the original message and any
attachments that trigger an incident.
You can implement the Limit Incident Data Retention response rule action to override the
default behavior and discard original messages and some or all attachments.
See “Configuring the Limit Incident Data Retention action” on page 1239.

Note: The default data retention behavior for network incidents applies to Network Prevent for
Web and Network Prevent for Email incidents. The default behavior does not apply to Network
Discover incidents. For Network Discover incidents, the system provides a link in the Incident
Snapshot that points to the offending file at its original location. Incident data retention for
Network Discover is not configurable.

Table 42-2 Discarding data from network incidents

Parameter Description

Discard Original Check this option to discard the original message.

Message
Use this configuration to save disk space when you are only interested in statistical data.

Discard Attachment Select All to discard all message attachments.

Select Attachments with no Violations to save only relevant message attachments, that is,
those that trigger a policy violation.
Note: You must select something other than None for this action option. If you leave None
selected and do not check the box next to Discard Original Message, the action has no effect.
Such a configuration duplicates the default incident data retention behavior for network servers.
 Response rule actions 1242
Configuring the Log to a Syslog Server action

Configuring the Log to a Syslog Server action

The Log to a Syslog Server response rule action logs the incident to a syslog server. These
logs can be useful if you use a security information and events management (SIEM) system.
See “About response rule actions” on page 1199.
This response rule action is available for all types of detection servers.
See “Response rule actions for all detection servers” on page 1200.

Note: You use this response rule in conjunction with a syslog server. See “Enabling a syslog
server” on page 159.

To configure the Log to a Syslog Server response rule action

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Log to a Syslog Server action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Enter the Host name of the syslog server.
4 Edit the Port for the syslog server, if necessary.
The default port is 514.
5 Enter the text of the Message to log on the syslog server.
You can include response action variables in your syslog server messages.
See “Response action variables” on page 1300.

6 Select the Level to apply to the log message from the drop-down list.
The following options are available:
■ 0 - Kernel panic
■ 1 - Needs immediate attention
■ 2 - Critical condition
■ 3 - Error
■ 4 - Warning
■ 5 - May need attention
■ 6 - Informational
 Response rule actions 1243
Configuring the Send Email Notification action

■ 7- Debugging

7 Save the response rule.

See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

Configuring the Send Email Notification action

The Send Email Notification action enables you to compose an email and send it to recipients
you specify.
See “About response rule actions” on page 1199.
This response rule action is available for all types of detection servers.
See “Response rule actions for all detection servers” on page 1200.
You must integrate the Enforce Server with an SMTP email server to implement this response
rule action.
See “Configuring the Enforce Server to send email alerts” on page 161.
To configure the Send Email Notification response rule action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the All: Send Email Notification action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Configure the recipient(s), sender, format, incident inclusion, and messages per day.
See Table 42-3 on page 1243.
4 Configure the Notification Content of the email notification: language, subject, body.
See Table 42-4 on page 1244.
5 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-3 Sender and recipient information

Parameter Description

To: Sender Select this option to send the email notification to the email sender. This recipient only applies
to email message violations.
 Response rule actions 1244
Configuring the Send Email Notification action

Table 42-3 Sender and recipient information (continued)

Parameter Description

To: Data Owner Select this option to send email notification to the data owner that the system identifies by email
address in the incident.

See “Discover incident snapshot” on page 1335.

To: Other Email This option can include any custom attributes designated as email addresses (such as
Address "manager@email"). For example, if you define a custom attribute that is an email address, or
retrieve one via a lookup plug-in, that address will appear in the "To" field for selection, to the
right of "To: Sender" and "To: Data Owner."

See “Configuring custom attributes” on page 1418.

Custom To Enter one or more specific email addresses separated by commas.

CC Enter one or more specific email addresses separated by commas for people you want to copy
on the notification.

Custom From You can specify the sender of the message.

If this field is blank, the message appears to come from the system email address.

Notification Format Select either HTML or plain-text format.

Include Original Select this option to include the message that generated the incident with the notification email.
Message

Max Per Day Enter a number to restrict the maximum number of notifications that the system sends in a day.

Table 42-4 Notification content

Parameter Description

Language Select the language for the message from the drop-down menu.

Add Language Click the icon to add multiple language(s) for the message.

See “About Endpoint Prevent response rules in different locales” on page 1753.

Subject Enter a subject for the message that indicates what the message is about.

Body Enter the body of the message.

 Response rule actions 1245
Configuring the Server FlexResponse action

Table 42-4 Notification content (continued)

Parameter Description

Insert Variables You can add one or more variables to the subject or body of the email message by selecting
the desired value(s) from the Insert Variables list.

Variables can be used to include the file name, policy name, recipients, and sender in both the
subject and the body of the email message. For example, to include the policy and rules violated,
you would insert the following variables.

A message has violated the following rules in $POLICY$: $RULES$

See “Response action variables” on page 1300.

See “Implementing response rules” on page 1216.

Configuring the Server FlexResponse action

The All: Server FlexResponse action enables you to remediate any incident type using a
custom, server-side FlexResponse plug-in. You can configure a Server FlexResponse response
action for either automated response rules or smart response rules.
The All: Server FlexResponse action is available only if you have licensed Network Protect
and you have deployed one or more Server FlexResponse plug-ins to Symantec Data Loss
Prevention.
See “Deploying a Server FlexResponse plug-in” on page 1586.
To configure a Server FlexResponse action
1 Log on to the Enforce Server administration console.
2 Create a new Response Rule for each custom Server FlexResponse plug-in.
Click Manage > Policies > Response Rules.
3 Click Add Response Rule.
4 Select either Automated Response or Smart Response. Click Next.
5 Enter a name for the rule in the Rule Name field. (For Smart Response rules, this name
appears as the label on the button that incident responders select during remediation.)
6 Enter an optional description for the rule in the Description field.
7 In the Actions (executed in the order shown) menu, select the action All: Server
FlexResponse.
8 Click Add Action.
 Response rule actions 1246
Configuring the Set Attribute action

9 In the FlexResponse Plugin menu, select a deployed Server FlexResponse plug-in to

execute with this Response Rule action.
The name that appears in this drop-down menu is the value specified in the display-name
property from either the configuration properties file or the plug-in metadata class.
See “Deploying a Server FlexResponse plug-in” on page 1586.

Note: If you have installed the Network Protect ICE license and configured the Enforce
Server to connect to the Symantec ICE Cloud, you can use the SharePoint Encrypt
response rule action which is made available through a Server FlexResponse plug-in for
encryption that is installed automatically with Symantec Data Loss Prevention. No additional
configuration or customization is required for the encryption plug-in.

10 Click Save.
11 Repeat this procedure, adding a Response Rule for any additional Server FlexResponse
plug-ins that you have deployed.

Configuring the Set Attribute action

The Set Attribute response rule action sets the incident status to the specified value.
See “About response rule actions” on page 1199.
This response rule action is available for all detection servers.
See “Response rule actions for all detection servers” on page 1200.
The Set Attribute action is based on custom attributes you define at the System > Incident
Data > Attributes screen.
See “About custom attributes” on page 1416.
To configure the Set Attribute action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the All: Set Attribute action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Select the Attribute from the drop-down list (if more than one custom attribute is defined).
4 Enter an incident status Value for the selected custom attribute.
5 Click Save to save the configuration.
See “Manage response rules” on page 1219.
 Response rule actions 1247
Configuring the Set Status action

See “Implementing response rules” on page 1216.

Configuring the Set Status action

The Set Status response rule action sets the incident status to the specified value.
See “About response rule actions” on page 1199.
This response rule is available for all detection servers.
See “Response rule actions for all detection servers” on page 1200.
This response rule action is based on the incident Status Values you configure at the System
> Incident Data > Attributes screen.
See “About incident status attributes” on page 1410.
To configure the Set Status response rule action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the All: Set Status action type from the Actions list.
3 See “Configuring response rule actions” on page 1223.
4 Select the Status to assign to the incident from the list.
The following are some example incident statuses you might configure and select from:
■ New
■ Escalated
■ Investigation
■ Resolved
■ Dismissed

5 Click Save to save the configuration.

See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

Configuring the Classify Enterprise Vault Content

response action
The Classification: Classify Enterprise Vault Content response rule defines the classification
result tags that the Classification Server generates for an Exchange message that matches a
detection policy. The Classification Server delivers the retention category and classification
 Response rule actions 1248
Configuring the Classify Enterprise Vault Content response action

tag to the Data Classification for Enterprise Vault filter that posted the Exchange message for
detection. The classification tag always corresponds to the name of the policy that triggers the
response rule action.
Symantec Enterprise Vault for Microsoft Exchange can then use the retention category and
classification tag to perform archiving, delete messages, or flag the message for compliance
reviews or E-Discovery searches.
To configure the Classify Enterprise Vault Content response rule action
1 Configure a response rule at the Configure Response Rule screen (Manage > Response
Rules).
See “Configuring response rules” on page 1221.
2 Add the Classification: Classify Enterprise Vault Content action type from the Actions
list.
See “Configuring response rule actions” on page 1223.
3 Configure the parameters to classify the Enterprise Vault message.
See Table 42-5 on page 1248.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-5 Classification: Classify Enterprise Vault Content parameters

Parameter Description

Archive and Select this option to indicate that Symantec Enterprise Vault should archive the message
classify that matched the detection rule. If you select this option, also use the Assign retention
message category menu to specify the retention category that Enterprise Vault assigns.
 Response rule actions 1249
Configuring the Classify Enterprise Vault Content response action

Table 42-5 Classification: Classify Enterprise Vault Content parameters (continued)

Parameter Description

Assign retention The Assign retention category menu lists all of the retention categories that you have
category configured for use with the Data Classification for Enterprise Vault solution. If you
configure the response rule to archive a message, also select the appropriate retention
category from this menu.

You should configure the retention category names in this menu to match those
categories that are available on Enterprise Vault servers.

See “Configuring the retention categories that are available for classification”
on page 1250.

If you select Do not override retention category, the Classification Server

communicates to Enterprise Vault that no retention category has been assigned.
Enterprise Vault uses the retention category that is already available with the message
and applies it during the archiving process.

When you configure a response rule, if you do not select the classification type of
response rule, then Enterprise Vault cannot receive any response from the Symantec
Enterprise Vault Data Classification Services. Enterprise Vault applies the retention
category that is already available on the message. If the associated policy was running
in test mode, the incident is created, but Enterprise Vault does not receive any response
from the Classification Server. Not even test mode logs on Enterprise Vault are updated.

Compliance If you configure the response rule to archive the message, you can also select Prioritize
review messages for compliance review to prioritize the message for review. The Discovery
Accelerator and Compliance Accelerator products can use this classification tag to
filter messages during searches or audits.
When you select this option, two additional choices are presented:

■ Include in review—Includes the message in subsequent searches and audits.

■ Exclude from review—Excludes the message from subsequent searches and
audits.

See the Discovery Accelerator and Compliance Accelerator documentation for more
information about searching and auditing messages in Enterprise Vault.
 Response rule actions 1250
Configuring the Classify Enterprise Vault Content response action

Table 42-5 Classification: Classify Enterprise Vault Content parameters (continued)

Parameter Description

Do not archive Choose this option to indicate that Symantec Enterprise Vault should not archive the
message message that matched the detection rule.
When you select this option, the following choices are presented to specify the way in
which Enterprise Vault should discard the message:

■ Delete message immediately and permanently—Enterprise Vault should delete

the message immediately.
■ Move message to Deleted Items folder—Enterprise Vault should move the
message to the Deleted Items folder. The message may be deleted at a later time
when the folder is emptied.
■ Leave message in mailbox—Enterprise Vault should leave the message in the
mailbox and mark it as “Do not archive.”
If you select this option but later decide to clear the “Do Not Archive” property on
messages, you can do so by setting the ClearDoNotArchive and
ClearDoNotJournal registry values on the Enterprise Vault server. See the
Enterprise Vault Registry Values manual for instructions. These values permit the
Exchange mailbox and Exchange Journaling tasks to archive the messages.

Note: When you monitor a Journal mailbox, you may see messages marked as "Do
not archive" in the journal Inbox and in the Deleted items folder. Messages that are
marked as "Do not archive" are not automatically re-located. You can manually move
the messages into the deleted items folder.

See “About response rule actions” on page 1199.

See “Implementing response rules” on page 1216.

Configuring the retention categories that are available for

classification
The Classification: Classify Enterprise Vault Content response rule defines the classification
result tags that a Classification Server generates for an Exchange message that matches a
detection policy. If you configure this response rule to perform the Archive and classify
message action, you also specify the retention category that Enterprise Vault should apply to
the archived message. The list of available retention categories that is shown in the Enforce
Server administration console is defined using a configuration file,
RetentionCategories.config.

See “Configuring the Classify Enterprise Vault Content response action” on page 1247.
When you first install the Data Classification Services solution, you must create a
RetentionCategories.config file to include the retention categories that are available in
Enterprise Vault servers. If you change the retention categories that are available in an
 Response rule actions 1251
Configuring the Classify Enterprise Vault Content response action

Enterprise Vault deployment, you should also manually change the available categories that
are defined in RetentionCategories.config.

Note: The RetentionCategories.config file supports UTF-8 character encoding without byte
order markers (BOM).

To configure the retention categories that are available for classification

1 One each Enterprise Vault server, run the ExportRetentionCategories.exe command-line
utility that is installed in the Enterprise Vault program folder. (To display usage instructions,
execute the utility without supplying any command-line options). You must open the
command-line utility from a user with administrator privileges
2 Follow the on-screen instructions to generate a file that lists the retention categories
available in the Enterprise Vault server. The following retention categories are always
excluded from the file:
■ The retention categories for managed folders.
■ For English deployments, any retention category with the name <Do not override
retention category> does not apply a new retention category. Instead, a retention
category that is already available for the message is applied during the archiving
process.
Keep in mind that hidden retention categories are included in the resulting file.
3 Repeat steps 1 and 2 for each Enterprise Vault server in your deployment.
4 If you generated files for multiple Enterprise Vault servers, use a text editor to merge the
contents of each file into a single file.
5 Rename the file that contains all retention categories to RetentionCategories.config.
6 Log on to the Enforce Server computer using Administrator or superuser privileges.
7 Copy the RetentionCategories.config file that you created to the config subdirectory
of the Symantec Data Loss Prevention product installation directory. The default directory
is c:\SymantecDLP\Protect\config.
8 Restart the Enforce Server to apply the changes.
See “Server controls” on page 211.
See the Symantec Data Loss Prevention Administration Guide for information about
starting and stopping Symantec Data Loss Prevention services.
 Response rule actions 1252
Configuring the Cloud Storage: Add Visual Tag action

Configuring the Cloud Storage: Add Visual Tag action

The Add Visual Tag rule action lets an incident responder apply visual tags as metadata to
sensitive content stored in your Box cloud storage target. The visual tag helps your Box cloud
storage users search for and self-remediate sensitive data. For example, you might want the
tag to read "This content is considered confidential." You can also remind them of additional
security features of Box, such as adding password protection to any download links.
To configure the Cloud Storage: Add Visual Tag action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Cloud Storage: Add Visual Tag action type from the Actions list.
The system displays the Add Visual Tag field. Enter the text you want to display in the
tag for your users.
See “Configuring response rule actions” on page 1223.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

Configuring the Cloud Storage: Quarantine action

The Cloud Storage: Quarantine response rule action quarantines content that the detection
server identifies as sensitive or protected.
To configure the Cloud Storage: Quarantine action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Cloud Storage: Quarantine action type from the Actions list.
The system displays the Cloud Storage: Quarantine field.
See “Configuring response rule actions” on page 1223.
3 Configure the Cloud Storage: Quarantine parameters.
See Table 42-6 on page 1253.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.
 Response rule actions 1253
Configuring the Quarantine Smart Response action

Table 42-6 Cloud Storage: Quarantine File configuration parameters

Parameter Description

Marker File Select Leave marker file in place of remediated file to create a marker text file to replace the original
file. This action notifies the user what happened to the file instead of quarantining or deleting the file
without any explanation.
Note: The marker file is the same type and has the same name as the original file, as long as it is a
text file. An example of such a file type is Microsoft Word. If the original file is a PDF or image file, the
system creates a plain text marker file. The system then gives the file the same name as the original
file with .txt appended to the end. For example, if the original file name is accounts.pdf, the marker file
name is accounts.pdf.txt.

Marker Specify the text to appear in the marker file. If you selected the option to leave the marker file in place
Text of the remediated file, you can use variables in the marker text.

To specify marker text, select the variable from the Insert Variable list.

For example, for Marker Text you might enter:

A message has violated the following rules in $POLICY$: $RULES

Or, you might enter:

$FILE_NAME$ has been moved to $QUARANTINE_PARENT_PATH$

Add visual Select this option to add a visual tag to the marker file. The visual tag helps your Box cloud storage
tag to users search for marker files for quarantined sensitive data
marker file

Tags Enter the visual tag text in this field.

See “Implementing response rules” on page 1216.

Configuring the Quarantine Smart Response action

The Quarantine Smart Response action quarantines files in the Salesforce, Box, and OneDrive
cloud applications through the Cloud Service Connector. The quarantine path is relative to the
user's root folder.
To configure the Quarantine Smart Response action
1 Configure a Smart Response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Quarantine action type from the Actions list.
The system displays the Quarantine field.
See “Configuring response rule actions” on page 1223.
 Response rule actions 1254
Configuring the Restore File Smart Response action

3 Configure the Quarantine parameters.

See Table 42-7 on page 1254.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-7 Quarantine (Smart Response) configuration parameters

Parameter Description

File Path Enter the file path for the quarantine location. This file path is relative to the user's root folder.

Use Marker Select Use Marker File to create a marker text file to replace the original file. This action notifies the
File user what happened to the file instead of quarantining or deleting the file without any explanation.

See “Implementing response rules” on page 1216.

Configuring the Restore File Smart Response action

The Restore File Smart Response action restores a quarantined file in the Salesforce, Box,
and OneDrive cloud applications through the Cloud Service Connector.
To configure the Restore File Smart Response action
1 Configure a Smart Response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Restore File action type from the Actions list.
The system displays the Restore File field.
3 Click Save to save the configuration.
4 See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

Configuring the Break Links in Data-at-Rest action

The Break Links in Data-at-Rest action breaks links to sensitive data in the following cloud
applications through the Cloud Service Connector:
■ Salesforce
■ Box
■ Dropbox
■ OneDrive
 Response rule actions 1255
Configuring the Custom Action on Data-at-Rest action

■ SharePoint
■ Google Drive
You can configure a custom payload with additional details about this recommendation. The
custom payload appears in the customResponsePayload parameter of the detection response.
To configure the Break Links in Data-at-Rest action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Break Links in Data-at-Rest action type from the Actions list.
The system displays the Break Links in Data-at-Rest field.
See “Configuring response rule actions” on page 1223.
3 Configure the Break Links in Data-at-Rest parameter.
See Table 42-8 on page 1255.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-8 Break Links in Data-at-Rest configuration parameter

Parameter Description

Custom Enter details about the Break Links in Data-at-Rest action in the custom payload field. These details
payload are returned in the customResponsePayload parameter of the detection result.

See “Implementing response rules” on page 1216.

Configuring the Custom Action on Data-at-Rest action

The Custom Action on Data-at-Rest action returns a recommendation to perform some
custom action on the sensitive data with the detection result.
You can configure a custom payload with additional details about this recommendation. The
custom payload appears in the customResponsePayload parameter of the detection response.
 Response rule actions 1256
Configuring the Delete Data-at-Rest action

To configure the Custom Action on Data-at-Rest action

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Custom Action on Data-at-Rest action type from the Actions list.
The system displays the Custom Action on Data-at-Rest field.
See “Configuring response rule actions” on page 1223.
3 Configure the Custom Action on Data-at-Rest parameter.
See Table 42-9 on page 1256.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-9 Custom Action on Data-at-Rest configuration parameter

Parameter Description

Custom Enter details about the Custom Action on Data-at-Rest action in the custom payload field. These
payload details are returned in the customResponsePayload parameter of the detection result.

See “Implementing response rules” on page 1216.

Configuring the Delete Data-at-Rest action

The Delete Data-at-Rest action deletes sensitive data in the Dropbox cloud application through
the Cloud Service Connector.
To configure the Delete Data-at-Rest action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Delete Data-at-Rest action type from the Actions list.
The system displays the Delete Data-at-Rest field.
See “Configuring response rule actions” on page 1223.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.
 Response rule actions 1257
Configuring the Encrypt Data-at-Rest action

Configuring the Encrypt Data-at-Rest action

The Encrypt Data-at-Rest action encrypts sensitive data in the OneDrive application through
the Cloud Service Connector.
You can configure a custom payload with additional details about this recommendation. The
custom payload appears in the customResponsePayload parameter of the detection response.
To configure the Encrypt Data-at-Rest action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Encrypt Data-at-Rest action type from the Actions list.
The system displays the Encrypt Data-at-Rest field.
See “Configuring response rule actions” on page 1223.
3 Configure the parameter.
See Table 42-10 on page 1257.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-10 Encrypt Data-at-Rest configuration parameter

Parameter Description

Custom Enter details about the Encrypt Data-at-Rest action in the Custom payload field. These details are
payload returned in the customResponsePayload parameter of the detection result.

See “Implementing response rules” on page 1216.

Configuring the Perform DRM on Data-at-Rest action

The Perform DRM on Data-at-Rest action applies Digital Rights Management (DRM) to
sensitive data in applications through the Cloud Service Connectoror API Detection for
Developer Apps Appliance.
You can configure a custom payload with additional details about this recommendation. The
custom payload appears in the customResponsePayload parameter of the detection response.
 Response rule actions 1258
Configuring the Quarantine Data-at-Rest action

To configure the Perform DRM on Data-at-Rest action

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Perform DRM on Data-at-Rest action type from the Actions list.
The system displays the field.
See “Configuring response rule actions” on page 1223.
3 Configure the Perform DRM on Data-at-Rest parameter.
See Table 42-11 on page 1258.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-11 Perform DRM on Data-at-Rest configuration parameter

Parameter Description

Custom Enter details about the Perform DRM on Data-at-Rest action in the Custom payload field. These details
payload are returned in the customResponsePayload parameter of the detection result.

See “Implementing response rules” on page 1216.

Configuring the Quarantine Data-at-Rest action

The Quarantine Data-at-Rest action quarantines sensitive data in the Salesforce, Box, and
OneDrive cloud applications through the Cloud Service Connector.
To configure the Quarantine Data-at-Rest action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Quarantine Data-at-Rest action type from the Actions list.
The system displays the Quarantine Data-at-Rest field.
See “Configuring response rule actions” on page 1223.
3 Configure the Quarantine Data-at-Rest parameter.
See Table 42-12 on page 1259.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.
 Response rule actions 1259
Configuring the Tag Data-at-Rest action

Table 42-12 Quarantine Data-at-Rest configuration parameter

Parameter Description

File Path Enter the file path for the quarantine location. This file path is relative to the user's root folder.

Use Marker Select Use Marker File to create a marker text file to replace the original file. This action notifies the
File user what happened to the file instead of quarantining or deleting the file without any explanation.

See “Implementing response rules” on page 1216.

Configuring the Tag Data-at-Rest action

The Tag Data-at-Rest action tags sensitive data in applications through the Cloud Service
Connector or API Detection for Developer Apps Appliance.
You can configure a custom payload with additional details about this recommendation. The
custom payload appears in the customResponsePayload parameter of the detection response.
To configure the Tag Data-at-Rest action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Tag Data-at-Rest action type from the Actions list.
The system displays the Tag Data-at-Rest field.
See “Configuring response rule actions” on page 1223.
3 Configure the Tag Data-at-Rest parameter.
See Table 42-13 on page 1259.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-13 Tag Data-at-Rest configuration parameter

Parameter Description

Custom Enter details about the Tag Data-at-Rest action in the Custom payload field. These details are returned
payload in the customResponsePayload parameter of the detection result.

See “Implementing response rules” on page 1216.

 Response rule actions 1260
Configuring the Prevent download, copy, print action

Configuring the Prevent download, copy, print action

The Prevent download, copy, print action prevents sensitive data files from being downloaded,
copied, or printed from the Google Drive cloud application through the Cloud Service Connector.
To configure the Prevent download, copy, print action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Prevent download, copy, print action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

Configuring the Remove Collaborator Access action

The Remove Collaborator Access action removes access from collaborators to sensitive
data files in the following cloud applications through the Cloud Service Connector:
■ Salesforce
■ Box
■ Dropbox
■ OneDrive
■ SharePoint
■ Google Drive
To configure the Remove Collaborator Access action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Remove Collaborator Access action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.
 Response rule actions 1261
Configuring the Set Collaborator Access to 'Edit' action

Configuring the Set Collaborator Access to 'Edit'

action
The Set Collaborator Access to 'Edit' action grants collaborators edit access to sensitive
data files in the following cloud applications through the Cloud Service Connector:
■ Salesforce
■ Box
■ Dropbox
■ OneDrive
■ SharePoint
■ Google Drive
To configure the Set Collaborator Access to 'Edit' action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Set Collaborator Access to 'Edit' action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

Configuring the Set Collaborator Access to 'Preview'

action
The Set Collaborator Access to 'Preview' action grants collaborators preview access to
sensitive data files in the Box cloud application through the Cloud Service Connector.
To configure the Set Collaborator Access to 'Preview' action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Set Collaborator Access to 'Preview' action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.
 Response rule actions 1262
Configuring the Set Collaborator Access to 'Read' action

See “Implementing response rules” on page 1216.

Configuring the Set Collaborator Access to 'Read'

action
The Set Collaborator Access to 'Read' action grants collaborators read access to sensitive
data files in the following cloud applications through the Cloud Service Connector:
■ Salesforce
■ Box
■ Dropbox
■ OneDrive
■ SharePoint
■ Google Drive
To configure the Set Collaborator Access to 'Read' action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Set Collaborator Access to 'Read' action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

Configuring the Set File Access to 'All Read' action

The Set File Access to 'All Read' action grants public read access to sensitive data files in
the OneDrive, SharePoint, and Google drive cloud applications through the Cloud Service
Connector.
 Response rule actions 1263
Configuring the Set File Access to 'Internal Edit'

To configure the Set File Access to 'All Read' action

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Set File Access to 'All Read' action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

Configuring the Set File Access to 'Internal Edit'

The Set File Access to 'Internal Edit' action grants edit access to all members of your
organization to sensitive files in the following cloud applications through the Cloud Service
Connector:
■ Salesforce
■ Box
■ OneDrive
■ SharePoint
■ Google Drive
To configure the Set File Access to 'Internal Edit' action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Set File Access to 'Internal Edit' action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.
 Response rule actions 1264
Configuring the Set File Access to 'Internal Read' action

Configuring the Set File Access to 'Internal Read'

action
The Set File Access to 'Internal Read' action grants read access to all members of your
organization to sensitive data files in the following cloud applications through the Cloud Service
Connector:
■ Salesforce
■ Box
■ OneDrive
■ SharePoint
■ Google Drive
To configure the Set File Access to 'Internal Read' action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Set File Access to 'Internal Read' action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

Configuring the Add two-factor authentication action

The Add two-factor authentication action adds two-factor authentication to sensitive data
files in applications through the Cloud Service Connector or API Detection for Developer Apps
Appliance.
To configure the Add two-factor authentication action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Add two-factor authentication action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.
 Response rule actions 1265
Configuring the Block Data-in-Motion action

Configuring the Block Data-in-Motion action

The Block Data-in-Motion action blocks sensitive data in applications through the Cloud
Service Connector or API Detection for Developer Apps Appliance.
You can configure a message for your users to inform them why the sensitive data was blocked.
The message appears in the message parameter of the detection response.
To configure the Data-in-Motion (DIM) REST API action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Block Data-in-Motion action type from the Actions list.
The system displays the Block Data-in-Motion field.
See “Configuring response rule actions” on page 1223.
3 Configure the Block Data-in-Motion parameter.
See Table 42-14 on page 1265.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-14 Block Data-in-Motion configuration parameter

Parameter Description

Message Enter a user-facing message for the Block Data-in-Motion action in the message field. These details
are returned in the message parameter of the detection result.

See “Implementing response rules” on page 1216.

Configuring the Custom Action on Data-in-Motion

action
The Custom Action on Data-in-Motion action returns a recommendation to take some custom
action on the sensitive data with the detection result.
You can configure a custom payload with additional details about this recommendation. The
custom payload appears in the customResponsePayload parameter of the detection response.
 Response rule actions 1266
Configuring the Encrypt Data-in-Motion action

To configure the Custom Action on Data-in-Motion action

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Custom Action on Data-in-Motion action type from the Actions list.
The system displays the Custom Action on Data-in-Motion field.
See “Configuring response rule actions” on page 1223.
3 Configure the parameter.
See Table 42-15 on page 1266.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-15 Custom Action on Data-in-Motion configuration parameter

Parameter Description

Custom Enter details about the Custom Action on Data-in-Motion action in the custom payload field. These
payload details are returned in the customResponsePayload parameter of the detection result.

See “Implementing response rules” on page 1216.

Configuring the Encrypt Data-in-Motion action

The Encrypt Data-in-Motion action encrypts sensitive data in the Box cloud application through
the Cloud Service Connector.
You can configure a custom payload with additional details about this recommendation. The
custom payload appears in the customResponsePayload parameter of the detection response.
To configure the Encrypt Data-in-Motion action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Encrypt Data-in-Motion action type from the Actions list.
The system displays the Encrypt Data-in-Motion field.
See “Configuring response rule actions” on page 1223.
 Response rule actions 1267
Configuring the Perform DRM on Data-in-Motion action

3 Configure the Encrypt Data-in-Motion parameter.

See Table 42-16 on page 1267.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-16 Encrypt Data-in-Motion configuration parameter

Parameter Description

Custom Enter details about the Encrypt Data-in-Motion action in the custom payload field. These details are
payload returned in the customResponsePayload parameter of the detection result.

See “Implementing response rules” on page 1216.

Configuring the Perform DRM on Data-in-Motion

action
The Perform DRM on Data-in-Motion action applies Digital Rights Management (DRM) to
sensitive data in cloud applications through the Cloud Service Connector.
You can configure a custom payload with additional details about this recommendation. The
custom payload appears in the customResponsePayload parameter of the detection response.
To configure the Perform DRM on Data-in-Motion action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Perform DRM on Data-in-Motion action type from the Actions list.
The system displays the Perform DRM on Data-in-Motion field.
See “Configuring response rule actions” on page 1223.
3 Configure the Perform DRM on Data-in-Motion parameter.
See Table 42-17 on page 1267.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-17 Perform DRM on Data-in-Motion configuration parameter

Parameter Description

Custom Enter details about the Perform DRM on Data-in-Motion action in the custom payload field. These
payload details are returned in the customResponsePayload parameter of the detection result.
 Response rule actions 1268
Configuring the Quarantine Data-in-Motion action

See “Implementing response rules” on page 1216.

Configuring the Quarantine Data-in-Motion action

The Quarantine Data-in-Motion action quarantines sensitive data in the Salesforce, Box, and
OneDrive cloud applications through the Cloud Service Connector.
You can configure a custom payload with additional details about this recommendation. The
custom payload appears in the customResponsePayload parameter of the detection response.
To configure the Quarantine Data-in-Motion action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Quarantine Data-in-Motion action type from the Actions list.
The system displays the Quarantine Data-in-Motion field.
See “Configuring response rule actions” on page 1223.
3 Configure the Quarantine Data-in-Motion parameter.
See Table 42-18 on page 1268.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-18 Quarantine Data-in-Motion configuration parameter

Parameter Description

Custom Enter details about the Quarantine Data-in-Motion action in the custom payload field. These details
payload are returned in the customResponsePayload parameter of the detection result.

See “Implementing response rules” on page 1216.

Configuring the Redact Data-in-Motion action

The Redact Data-in-Motion action redacts sensitive data in applications through the Cloud
Service Connector or API Detection for Developer Apps Appliance.
You can configure a message for your users to inform them why the sensitive data was
redacted. The message appears in the message parameter of the detection response.
 Response rule actions 1269
Configuring the Endpoint: FlexResponse action

To configure the Redact Data-in-Motion action

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Redact Data-in-Motion action type from the Actions list.
The system displays the Redact Data-in-Motion field.
See “Configuring response rule actions” on page 1223.
3 Configure the Redact Data-in-Motion parameter.
See Table 42-19 on page 1269.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-19 Redact Data-in-Motion configuration parameter

Parameter Description

Message Enter a user-facing message for the Redact Data-in-Motion action in the message field. These details
are returned in the message parameter of the detection result.

See “Implementing response rules” on page 1216.

Configuring the Endpoint: FlexResponse action

The Endpoint: FlexResponse response rule action lets you implement one or more custom
responses you have developed using the FlexResponse API.
See “About Endpoint FlexResponse” on page 1913.
This response rule is available for Endpoint Discover.

Note: This feature is not available for agents running on Mac endpoints.

See “Response rule actions for endpoint detection” on page 1201.

To configure the Endpoint: FlexResponse response rule action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Endpoint: FlexResponse action type from the Actions list.
See “Configuring response rule actions” on page 1223.
 Response rule actions 1270
Configuring the Endpoint Discover: Quarantine File action

3 Enter the FlexResponse plug-in Name and configure its Parameters.

See Table 42-20 on page 1270.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-20 Endpoint: FlexResponse response rule action parameters

Parameter Description

FlexResponse Enter the script module name with packages separated by a period (.).
Python Plugin

Plugin parameters Click Add Parameter to add one or more parameters to the script.

Enter the Key/Value pair for each parameter.

Credentials You can add credentials for accessing the plugin.

You can add and store credentials at the System > Settings > Credentials screen.

See “About the credential store” on page 145.

See “Implementing response rules” on page 1216.

Configuring the Endpoint Discover: Quarantine File

action
The Endpoint Discover: Quarantine File response rule action removes a file containing sensitive
information from a non-secure location and places it in a secure location.
See “About Endpoint Quarantine” on page 1763.
This response rule action is specific to Endpoint Discover incidents. This response rule is not
applicable to two-tiered detection methods requiring a Data Profile.
See “Setting up and configuring Endpoint Discover” on page 1763.
If you use multiple endpoint response rules in a single policy, make sure that you understand
the order of precedence for such rules.
See “About response rule action execution priority” on page 1211.

Note: This feature is not available for agents running on Mac endpoints.
 Response rule actions 1271
Configuring the Endpoint Discover: Quarantine File action

To configure the Endpoint Discover: Quarantine File response rule action

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Endpoint Discover: Quarantine File action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Enter the Quarantine Path and the Marker File settings.
See Table 42-21 on page 1271.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-21 Endpoint Discover: Quarantine File response rule action parameters

Parameter Description

Quarantine Enter the path to the secured location where you want files to be placed. The secure location can
Path either be on the local drive of the endpoint, or can be on a remote file share. EFS folders can also
be used as the quarantine location.

Access Mode If your secure location is on a remote file share, you must select how the Symantec DLP Agent
accesses that file share.
Select one of the following credential access types:

■ Anonymous Access
■ Use Saved Credentials

In anonymous mode, the Symantec DLP Agent runs as LocalSystem user to move the confidential
file. You can use anonymous mode to move files to a secure location on a local drive or to remote
share if it allows anonymous access.
Note: EFS folders cannot accept anonymous users.

A specified credential lets the Symantec DLP Agent impersonate the specified user to access the
secure location. The credentials must be in the following format:

domain\user

You must enter the specified credentials you want to use through the System Credentials page.

See “Configuring endpoint credentials” on page 146.

Marker File Select the Leave marker in place of the remediated file check box to create a placeholder file
that replaces the confidential file.
 Response rule actions 1272
Configuring the Endpoint Prevent: Block action

Table 42-21 Endpoint Discover: Quarantine File response rule action parameters (continued)

Parameter Description

Marker Text Specify the text to appear in the marker file. If you selected the option to leave the marker file in
place of the remediated file, you can use variables in the marker text.

To specify the marker text, select the variable from the Insert Variable list.

For example, for Marker Text you might enter:

A message has violated the following rules in $POLICY$: $RULES

Or, you might enter:

$FILE_NAME$ has been moved to $QUARANTINE_PARENT_PATH$

See “About response rule actions” on page 1199.

See “Response rule actions for endpoint detection” on page 1201.

Configuring the Endpoint Prevent: Block action

The Endpoint Prevent: Block response rule action blocks the movement of confidential data
on the endpoint and optionally displays an on-screen notification to the endpoint user.
See “About response rule actions” on page 1199.
This response rule action is specific to Endpoint Prevent incidents. This response rule is not
applicable to two-tiered detection methods requiring a Data Profile.
See “Setting up and configuring Endpoint Discover” on page 1763.
If you combine multiple endpoint response rules in a single policy, make sure that you
understand the order of precedence for such rules.
See “About response rule action execution priority” on page 1211.

Note: The block action is not triggered for a copy of sensitive data to a local drive.

To configure the Endpoint Prevent: Block response rule action

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Endpoint Prevent: Block action type from the Actions list.
3 See “Configuring response rule actions” on page 1223.
 Response rule actions 1273
Configuring the Endpoint Prevent: Block action

4 Enter the Endpoint Notification Content settings.

See Table 42-22 on page 1273.
5 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-22 Endpoint Prevent: Block response rule action parameters

Parameter Configuration

Language Select the language you want the response rule to execute on. Click Add Language to add more
than one language.

See “About Endpoint Prevent response rules in different locales” on page 1753.

See “Setting Endpoint Prevent response rules for different locales” on page 1754.

Display Alert This field is optional for Endpoint Block actions. Select an Endpoint Block action to display an
Box with this on-screen notification to the endpoint user when the system blocks an attempt to copy confidential
message data.

Enter the notification message in the text box. You can add variables to the message by selecting
the appropriate value(s) from the Insert Variable box.

Optionally, you can configure the on-screen notification to include user justifications as well as an
option for users to enter their own justification.

You can also add hyperlinks to refer users to URLs that contain company security information. To
add hyperlinks you use standard HTML syntax, tags, and URLs. Tags are case-sensitive. You can
include insert hyperlinked text between regular text. For example, you would enter:

The $CONTENT_TYPE$ "$CONTENT_NAME$" contains sensitive information. <a

href="http://www.company.com">Click here for information</a>. Contact the <a
href="mailto:admin@company.com">administrator</a> if you have questions.

Insert Variable Select the variables to include in the on-screen notification to the endpoint when the system blocks
an attempt to copy confidential data.
You can select variables based on the following types:

■ Application
■ Content Name
■ Content Type
■ Device Type
■ Policy Names
■ Protocol
 Response rule actions 1274
Configuring the Endpoint Prevent: Block action

Table 42-22 Endpoint Prevent: Block response rule action parameters (continued)

Parameter Configuration

Allow user to Select this option to display up to four user justifications in the on-screen notification. When the
choose notification appears on the endpoint, the user is required to choose one of the justifications. (If you
explanation select Allow user to enter text explanation, the user can enter a justification.) Symantec Data Loss
Prevention provides four default justifications, which you can modify or remove as needed.
Justification:

■ User Education
■ Broken Business Process
■ Manager Approved
■ False positive
Each justification entry consists of the following options:

■ Check box
This option indicates whether to include the associated justification in the notification. To remove
a justification, clear the check box next to it. To include a justification, select the check box next
to it.
■ Justification
The system label for the justification. This value appears in reports (for ordering and filtering
purposes), but the user does not see it. You can select the desired option from the drop-down
list.
■ Option Presented to End User
The justification text the system displays in the notification. This value appears in reports with the
justification label. You can modify the default text as desired.
To add a new justification, select New Justification from the drop-down list. In the Enter new
justification text box that appears, enter the justification name. When you save the rule, Symantec
Data Loss Prevention includes it as an option (in alphabetical order) in all Justification drop-down
lists.
Note: You should be selective when adding new justifications. Deleting new justifications is not
currently supported.

Allow user to Select this option to include a text box into which users can enter their own justification.
enter text
explanation

See “Response rule actions for endpoint detection” on page 1201.

See “Recovering sensitive files on Mac endpoints” on page 1801.
 Response rule actions 1275
Configuring the Endpoint Prevent: Encrypt action

Configuring the Endpoint Prevent: Encrypt action

The Endpoint Prevent: Encrypt response rule action displays a time-sensitive notification when
the user attempts to transfer a sensitive file to a removable external device.
See “About response rule actions” on page 1199.
For information about the limitations of the Endpoint Prevent: Encrypt response rule action,
See “Response rule best practices” on page 1217.
This response rule action is available after you apply the Endpoint Prevent ICE license.
For using this response action, ensure that you have configured the following settings. If you
do not configure the following settings, the Encrypt response action blocks the file, instead of
encrypting the file.
■ The Endpoint Prevent ICE license is applied and the Enforce Server is configured to connect
to the Symantec Information Centric Encryption Cloud.
For information about how Symantec Data Loss Prevention interacts with Symantec ICE,
refer to the Symantec Information Centric Encryption Deployment Guide.
See “Configuring the Enforce Server to connect to the Symantec ICE Cloud” on page 204.
■ You need to enable Information Centric Encryption settings for DLP Agents on the System
> Agents > Agent Configuration > Settings page.
See “Agent settings” on page 1798.
See “Information Centric Encryption settings for DLP Agents” on page 1804.
Users have a limited amount of time to decide to ignore the policy violation or not. If the violation
is ignored, the DLP Agent encrypts the file, the data transfer completes, and an incident is
created. If the violation is not ignored, the data transfer is stopped and an incident is created.
If the user does not make a decision in the allotted time, the data transfer is automatically
blocked and an incident is created. You can provide a reason for the notification as well as
options for the endpoint user to enter a justification for the action. This response rule action is
available for Endpoint Prevent on Windows and Mac endpoints.
See “How to implement Endpoint Prevent” on page 1751.
 Response rule actions 1276
Configuring the Endpoint Prevent: Encrypt action

To configure the Endpoint Prevent: Encrypt action

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
Add the Endpoint Prevent: Encrypt action type from the Actions list.
See “Configuring response rule actions” on page 1223.
2 Configure the Endpoint Prevent: Encrypt parameters.
See Table 42-23 on page 1276.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-23 Endpoint Prevent: Encrypt parameters

Parameter Description

Language Select the language you want the response rule to execute on. Click Add
Language to add more than one language.

See “About Endpoint Prevent response rules in different locales” on page 1753.

See “Setting Endpoint Prevent response rules for different locales” on page 1754.

Pre-timeout warning This field is required to notify users that they have a limited amount of time to
respond to the incident.

Enter the notification message in the text box. You can add variables to the
message by selecting the appropriate value(s) from the Insert Variable box.

Post-timeout message This field notifies users that the amount of time to override the policy has
expired. The data transfer was blocked.

Enter the notification message in the text box. You can add variables to the
message by selecting the appropriate value(s) from the Insert Variable box.
 Response rule actions 1277
Configuring the Endpoint Prevent: Encrypt action

Table 42-23 Endpoint Prevent: Encrypt parameters (continued)

Parameter Description

Display Alert Box with This field is required for Endpoint Encrypt actions. Select this option to display
this message an on-screen notification to the endpoint user.

Enter the notification message in the text box. You can add variables to the
message by selecting the appropriate value(s) from the Insert Variable box.

Optionally, you can configure the on-screen notification to include user

justifications as well as the option for users to enter their own justifications.

You can also add hyperlinks to refer users to URLs that contain company
security information. To add hyperlinks you use standard HTML syntax, tags,
and URLs. Tags are case-sensitive. You can include insert hyperlinked text
between regular text. For example, you would enter:

The $CONTENT_TYPE$ "$CONTENT_NAME$" contains sensitive

information. <a href="http://www.company.com">Click here for
information</a>. Contact the <a
href="mailto:admin@company.com">administrator</a> if you have
questions.

Insert Variable Select the variables that you want to include in the on-screen notification to
the endpoint user.

You can select variables based on the following types:

■ Application
■ Content Name
■ Content Type
■ Device Type
■ Policy Name
■ Protocol
■ Timeout Counter

Note: You must use the Timeout Counter variable to display how much time
remains before blocking the data transfer.
 Response rule actions 1278
Configuring the Endpoint Prevent: Encrypt action

Table 42-23 Endpoint Prevent: Encrypt parameters (continued)

Parameter Description

Allow user to choose Select this option to display up to four user justifications in the on-screen
explanation. notification. When the notification appears on the endpoint, the user is required
to choose one of the justifications. (If you select Allow user to enter text
explanation, the user can enter a justification.) Symantec Data Loss Prevention
provides four default justifications, which you can modify or remove as needed.

Available Justifications:

■ Broken Business Process

■ False positive
■ Manager Approved
■ User Education
■ Custom (new justification)

Each justification entry consists of the following options:

■ Check box
This option indicates whether to include the associated justification in the
notification. To remove a justification, clear the check box next to it. To
include a justification, select the check box next to it.
■ Justification
The system label for the justification. This value appears in reports (for
ordering and filtering purposes), but the user does not see it. You can select
the desired option from the drop-down list.
■ Option Presented to End User
The justification text Symantec Data Loss Prevention displays in the
notification. This value appears in reports with the justification label. You
can modify the default text as desired.

To add a new justification, select New Justification from the appropriate

drop-down list. In the Enter new justification text box that appears, type the
justification name. When you save the rule, the system includes the new
justification as an option (in alphabetical order) in all Justification drop-down
lists.
Note: You should be selective in adding new justifications. Deleting new
justifications is not currently supported.

Allow user to enter text Select this option to include a text box into which users can enter their own
explanation. justification.

See “Implementing response rules” on page 1216.

 Response rule actions 1279
Configuring the Endpoint Prevent: Notify action

Configuring the Endpoint Prevent: Notify action

The Endpoint Prevent: Notify response rule action displays an on-screen notification to the
endpoint user when the user attempts to copy or send a sensitive file. You can provide a reason
for the notification as well as options for the endpoint user to give a justification for the action.
See “About response rule actions” on page 1199.
This response rule action is available for Endpoint Prevent.
See “How to implement Endpoint Prevent” on page 1751.

Note: The notify action is not triggered for a copy of sensitive data to a local drive.

To configure the Endpoint Prevent: Notify action

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
Add the Endpoint Prevent: Notify action type from the Actions list.
See “Configuring response rule actions” on page 1223.
2 Configure the action parameters.
See Table 42-24 on page 1279.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-24 Endpoint Prevent: Notify response rule action parameters

Parameter Description

Language Select the language you want the response rule to execute on.

Click Add Language to add more than one language.

See “About Endpoint Prevent response rules in different locales” on page 1753.

See “Setting Endpoint Prevent response rules for different locales” on page 1754.
 Response rule actions 1280
Configuring the Endpoint Prevent: Notify action

Table 42-24 Endpoint Prevent: Notify response rule action parameters (continued)

Parameter Description

Display Alert Box This field is required for Endpoint Notify actions. Select this option to display an on-screen
with this message notification to the endpoint user.

Enter the notification message in the text box. You can add variables to the message by selecting
the appropriate value(s) from the Insert Variable box.

Optionally, you can configure the on-screen notification to include user justifications as well as
the option for users to enter their own justifications.

You can also add hyperlinks to refer users to URLs that contain company security information.
To add hyperlinks you use standard HTML syntax, tags, and URLs. Tags are case-sensitive.
You can include insert hyperlinked text between regular text. For example, you would enter:

The $CONTENT_TYPE$ "$CONTENT_NAME$" contains sensitive information. <a

href="http://www.company.com">Click here for information</a>. Contact the <a
href="mailto:admin@company.com">administrator</a> if you have questions.

Insert Variable Select the variables that you want to include in the on-screen notification to the endpoint user.
You can select variables based on the following types:

■ Application
■ Content Name
■ Content Type
■ Device Type
■ Policy Names
■ Protocol
 Response rule actions 1281
Configuring the Endpoint Prevent: Notify action

Table 42-24 Endpoint Prevent: Notify response rule action parameters (continued)

Parameter Description

Allow user to choose Select this option to display up to four user justifications in the on-screen notification. When
explanation the notification appears on the endpoint, the user is required to choose one of the justifications.
(If you select Allow user to enter text explanation, the user can enter a justification.) Symantec
Data Loss Prevention provides four default justifications, which you can modify or remove as
needed.
Available Justifications:

■ Broken Business Process

■ False positive
■ Manager Approved
■ User Education
■ Custom (new justification)
Each justification entry consists of the following options:

■ Check box
This option indicates whether to include the associated justification in the notification. To
remove a justification, clear the check box next to it. To include a justification, select the
check box next to it.
■ Justification
The system label for the justification. This value appears in reports (for ordering and filtering
purposes), but the user does not see it. You can select the desired option from the drop-down
list.
■ Option Presented to End User
The justification text Symantec Data Loss Prevention displays in the notification. This value
appears in reports with the justification label. You can modify the default text as desired.

To add a new justification, select New Justification from the appropriate drop-down list. In the
Enter new justification text box that appears, type the justification name. When you save the
rule, the system includes the new justification as an option (in alphabetical order) in all
Justification drop-down lists.
Note: You should be selective in adding new justifications. Deleting new justifications is not
currently supported.

Allow user to enter Select this option to include a text box into which users can enter their own justification.
text explanation

See “Response rule actions for endpoint detection” on page 1201.

 Response rule actions 1282
Configuring the Endpoint Prevent: User Cancel action

Configuring the Endpoint Prevent: User Cancel action

The Endpoint Prevent: User Cancel response rule action displays a time-sensitive notification
to the user when a policy is violated.
See “About response rule actions” on page 1199.
Users have a limited amount of time to decide to ignore the policy violation or not. If the violation
is ignored, the data transfer completes and an incident is created. If the violation is not ignored,
the data transfer is stopped and an incident is created. If the user does not make a decision
in the allotted time, the data transfer is automatically blocked and an incident is created. You
can provide a reason for the notification as well as options for the endpoint user to enter a
justification for the action.
This response rule action is available for Endpoint Prevent on Windows endpoints only.
See “How to implement Endpoint Prevent” on page 1751.
To configure the Endpoint Prevent: User Cancel action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
Add the Endpoint Prevent: User Cancel action type from the Actions list.
See “Configuring response rule actions” on page 1223.
2 Configure the Endpoint Prevent: User Cancel parameters.
See Table 42-25 on page 1282.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-25 Endpoint Prevent: User Cancel parameters

Parameter Description

Language Select the language you want the response rule to execute on.

Click Add Language to add more than one language.

See “About Endpoint Prevent response rules in different locales” on page 1753.

See “Setting Endpoint Prevent response rules for different locales” on page 1754.

Pre-timeout warning This field is required to notify users that they have a limited amount of time to respond to the
incident.

Enter the notification message in the text box. You can add variables to the message by selecting
the appropriate value(s) from the Insert Variable box.
 Response rule actions 1283
Configuring the Endpoint Prevent: User Cancel action

Table 42-25 Endpoint Prevent: User Cancel parameters (continued)

Parameter Description

Post-timeout This field notifies users that the amount of time to override the policy has expired. The data
message transfer was blocked.

Enter the notification message in the text box. You can add variables to the message by selecting
the appropriate value(s) from the Insert Variable box.

Display Alert Box This field is required for Endpoint User Cancel actions. Select this option to display an on-screen
with this message notification to the endpoint user.

Enter the notification message in the text box. You can add variables to the message by selecting
the appropriate value(s) from the Insert Variable box.

Optionally, you can configure the on-screen notification to include user justifications as well as
the option for users to enter their own justifications.

You can also add hyperlinks to refer users to URLs that contain company security information.
To add hyperlinks you use standard HTML syntax, tags, and URLs. Tags are case-sensitive.
You can include insert hyperlinked text between regular text. For example, you would enter:

The $CONTENT_TYPE$ "$CONTENT_NAME$" contains sensitive information. <a

href="http://www.company.com">Click here for information</a>. Contact the <a
href="mailto:admin@company.com">administrator</a> if you have questions.

Insert Variable Select the variables that you want to include in the on-screen notification to the endpoint user.
You can select variables based on the following types:

■ Application
■ Content Name
■ Content Type
■ Device Type
■ Policy Name
■ Protocol
■ Timeout Counter

Note: You must use the Timeout Counter variable to display how much time remains before
blocking the data transfer.
 Response rule actions 1284
Configuring the Endpoint Prevent: User Cancel action

Table 42-25 Endpoint Prevent: User Cancel parameters (continued)

Parameter Description

Allow user to choose Select this option to display up to four user justifications in the on-screen notification. When
explanation. the notification appears on the endpoint, the user is required to choose one of the justifications.
(If you select Allow user to enter text explanation, the user can enter a justification.) Symantec
Data Loss Prevention provides four default justifications, which you can modify or remove as
needed.
Available Justifications:

■ Broken Business Process

■ False positive
■ Manager Approved
■ User Education
■ Custom (new justification)
Each justification entry consists of the following options:

■ Check box
This option indicates whether to include the associated justification in the notification. To
remove a justification, clear the check box next to it. To include a justification, select the
check box next to it.
■ Justification
The system label for the justification. This value appears in reports (for ordering and filtering
purposes), but the user does not see it. You can select the desired option from the drop-down
list.
■ Option Presented to End User
The justification text Symantec Data Loss Prevention displays in the notification. This value
appears in reports with the justification label. You can modify the default text as desired.

To add a new justification, select New Justification from the appropriate drop-down list. In the
Enter new justification text box that appears, type the justification name. When you save the
rule, the system includes the new justification as an option (in alphabetical order) in all
Justification drop-down lists.
Note: You should be selective in adding new justifications. Deleting new justifications is not
currently supported.

Allow user to enter Select this option to include a text box into which users can enter their own justification.
text explanation.

See “Implementing response rules” on page 1216.

 Response rule actions 1285
Configuring the Network Prevent for Web: Block FTP Request action

Configuring the Network Prevent for Web: Block FTP

Request action
The Network Prevent for Web: Block FTP Request response rule action blocks any file transfer
by FTP on your network device.
See “About response rule actions” on page 1199.
This response rule is available only for Network Prevent for Web integrated with a proxy server.
See “Configuring Network Prevent for Web Server” on page 1511.
To configure the Network Prevent for Web: Block FTP Request response rule action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Network Prevent for Web: Block FTP Request action type from the Actions
list.
The Block FTP Request response rule action does not require any further configuration.
Once the response rule is deployed to a policy, this action blocks any FTP attempt.
See “Configuring response rule actions” on page 1223.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

Configuring the Network Prevent for Web: Block

HTTP/S action
The Network Prevent for Web: Block HTTP/S response rule action blocks the transmission of
Web content that Network Prevent for Web detects. This action also blocks Web-based email
messages and attachments.
See “About response rule actions” on page 1199.
This response rule action blocks the transmission of Web content using the Internet Content
Adaptation Protocol (ICAP). To implement this response rule action you must integrate the
detection server with a Web proxy server.
See “Configuring Network Prevent for Web Server” on page 1511.
 Response rule actions 1286
Configuring the Network Prevent: Block SMTP Message action

To configure the Network Prevent: Block HTTP/S response rule action

1 Integrate Network Prevent for Web with a proxy server and, if necessary, a VPN server.
See “Network Prevent for Web Server—basic configuration” on page 219.
2 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
3 Add the Network Prevent for Web: Block HTTP/S action type from the Actions list.
See “Configuring response rule actions” on page 1223.
4 Edit the Rejection Message, as necessary.
The system presents this message to the user's browser when the action blocks content.
For example, you might include some HTML-coded text to display in a browser.

Note: If the requesting client does not expect an HTML response, the Rejection Message
may not be displayed in the client browser. For example, a client expecting an XML
response to a Web post may only indicate a Javascript error.

5 Click Save to save the configuration of the response rule.

Certain applications may not provide an adequate response to the Network Prevent for Web:
Block HTTP/S response action. This behavior has been observed with the Yahoo! Mail
application when a detection server blocks a file upload. If a user tries to upload an email
attachment and the attachment triggers a Network Prevent for Web: Block HTTP/S response
action, Yahoo! Mail does not respond or display an error message to indicate that the file is
blocked. Instead, Yahoo! Mail appears to continue uploading the selected file, but the upload
never completes. The user must manually cancel the upload at some point by pressing Cancel.
Other applications may also exhibit this behavior, depending on how they handle the block
request. In these cases a detection server incident is created and the file upload is blocked
even though the application provides no such indication.
See “Implementing response rules” on page 1216.

Configuring the Network Prevent: Block SMTP

Message action
The Network Prevent: Block SMTP Message response rule action blocks SMTP email messages
that cause an incident on the Network Prevent (Email) detection server.
See “About response rule actions” on page 1199.
This response rule action is only available with Network Prevent for Email.
 Response rule actions 1287
Configuring the Network Prevent: Modify SMTP Message action

See “Response rule actions for Network Prevent detection” on page 1202.
You must integrate the Network Prevent for Email detection server with a Mail Transfer Agent
(MTA) to implement this response rule action. Refer to the Symantec Data Loss Prevention
MTA Integration Guide for Network Prevent (Email) for details.
To configure the Block SMTP Message response rule action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Network Prevent: Block SMTP Message action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Configure the Block SMTP Message action parameters.
See Table 42-26 on page 1287.
4 Click Save to save the response rule.
See “Manage response rules” on page 1219.

Table 42-26 Network Prevent: Block SMTP Message parameters

Parameter Description

Bounce Message to Sender Enter the text that you want to appear in the SMTP error that Network Prevent
(Email) returns to the MTA. Some MTAs display this text in the message that
is bounced to the sender.

If you leave this field blank, the message does not bounce to the sender but
the MTA sends its own message.

Redirect Message to this Address If you want to redirect blocked messages to a particular address (such as the
Symantec Data Loss Prevention administrator), enter that address in this field.

If you leave this field blank, the bounced message goes to the sender only.

See “Implementing response rules” on page 1216.

Configuring the Network Prevent: Modify SMTP

Message action
The Network Prevent: Modify SMTP Message response rule action lets you modify a sensitive
email. For example, you can use this action to change an email subject header to include
information about the policy violation type.
See “About response rule actions” on page 1199.
See “Response rule actions for Network Prevent detection” on page 1202.
 Response rule actions 1288
Configuring the Network Prevent for Web: Remove HTTP/S Content action

To configure the Network Prevent: Modify SMTP Message action

1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Network Prevent: Modify SMTP Message action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Configure the action parameters.
See Table 42-27 on page 1288.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-27 Network Prevent: Modify SMTP Message parameters

Parameter Description

Subject Select the type of modification to make to the subject of the message from the following options:

■ Do not Modify – No text is changed in the subject.

■ Prepend – New text is added to the beginning of the subject.
■ Append – New text is added to the end of the subject.
■ Replace With – New text completely replaces the old subject text.

If the subject text is currently modified, specify the new text.

For example, if you want to prepend "VIOLATION" to the subject of the message, select Prepend
and enter VIOLATION in the text field.

Headers Enter a unique name and a value for each header you want to add to the message (up to three).

Enable Email Select this option to enable integration with Symantec Messaging Gateway. When this option is
Quarantine enabled, Symantec Data Loss Prevention adds preconfigured x-headers to the message that
Connect (requires inform Symantec Messaging Gateway that the message should be quarantined.
Symantec
For more information, see the Symantec Data Loss Prevention Email Quarantine Connect
Messaging
FlexResponse Implementation Guide.
Gateway)

See “Implementing response rules” on page 1216.

Configuring the Network Prevent for Web: Remove

HTTP/S Content action
The Network Prevent for Web: Remove HTTP/S Content response action removes confidential
data that is posted to Web mail sites (such as Gmail), blogs (such as Blogspot), and other
sites. This action also removes confidential data that is included in any files that users upload
 Response rule actions 1289
Configuring the Network Prevent for Web: Remove HTTP/S Content action

to Web sites or attach to Web mail. This action only applies to HTTP/S POST commands; it
does not apply to GET commands.
See “About response rule actions” on page 1199.
This response rule action is only available for Network Prevent for Web.
See “Response rule actions for Network Prevent detection” on page 1202.
Symantec Data Loss Prevention recognizes Web form fields for selected Web mail, blog, and
social networking sites. If Network Prevent for Web cannot remove confidential data for a Web
site it recognizes, it creates a system event and performs a configured fallback option.

Note: Symantec Data Loss Prevention removes content for file uploads and, for Network
Prevent, Web mail attachments even for those sites that it does not recognize for HTTP content
removal.

To configure the Network Prevent for Web: Remove HTTP/S Content action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Network Prevent for Web: Remove HTTP/S Content action type from the
Actions list.
See “Configuring response rule actions” on page 1223.
3 Configure the action parameters.
See Table 42-28 on page 1289.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-28 Network Prevent for Web: Remove HTTP/S Content parameters

Field Description

Removal The message that appears in content (Web postings, Web mail, or files) from which the system has
Message removed confidential information. Only the recipient sees this message.

Fallback option The action to take if Network Prevent for Web cannot remove confidential information that was
detected in an HTTP or HTTPS post.

The available options are Block (the default) and Allow.

Note: Symantec Data Loss Prevention removes confidential data in file uploads and, for Network
Prevent, Web mail attachments, even for sites in which it does not perform content removal. The
Fallback option is taken only in cases where Symantec Data Loss Prevention detects confidential
content in a recognized Web form, but it cannot remove the content.
 Response rule actions 1290
Configuring the Network Protect: Copy File action

Table 42-28 Network Prevent for Web: Remove HTTP/S Content parameters (continued)

Field Description

Rejection The message that Network Prevent for Web returns to a client when it blocks an HTTP or HTTPS
Message post. The client Web application may or may not display the rejection message, depending on how
the application handles error messages.

See “Implementing response rules” on page 1216.

Configuring the Network Protect: Copy File action

The Network Protect: Copy File response rule action copies a sensitive file to the local file
system.
See “About response rule actions” on page 1199.
This response rule action is only available for Network Discover that is configured for Network
Protect.
See “Response rule actions for Network Prevent detection” on page 1202.
To configure the Network Protect: Copy File response rule action
1 Configure a network file share and specify a location to copy files to.
See “Configuring Network Protect for file shares” on page 1619.
2 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
3 Select the Network Protect: Copy File action type from the Actions list.
This action does not require you to configure any parameters.
See “Configuring response rule actions” on page 1223.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.

Configuring the Network Protect: Quarantine File

action
The Network Protect: Quarantine File response rule action quarantines a file that the detection
server identifies as sensitive or protected.
See “About response rule actions” on page 1199.
 Response rule actions 1291
Configuring the Network Protect: Quarantine File action

This response rule action is only available for Network Discover that is configured for Network
Protect.
See “Response rule actions for Network Prevent detection” on page 1202.
To configure the Network Protect: Quarantine File response rule action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Network Protect: Quarantine File action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Configure the Network Protect: Quarantine File parameters.
See Table 42-29 on page 1291.
4 Click Save to save the configuration.
See “Manage response rules” on page 1219.

Table 42-29 Network Protect: Quarantine File configuration parameters

Parameter Description

Marker File Select this option to create a marker text file to replace the original file. This action notifies the user
what happened to the file instead of quarantining or deleting the file without any explanation.
Note: The marker file is the same type and has the same name as the original file, as long as it is a
text file. An example of such a file type is Microsoft Word. If the original file is a PDF or image file, the
system creates a plain text marker file. The system then gives the file the same name as the original
file with .txt appended to the end. For example, if the original file name is accounts.pdf, the marker file
name is accounts.pdf.txt.

Marker Text Specify the text to appear in the marker file. If you selected the option to leave the marker file in place
of the remediated file, you can use variables in the marker text.

To specify marker text, select the variable from the Insert Variable list.

For example, for Marker Text you might enter:

A message has violated the following rules in $POLICY$: $RULES

Or, you might enter:

$FILE_NAME$ has been moved to $QUARANTINE_PARENT_PATH$

See “Implementing response rules” on page 1216.

 Response rule actions 1292
Configuring the Network Protect: Encrypt File action

Configuring the Network Protect: Encrypt File action

The Network Protect: Encrypt File response rule action encrypts a file that the detection server
identifies as sensitive or protected. This functionality is available only if the Network Discover
ICE license is installed and the Enforce Server has been configured to connect to the Symantec
ICE Cloud.
See “Configuring the Enforce Server to connect to the Symantec ICE Cloud” on page 204.
For information about how Symantec Data Loss Prevention interacts with Symantec ICE, refer
to the Symantec Information Centric Encryption Deployment Guide.

Note: When a file is encrypted, the file extension changes to .html You must manually update
any links that point to the original unencrypted file.

See “About response rule actions” on page 1199.

For information about the limitations of the Network Protect: Encrypt File response rule action,
See “Response rule best practices” on page 1217.
This response rule action is only available for Network Discover that is configured for Network
Protect.
See “Response rule actions for Network Prevent detection” on page 1202.
To configure the Network Protect: Encrypt File response rule action
1 Configure a response rule at the Configure Response Rule screen.
See “Configuring response rules” on page 1221.
2 Add the Network Protect: Encrypt File action type from the Actions list.
See “Configuring response rule actions” on page 1223.
3 Click Save to save the configuration.
See “Manage response rules” on page 1219.
See “Implementing response rules” on page 1216.
 Section 6
Remediating and managing
incidents

■ Chapter 43. Remediating incidents

■ Chapter 44. Remediating Network incidents

■ Chapter 45. Remediating Endpoint incidents

■ Chapter 46. Remediating Discover incidents

■ Chapter 47. Working with Cloud Connector incidents

■ Chapter 48. Managing and reporting incidents

■ Chapter 49. Hiding incidents

■ Chapter 50. Working with incident data

■ Chapter 51. Working with user risk

■ Chapter 52. Implementing lookup plug-ins

 Chapter 43
Remediating incidents
This chapter includes the following topics:

■ About incident remediation

■ Remediating incidents

■ Executing Smart response rules

■ Incident remediation action commands

■ Response action variables

About incident remediation

As incidents occur in your system, individuals in your organization must analyze the incidents,
determine why they occurred, identify trends, and remediate the problems.
Symantec Data Loss Prevention provides a rich set of capabilities which can be used to build
an effective incident remediation process. Once you are ready to take action, you can use a
series of incident commands on the Incident Snapshot and Incident List pages.
Since the Incident Snapshot page displays details about one specific incident, you can select
a command to perform an action on the displayed incident.
On the Incident List page, you can perform an action on multiple incidents at one time. You
can select more than one incident from the list and then choose the desired command.
Table 43-1 describes the options that are involved in incident remediation:
 Remediating incidents 1295
About incident remediation

Table 43-1 Options involved in incident remediation

Remediation options Description

Role-based access control Access to incident information in the Symantec Data Loss Prevention system
can be tightly controlled with role-based access control. Roles control which
incidents a particular remediator can take action on, as well as what
information within that incident is available to the remediator. For example,
access control can be used to ensure that a given remediator can act only
on incidents originating within a particular business unit. In addition, it might
prevent that business unit's staff from ever seeing high-severity incidents,
instead routing those incidents to the security department.

See “About role-based access control” on page 93.

Severity level assignment Incident severity is a measure of the risk that is associated with a particular
incident. For example, an email message containing 50 customer records
can be considered more severe than a message containing 50 violations of
an acceptable use policy. Symantec Data Loss Prevention lets you specify
what constitutes a severe incident by configuring it at the policy rule level.
Symantec Data Loss Prevention then uses the severity of the incident to
drive subsequent responses to the incident. This process lets you prioritize
incidents and devote your manual remediation resources to the areas where
they are needed most.

Custom attribute lookup Custom attribute lookup is the process of collecting additional information
about the incident from data sources outside of Enforce and the incident
itself. For example, a corporate LDAP server can be queried for additional
information about the message sender, such as the sender's manager name
or business unit.

See “About using custom attributes” on page 1417.

For example, you can use custom attributes as input to subsequent automated
responses to automatically notify the sender's manager about the policy
violation.

See “Setting the values of custom attributes manually” on page 1420.

 Remediating incidents 1296
About incident remediation

Table 43-1 Options involved in incident remediation (continued)

Remediation options Description

Automated incident A powerful feature of the Enforce Server is the ability to automatically respond
responses to incidents as they arise. For example, you can configure the system to
respond to a serious incident by blocking the offending communication. You
can send an email message to the sender's manager. You can send an alert
to a security event management system. You can escalate the incident to
the security department. On the other hand, an acceptable use incident might
be dispensed with by sending an email message to the sender. Then you
can mark the incident as closed, requiring no further work. Between these
extremes, you can establish a policy that automatically encrypts transmissions
of confidential data to a business partner. All of these scenarios can be
handled automatically without user intervention.

See “Configuring response rule actions” on page 1223.

Smart Response Although the automated response is an important part of the remediation
process, SmartResponse is necessary at times, particularly in the case of
more serious incidents. Symantec Data Loss Prevention provides a detailed
Incident Snapshot with all of the information necessary to determine the next
steps in remediation. You can use SmartResponse to manually update
incident severity, status, and custom attributes, add comments to the incident.
You can move the incident through the remediation workflow to resolve it.

See “Configuring response rule actions” on page 1223.

The following standard SmartResponse actions are available:

■ Add Note
■ Log to a Syslog Server
■ Send Email Notification
■ Set Status

See “Configuring the Server FlexResponse action” on page 1245.

Distribution of aggregated You can create and automatically distribute aggregated incident reports to
incident reports data owners for remediation.

The Enforce Server handles all of these steps, except for Smart Response. You can handle
incidents in an entirely automated way. You can reserve manual intervention (Smart Response)
for only the most serious incidents.
See “Network incident snapshot” on page 1310.
See “Discover incident snapshot” on page 1335.
See “Endpoint incident snapshot” on page 1319.
 Remediating incidents 1297
Remediating incidents

Remediating incidents
When you remediate an incident, you can perform the following actions:
■ Set the incident’s status or severity.
■ Apply a Smart Response rule to the incident.
■ Set the incident’s custom attributes.
■ Add comments to the incident record.
■ Remediate incidents by going to an incident list or incident snapshot and selecting actions
to perform on one or more incidents.
■ Perform some combination of these actions.
You can import a solution pack during installation. Solution packs prepopulate incident lists
and incident snapshots with several remediation options and custom attributes. For complete
descriptions of all solution packs (including information about all remediation options and
custom attributes they contain), refer to the documentation for each of the solution packs in
the solutions packs directory in the documentation.
To remediate incidents
1 Access an incident list or incident snapshot.
In incident lists, Symantec Data Loss Prevention displays available remediation options
in the Incident Actions drop-down menu. The menu becomes active when you select
one or more incidents in the list (with the check box). In incident snapshots, Symantec
Data Loss Prevention also displays the available remediation options. You can set a
Status or Severity from the drop-down menus.
See “Viewing incidents” on page 1363.
You can also edit the Attributes and provide related information.
2 Take either of the following actions:
■ When you view an incident list, select the incident(s) to be remediated (check the box).
You can select incidents individually or select all incidents on the current screen. Then
select the wanted action from the Incidents Actions drop-down menu. For example,
select Incident Actions > Set Status > Escalated.
You can perform as many actions as needed.
■ When you view an incident snapshot, you can set the Status and Severity from the
drop-down menus.
If a Smart Response has been previously set up, you can select a Smart Response
rule in the remediation bar.
See “About response rules” on page 1199.
 Remediating incidents 1298
Executing Smart response rules

For example, if one of the Solution Packs was installed, you can select Dismiss False
Positive in the remediation bar. When the Execute Response Rule screen appears,
click OK. This Smart Response rule changes the incident status from New to
Dismissed and sets the Dismissal Reason attribute to False Positive.
You can perform as many remediation actions as needed.

Executing Smart response rules

When you execute a response rule that sends an email, you can manually compose the
contents of the email notification.

Note: Sending an email notification to the sender applies to SMTP incidents only. Also, the
notification addressees that are based on custom attributes (such as "manager email") work
correctly only if populated by the attribute lookup plug-in.

To compose an email notification response

1 Enter optional emails for copies in the CC field.
2 Select the language.
3 Compose or edit the subject and body of the email.
4 Insert variables for the fields in the incident. The supported variables appear as links to
the right of the editable fields.
For example, if you want to include the policy and rules violated, you might enter:

A message has violated the following rules in $POLICY$:

$RULES$

5 Click OK to send the notification.

See “Adding a new response rule” on page 1220.
See “About incident remediation” on page 1294.
See “Response action variables” on page 1300.

Incident remediation action commands

In an incident list, use the Incident Actions drop-down to select remediation actions.
The following incident actions are available for an incident list:
 Remediating incidents 1299
Incident remediation action commands

Add Note Add a brief note to the selected incident(s). The comment appears
on the Incident History tab of the Incident Snapshot page for each
selected incident.

Delete Incidents Delete the selected incident(s) from the Symantec Data Loss
Prevention system.

Proceed cautiously when deleting incidents. All data that is

associated with the incident(s) is removed. This operation cannot
be reversed.

Export Selected: CSV Export the selected incident(s) to a comma-separated (.csv) file.

Export Selected: XML Export the selected incident(s) to an XML file.

Hide/Unhide Select one of the following incident hiding actions to set the hidden
state for the selected incidents:

■ Hide Incidents—Flags the selected incidents as archived.

■ Unhide Incidents—Restores the selected incidents to the
non-archived state.
■ Do Not Hide—Prevents the selected incidents from being
archived.
■ Allow Hiding—Allows the selected incidents to be archived.

See “About incident hiding” on page 1406.

Lookup Attributes Use the configured lookup plug-ins to look up the configured
attributes.

Set Attributes Display the Set Attributes page so you can enter or edit the attribute
values for the selected incident(s).

Set Data Owner Set the following Data Owner attributes:

■ Name
■ Email Address

Set Severity Change the severity that is set for the selected incident(s) to one of
the options under Set Severity.

Set Status Change the status of the selected incident(s) to one of the options
under Set Status. A system administrator can customize the options
that appear on this list on the Incident Attributes page.

See “About incident status attributes” on page 1410.

 Remediating incidents 1300
Response action variables

Run Smart Response Perform one of the listed responses on the selected incident(s).
When you click a response rule, the Execute Response Rule page
appears.

These manual response rules are available only if you have

permission to remediate.

See “About incident remediation” on page 1294.

Response action variables

Response action variables can be used in response rules.
See “Executing Smart response rules” on page 1298.
The response action variables vary by incident type.
See “General incident variables” on page 1300.
See “Endpoint incident variables” on page 1302.
See “ Network Monitor and Network Prevent incident variables” on page 1301.
See “Discover incident variables” on page 1301.

General incident variables

The following general variables are available for all incident types:

$APPLICATION_NAME$ Specifies the name of the application that is associated with the
incident.

$ATTACHMENT_FILENAME$ Specifies the name of the attached file.

$BLOCKED$ Indication of whether or not Symantec Data Loss Prevention blocked

the message (yes or no).

$DESTINATION_IP$ Specifies the destination IP address.

$INCIDENT_ID$ The unique identifier of the incident.

$INCIDENT_SNAPSHOT$ The fully qualified URL to the incident snapshot page for the incident.

$MATCH_COUNT$ The incident match count.

$OCCURED_ON$ Specifies the date on which the incident occurred. This date may be
different than the date the incident was reported.

$POLICY$ The name of the policy that was violated.

 Remediating incidents 1301
Response action variables

$POLICY_RULES$ A comma-separated list of one or more policy rules that were violated.

$PROTOCOL$ The protocol, device type, and target type of the incident, where
applicable.

$RECIPIENTS$ A comma-separated list of one or more message recipients.

$REPORTED_ON$ Specifies the date on which the incident was reported.

$MONITOR_NAME$ Specifies the detection server or cloud detector that created the
incident.

$SENDER$ The message sender.

$SEVERITY$ The severity that is assigned to incident.

$STATUS$ Specifies the remediation status of the incident.

$SUBJECT$ The subject of the message.

$URL$ Specifies the file path or location.

Network Monitor and Network Prevent incident variables

The following Network Monitor and Network Prevent variables are available:

$DATAOWNER_NAME$ The person responsible for remediating the incident. This field must
be set manually, or with one of the lookup plug-ins.

Reports can automatically be sent to the data owner for remediation.

$DATAOWNER_EMAIL$ The email address of the person responsible for remediating the
incident. This field must be set manually, or with one of the lookup
plug-ins.

Discover incident variables

The following Network Discover/Cloud Storage Discover and Network Protect incident variables
are available:

$DATAOWNER_NAME$ The person responsible for remediating the incident. This field must
be set manually, or with one of the lookup plug-ins.

Reports can automatically be sent to the data owner for remediation.

$DATAOWNER_EMAIL$ The email address of the person responsible for remediating the
incident. This field must be set manually, or with one of the lookup
plug-ins.
 Remediating incidents 1302
Response action variables

$ENDPOINT_MACHINE$ The name of the endpoint computer that generated the violation.

$PATH$ The full path to the file in which the incident was found.

$FILE_NAME$ The name of the file in which the incident was found.

$PARENT_PATH$ The path to the parent directory of the file in which the incident was
found.

$QUARANTINE_PARENT_PATH$ The path to the parent directory in which the file was quarantined.

$SCAN_DATE$ The date of the scan that found the incident.

$TARGET$ The name of the target in which the incident was found.

Endpoint incident variables

The following Endpoint incident variables are available:

$APPLICATION_USER$ The name of the application user.

$DATAOWNER_NAME$ The person responsible for remediating the incident. This field must
be set manually, or with one of the lookup plug-ins.

Reports can automatically be sent to the data owner for remediation.

$DATAOWNER_EMAIL$ The email address of the person responsible for remediating the
incident. This field must be set manually, or with one of the lookup
plug-ins.

$ENDPOINT_LOCATION$ The location of the endpoint computer.

$ENDPOINT_MACHINE$ The name of the endpoint computer that generated the violation.

$ENDPOINT_USER_NAME$ The name of the Endpoint user.

$MACHINE_IP$ The corporate IP address of the endpoint computer.

$USER_JUSTIFICATION$ The justification that was provided by the endpoint user.

Cloud Connector incident variables

The following Cloud Connector incident variables are available:

$DATAOWNER_NAME$ The person responsible for remediating the incident. This field must
be set manually.

Reports can automatically be sent to the data owner for remediation.

 Remediating incidents 1303
Response action variables

$DATAOWNER_EMAIL$ The email address of the person responsible for remediating the
incident. This field must be set manually.
 Chapter 44
Remediating Network
incidents
This chapter includes the following topics:

■ Network incident list

■ Network incident list—Actions

■ Network incident list—Columns

■ Network incident snapshot

■ Network incident snapshot—Heading and navigation

■ Network incident snapshot—General information

■ Network incident snapshot—Matches

■ Network incident snapshot—Attributes

■ Network summary report

Network incident list

A network incident list shows multiple network incident records with information about the
incident such as: the severity, associated policy, number of matches, and status of the incident.
Click a row of the incident list to view more details about a specific incident. Select specific
incidents (or groups of incidents) to modify or remediate by clicking the check boxes at the
left.
When IPv6 addresses appear in reports, they follow these rules:
■ Addresses are normalized in the Source IP and Destination IP fields.
 Remediating Network incidents 1305
Network incident list

■ In the Recipient (URL) fields, addresses are represented as they have been provided,
which is usually a hostname and varies by protocol.
■ In the Sender fields, representation of addresses varies by protocol.
■ Normalized fields are used for IP-based filtering.
When IPv6 addresses appear in incident list filters, they follow these rules:
■ Addresses are normalized in the Source IP and Destination IP fields.
■ In the Recipient (URL) field, addresses are represented as they have been provided in
the Recipient (URL), Domain, and Sender fields.
■ Normalized fields are used for IP-based filtering.
When IPv6 addresses appear in incident details, they follow these rules:
■ Addresses are normalized in the Source IP and Destination IP fields.
■ In the Recipient (URL) field, addresses are represented as they have been provided.
■ In the Sender field, addresses are represented as they have been provided.
■ Links to filtered lists behave like user input.
You can view normalized IPv6 addresses in an incident summary:
■ Addresses are summarized by the Source IP, Destination IP, Sender, and Domain fields.
■ Normalization occurs for fields as it does in the incident details.
You can view non-normalized IPv6 addresses in an incident summary:
■ Addresses are summarized by the Source IP, Destination IP, Sender, and Domain fields.
■ Normalization occurs for fields as it does in the incident details.

Note: Use caution when you click Select All. This action selects all incidents in the report (not
only those on the current page). Any incident command you subsequently apply affects all
incidents. To select only the incidents on the current page, select the checkbox at top left of
the incident list.

Incident information is divided into several columns. Click any column header to sort
alpha-numerically by that column's data. To sort in reverse order, click the column header a
second time. By default, Symantec Data Loss Prevention sorts incidents by date.
The Type column shows the icons that indicate the type of network incident. Table 44-1
describes the icons.
 Remediating Network incidents 1306
Network incident list

Table 44-1 Type of network incident

Icon Description

SMTP
The addition of the second icon indicates a message
attachment.

HTTP

Symantec Data Loss Prevention also detects the

Yahoo and MSN IM traffic that is tunneled through
HTTP.

The addition of the second icon indicates an

attachment to Web-based email.

HTTPS

FTP

NNTP

IM:MSN

IM:AIM

IM:Yahoo

TCP:custom_protocol

This column also indicates whether the communication was blocked or altered. Table 44-2
shows the possible values.

Table 44-2 Incident block or altered status

Icon Description

No icon. Blank if the communication was not blocked.

Indicates Symantec Data Loss Prevention blocked

the communication containing the matched text.
 Remediating Network incidents 1307
Network incident list—Actions

Table 44-2 Incident block or altered status (continued)

Icon Description

Indicates Symantec Data Loss Prevention removed

confidential data from Web postings or Web-based
email messages. This icon can also indicate that a
file was uploaded to a Web site or attached to a
Web-based email message.

Indicates that Symantec Data Loss Prevention

added or modified the headers on the message that
generated the incident.

Use the following links to learn more about the Network incident list page:

To learn more about See this section

Columns of the incident list table See “Network incident list—Columns” on page 1309.

Actions to perform on selected incidents See “Network incident list—Actions” on page 1307.

Details of a specific incident See “Network incident snapshot” on page 1310.

Viewing a summary of all network incidents See “Network summary report” on page 1314.

Common features of all Symantec Data Loss See “About incident reports” on page 1354.
Prevention reports
See “Common incident report features” on page 1381.

See “Saving custom incident reports” on page 1366.

Network incident list—Actions

You can select one or more incidents and then remediate them using commands in the Incident
Actions drop-down list. The incident commands are as follows:

Action Description

Add Note Select to open a dialog box, type a comment, and

then click OK.
 Remediating Network incidents 1308
Network incident list—Actions

Action Description

Hide/Unhide Select one of the following archive actions to set

the archive state for the selected incidents:

■ Hide Incidents—Flags the selected incidents

as archived.
■ Unhide Incidents—Restores the selected
incidents to the non-archived state.
■ Do Not Hide—Prevents the selected incidents
from being archived.
■ Allow Hiding—Allows the selected incidents to
be archived.

See “About incident hiding” on page 1406.

Delete Incidents Select to delete specified incidents.

Export Selected: CSV Select to save specified incidents in a

comma-separated text (.csv) file or XML file, which
Export Selected: XML
can be displayed in several common applications,
such as Microsoft Excel.

Lookup Attributes Use lookup plug-ins to look up incident custom

attributes.

Run Smart Response Select to run a Smart Response rule that you or
your administrator configured. (To configure a Smart
Response rule, navigate to Policy > Response
Rules, click Add Response Rule, and select Smart
Response.

Set Attributes Select to set attributes for the selected incidents.

Set Data Owner Set the data owner name or email address. The
data owner is the person responsible for remediating
the incident.

Reports can automatically be sent to the data owner

for remediation.

Set Severity Select to set severity.

Set Status Select to set status.

See “About incident remediation” on page 1294.

See “Network incident list” on page 1304.
 Remediating Network incidents 1309
Network incident list—Columns

Network incident list—Columns

Incident information is divided into several columns. Click any column header to sort
alpha-numerically by that column's data. To sort in reverse order, click the column header a
second time. By default, Symantec Data Loss Prevention lists incidents by date.
The report includes the following columns:
■ Check boxes that let you select incidents to remediate.
You can select one or more incidents to which to apply commands from the Incident
drop-down menu at the top of the list. Click the checkbox at the top of the column to select
all incidents on the current page. (Note that you can also click Select All at far right to select
all incidents in the report.)
■ Type
The protocol over which the match was detected.
See “Network incident list” on page 1304.
■ Subject/Sender/Recipient(s)
Message subject, sender email address or IP address, recipient email address(es), or
URL(s).
■ Sent
Date and time the message was sent.
■ ID/Policy
Symantec Data Loss Prevention incident ID number and the policy against which the
incident was logged.
■ Matches
Number of matches in the incident.
■ Sev
Incident severity as determined by the severity setting of the rule the incident matched.
The possible values are as follows:

Icon Description

High

Medium

Low

For information only

■ Status
 Remediating Network incidents 1310
Network incident snapshot

Current incident status.

The possible values are as follows:
■ New
■ In Process
■ Escalated
■ False Positive
■ Configuration Errors
■ Resolved
You or your administrator can add new status designations on the Attribute Setup page.
See “Network incident list” on page 1304.

Network incident snapshot

An incident snapshot provides detailed information about a particular incident. It displays
general incident information, matches detected in the intercepted text, and incident attributes.
The snapshot also enables you to execute any Smart Response rules that you have configured.
The incident snapshot is divided into three panes, with navigation and Smart Response options.
Click on a link to view more help about the incident snapshot:

To learn more about See the section

Navigation and Smart Response options See “Network incident snapshot—Heading and
navigation” on page 1310.

General incident information (left-hand pane) See “Network incident snapshot—General

information” on page 1311.

Matches in incident (middle pane) See “Network incident snapshot—Matches”

on page 1313.

Attributes (right-hand pane) See “Network incident snapshot—Attributes”

on page 1314.

Network incident snapshot—Heading and navigation

The following page navigation tools appear near the top of the incident snapshot:

Previous Displays the previous incident in the source report.

Next Displays the next incident in the source report.

 Remediating Network incidents 1311
Network incident snapshot—General information

Returns to the source report (where you clicked the

link to get to this screen).

Updates the snapshot with any new data, such as

a new comment in the History section or a modified
status.

If you configured any Smart Response rules, Symantec Data Loss Prevention displays the
response options for executing the rules at the top of the page. Depending on the number of
Smart Response rules, a drop-down menu may also appear.
See “Network incident snapshot” on page 1310.

Network incident snapshot—General information

The left section of the snapshot displays general incident information. You can click on many
values to view an incident list that is filtered on that value. An icon may appear next to the
Status drop-down list to indicate whether the request that generated the incident was blocked
or altered.
See Table 44-2 on page 1306.
The current status and severity of the incident appear to the right of the snapshot heading. To
change one of the current values, click on it and choose another value from the drop-down
list.
The remaining portion of the general information pane is divided into four tabs.
■ Key Info
■ History
■ Notes
■ Correlations
Information in this section is divided into the following categories (not all of which appear for
every incident type):
 Remediating Network incidents 1312
Network incident snapshot—General information

Table 44-3 Incident general information tabs

Tab Name Description

Key Info The Key Info tab shows the policy that was violated in the incident. It also
shows the total number of matches for the policy, as well as matches per
policy rule. Click the policy name to view a list of all incidents that violated
the policy. Click view policy to view a read-only version of the policy.

This section also lists other policies that the same file violated. To view
the snapshot of an incident that is associated with a particular policy, click
go to incident next to the policy name. To view a list of all incidents that
the file created, click show all.

The Key Info tab also includes the following information:

■ The name of the detection server that recorded the incident.

■ The date and time the message was sent
■ The sender email or IP address
■ The recipient email or IP address(es)
■ The SMTP heading or the NNTP subject heading
■ The Is Hidden field displays the archived state of the incident, whether
or not the incident is hideable, and allows you to toggle the Do Not
Hide flag for the incident.
■ Attachment file name(s). Click to open or save the file.
If a response rule tells Symantec Data Loss Prevention to discard the
original message, you cannot view the attachment.
■ The person responsible for remediating the incident (Data Owner
Name). This field must be set manually, or with a lookup plug-in.
Reports can automatically be sent to the data owner for remediation.
If you click on a hyperlinked Data Owner Name, a filtered list of
incidents by Data Owner Name is displayed.
■ The email address of the person responsible for remediating the
incident (Data Owner Email Address). This field must be set
manually, or with a lookup plug-in.
If you click on the hyperlinked Data Owner Email Address, a filtered
list of incidents by Data Owner Email Address is displayed.

History View the actions that were performed on the incident. For each action,
Symantec Data Loss Prevention displays the action date and time, the
actor (a user or server), and the action or the comment.

See “Executing Smart response rules” on page 1298.

See “Manage response rules” on page 1219.

Notes View any notes that you or others have added to the incident. Click Add
Note to add a note.
 Remediating Network incidents 1313
Network incident snapshot—Matches

Table 44-3 Incident general information tabs (continued)

Tab Name Description

Correlations You can view a list of those incidents that share attributes of the current
incident. For example, you can view a list of all incidents that a single
account generated. The Correlations tab shows a list of correlations that
match single attributes. Click on attribute values to view lists of those
incidents that are related to those values.

To search for other incidents with the same attributes, click Find Similar.
In the Find Similar Incidents dialog box that appears, select the desired
search attributes. Then click Find Incidents.
Note: The list of correlated incidents does not display related incidents
that have been hidden.

See “Network incident snapshot” on page 1310.

See “About incident hiding” on page 1406.

Network incident snapshot—Matches

Beneath the general information, Symantec Data Loss Prevention displays the message
content (if applicable) and the matches that caused the incident. Symantec Data Loss Prevention
displays the following types of message content, depending on protocol type:

Protocol Message content

SMTP Message body

HTTP Name value pairs of the HTTP request

FTP Nothing shown

NNTP Message body

IM (all providers) IM conversation

TCP Data that was transmitted through custom protocol

Matches are highlighted in yellow and organized according to the message component (such
as header, body, or attachment) in which they were detected. Symantec Data Loss Prevention
displays the total relevant matches for each message component. It shows matches by the
order in which they appear in the original text. To view the rule that triggered a match, click
on the highlighted match.
See “About the Similarity Threshold and Similarity Score” on page 567.
 Remediating Network incidents 1314
Network incident snapshot—Attributes

See “Network incident snapshot” on page 1310.

Network incident snapshot—Attributes

Note: This section appears only if a system administrator has configured custom attributes.

You can view a list of custom attributes and their values, if any have been specified. Click on
attribute values to view an incident list that is filtered on that value. To add new values or edit
existing ones, click Edit. In the Edit Attributes dialog box that appears, type the new values
and click Save.
See “Setting the values of custom attributes manually” on page 1420.
See “Network incident snapshot” on page 1310.

Network summary report

The Network summary report provides summary information about the incidents that are found
on your network. You can organize the report by one or two summary criteria. A single-summary
report is organized by a single summary criterion, such as the policy that is associated with
each incident. A double-summary report is organized by two criteria, such as policy and incident
status.
To view the primary criteria and the secondary summary criteria available for the current report,
click the Advanced Filters & Summarization bar. The bar is near the top of the report. The
Summarize By: listboxes show the primary criteria and the secondary summary criteria. In
each listbox, Symantec Data Loss Prevention displays all out-of-the-box criteria in alphabetical
order, followed by any custom criteria that your system administrator has defined. Summary
reports take their name from the primary summary criterion (the value of the first listbox). If
you rerun a report with new criteria, the report name changes accordingly.
Summary entries are divided into several columns. Click any column header to sort
alpha-numerically by that column's data. To sort in reverse order, click the column header a
second time.
 Remediating Network incidents 1315
Network summary report

Table 44-4 Summary report columns

Column name Description

summary_criterion This column is named for the primary summary

criterion. It lists primary and (for double summaries)
secondary summary items. In a Policy Summary,
this column is named Policy and it lists policies.
Click on a summary item to view a list of incidents
that are associated with that item.

Total The total number of incidents that are associated

with the summary item. In a Policy Summary, this
column gives the total number of incidents that are
associated with each policy.

High Number of high-severity incidents that are

associated with the summary item. (The severity
setting of the rule that was matched determines the
incident severity.)

Med Number of medium-severity incidents that are

associated with the summary item.

Low Number of low-severity incidents that are associated

with the summary item.

Info The number of informational incidents that are

associated with the summary item.

Bar Chart A visual representation of the number of incidents

(of all severities) associated with the summary item.
The bar is broken into proportional, colored sections
to represent the various severities.

Matches Total number of matches associated with the

summary item.

If any of the severity columns contain totals, you can click on them to view a list of incidents
of the chosen severity.
See “Common incident report features” on page 1381.
See “About dashboard reports and executive summaries” on page 1356.
See “About incident reports” on page 1354.
See “Saving custom incident reports” on page 1366.
 Chapter 45
Remediating Endpoint
incidents
This chapter includes the following topics:

■ About endpoint incident lists

■ Endpoint incident snapshot

■ Reporting on Endpoint Prevent response rules

■ Endpoint incident destination or protocol-specific information

■ Endpoint incident summary reports

About endpoint incident lists

An endpoint incident list shows endpoint incidents that contain basic information such as
protocol or destination, severity, associated policy, number of matches, and status. Click on
any incident to view a snapshot containing more incident details. You can select specific
incidents (or groups of incidents) to modify or remediate.

Note: Endpoint reports show only the incidents that were captured by Endpoint Prevent.
Incidents that were captured by Endpoint Discover appear in Network Discover reports.

Incident information is divided into several columns. Click any column header to sort
alpha-numerically by the data in that column. To sort in reverse order, click the column header
a second time. By default, Symantec Data Loss Prevention lists incidents by date.
The report includes the following columns:
■ Check boxes that let you select incidents to remediate
 Remediating Endpoint incidents 1317
About endpoint incident lists

You can select one or more incidents to which to apply commands from the Incident drop-down
menu at the top of the list. Click the checkbox at the top of the column to select all incidents
on the current page. (You can click Select All at far right to select all incidents in the report.)

Table 45-1 Type of endpoint incident

Graphic Type of incident

CD/DVD burner (for example, Windows Media

burner)

Removable media (for example, a USB flash drive

or SD card)

Fixed drive (for example, the C:\ drive)

Endpoint copy to network share

Email/SMTP

HTTP

HTTPS

FTP

IM: MSN

IM: Yahoo

Print/Fax

Clipboard

Application File Access

A response column that indicates whether Symantec Data Loss Prevention blocked an
attempted violation or notified the end user about the violation of confidential data.
The possible values are as follows:
 Remediating Endpoint incidents 1318
About endpoint incident lists

■ Blank if Symantec Data Loss Prevention did not block the violation or notify the end user
■ A red icon indicates the violation was blocked by Symantec Data Loss Prevention, by the
user, or if the user cancel option time limit expired.
■ A notification icon indicates Symantec Data Loss Prevention notified the end user about
the violated confidential data policies. The notification icon also appears if the user allowed
the violating data transfer. The icon also appears if the user cancel time limit option has
expired and the default action is set to allow data transfers.
The other columns of this section appear as follows:

Table 45-2 Endpoint incident columns

Column Definition

File Name/Machine/User/Subject/Recipient File name, computer, endpoint user (domain and

logon name), subject title (if Email/SMTP violation),
and recipient user that is associated with the
incident.

When temporary files generate incidents on Mac

agents, the temporary file name displays in the File
Name column.

Occurred On Date ■ Incident date and time

■ Reported On Date
■ Time and date that the incident was reported. If
the endpoint is disconnected from the corporate
network, incidents are reported when the
connection is restored.

ID/Policy Symantec Data Loss Prevention incident ID number

and the policy against which the incident was
logged.

Matches Number of matches in the incident.

Severity Incident severity as determined by the severity

setting of the rule the incident matched.

The possible values are as follows:

■ High
■ Medium
■ Low
■ For information only
 Remediating Endpoint incidents 1319
Endpoint incident snapshot

Table 45-2 Endpoint incident columns (continued)

Column Definition

Status Current incident status.

The possible values are as follows:

■ New
■ In Process
■ Escalated
■ False positive
■ Configuration Errors
■ Resolved

You or your administrator can add new status designations on the Attribute Setup page.
See “Endpoint incident snapshot” on page 1319.
See “About incident remediation” on page 1294.
See “About incident reports” on page 1354.
See “Saving custom incident reports” on page 1366.

Endpoint incident snapshot

An incident snapshot provides detailed information about a particular Endpoint Prevent incident.
It displays general incident information, matches detected in the intercepted text, and details
about attributes, incident history, and the violated policy. You can also search for similar
incidents in the Correlations area.

Note: Endpoint Discover incidents are captured in Network Discover reports.

See “Discover incident lists” on page 1332.

Current status and severity appear under the snapshot heading. To change one of the current
values, click on it and choose another value from the drop-down list. If any action icon is
associated, it also appears here.
If you have configured any Smart Response rules, Symantec Data Loss Prevention displays
a Remediation bar (under the Status bar). The Remediation bar includes options for executing
the rules. Depending on the number of Smart Response rules, a drop-down menu may also
appear.
The top left section of the snapshot displays general incident information. You can click most
information values to view an incident list that is filtered on that value. Information in this section
is divided into the following categories (not all of which appear for every incident type):
 Remediating Endpoint incidents 1320
Endpoint incident snapshot

Table 45-3 Type of incident

Icon Incident type

CD/DVD burners (for example, Windows Media

burner)

Removable media (for example, a USB flash drive

or SD card)

Local drive

Network Share

Email/SMTP

HTTP

HTTPS/SSL

FTP

IM: MSN

IM: Yahoo

Print/Fax

Clipboard

Application File Access

The following table contains the other informational sections:

 Remediating Endpoint incidents 1321
Endpoint incident snapshot

Table 45-4 Incident sections

Section Description

Server Name of the Endpoint Server that detected the

incident for two-tier detection. Or, it is the name of
the Endpoint Server that received the incident from
the Symantec DLP Agent.

Agent response The Endpoint Block, Endpoint Notify, Endpoint

Quarantine, Endpoint FlexResponse, or User
Cancel action, if any. The possible values are as
follows:

■ Blank or no icon if Symantec Data Loss

Prevention did not block the copy or notify the
end user.
■ A red circle icon indicates Symantec Data Loss
Prevention blocked confidential data.
■ A message icon indicates Symantec Data Loss
Prevention notified the end user that the data is
confidential.

See Reporting on Endpoint Prevent Response

Rules.

Incident Occurred On Date and time the incident occurred.

Incident Reported On Date and time the Endpoint Server detected the
incident.

Is Hidden Displays the hidden state of the incident, whether

or not the incident is hideable, and allows you to
toggle the Do Not Hide flag for the incident. See
“About incident hiding” on page 1406.

User Endpoint user name (for example,

MYDOMAIN\bsmith).

User Justification The justification label precedes by the text that is

presented to the end user in the on-screen
notification (for example, Manager Approved: "My
manager approved the transfer of this data.")
Symantec Data Loss Prevention uses the label for
classification and filtering purposes in reports, but
the endpoint user never sees it. Click the label to
view a list of incidents in which the end user chose
this justification.

Machine Name Computer on which the incident occurred.

 Remediating Endpoint incidents 1322
Endpoint incident snapshot

Table 45-4 Incident sections (continued)

Section Description

Machine IP (Corporate) The IP address of the violating computer if the

computer was on the corporate network.

File name Name of the file that violated the policy. The file
name field appears only for fixed-drive incidents.

Quarantine Result If you have Endpoint Discover: Quarantine response

rules configured, you may see one of the following
quarantine scenarios:

■ File Quarantined
■ Quarantine Failed
■ Quarantine Result Timeout

Quarantine Location Displays the file path of the secure location where
the file was moved.

Quarantine Details Displays the reason that the quarantine task failed
to move the confidential file. For example, the action
may fail because the source file is missing, or the
credentials to access the secure location are
incorrect.

The Quarantine Details file also displays information

if the status of the quarantined file is unknown
because of a Quarantine Result Timeout event.

Endpoint Location Indicates whether or not the endpoint was

connected to the corporate network at the time the
incident occurred.

Application Name The name of the application that caused the

incident.

Destination The destination location or file path for the

confidential data, depending on the device or
protocol.

Destination IP The destination IP address for the confidential data.

The Destination IP address appears only for specific
network incidents.

Source The original file or data for the violation. The source
primarily appears in file-transfer incidents.
 Remediating Endpoint incidents 1323
Endpoint incident snapshot

Table 45-4 Incident sections (continued)

Section Description

Sender The sender of the confidential data for network

violations.

Recipient The intended recipient of the confidential data for

network violations.

FTP User Name The originating user name for violating FTP
transfers.

Attachments The associated file(s) or attachments sent (for

network incidents). If your administrator has
configured Symantec Data Loss Prevention to retain
endpoint incident data, you can click on a file name
to view file contents.

Data Owner The specified owner of the confidential data.

Data Owner Email Address The email address for the owner of the confidential
data.

Access information The available ACL information. Only applicable to

Endpoint Discover and Endpoint Prevent local drive
monitoring.

See “Incident snapshot access information section”

on page 1387.

Other sections of the incident snapshot are common across all Symantec Data Loss Prevention
products. These common sections include:
■ Incident snapshot matches
See “Incident snapshot matches section” on page 1386.
■ Incident snapshot policy section
See “Incident snapshot policy section” on page 1386.
■ Incident snapshot correlations section
See “Incident snapshot correlations tab” on page 1386.
■ Incident snapshot attributes section. (This section appears only if a system administrator
has configured custom attributes.)
See “Incident snapshot policy section” on page 1386.
■ Incident snapshot history section
See “Incident snapshot history tab” on page 1385.
 Remediating Endpoint incidents 1324
Reporting on Endpoint Prevent response rules

The Endpoint incident snapshot also contains two sections that are not common across other
product lines. Those sections are:
■ Destination or protocol-specific information
See “Endpoint incident destination or protocol-specific information” on page 1325.
■ Reporting on Endpoint Prevent response rules
See “Reporting on Endpoint Prevent response rules” on page 1324.

Reporting on Endpoint Prevent response rules

If user activity on the endpoint triggers more than one response rule, Symantec Data Loss
Prevention determines which policy to apply based on an established order of precedence.
Only the response rule that is associated with the prevailing policy is executed. Symantec
Data Loss Prevention creates incidents for all policies that are violated. It indicates (in the
relevant incident snapshots) that the response rules were superseded.
See “Endpoint incident snapshot” on page 1319.
By default, the following list is the main order of precedence for Endpoint Prevent incidents:
■ Block
■ User Cancel
■ Endpoint FlexResponse
■ Notify

Note: For Endpoint Discover, Quarantine incidents always take precedence over Endpoint
FlexResponse incidents.

Be aware of the following behavior regarding reporting of superseded incidents:

■ The snapshot of a superseded Endpoint Block or User Cancel incident still displays the
Blocked icon, because Symantec Data Loss Prevention did block the content in question.
The icon also indicates if the content was blocked because the user elected to block the
content. Alternately, the icon indicates that the user cancel time limit was exceeded and
the content was blocked.
■ The snapshot of a superseded Endpoint Notify incident does not include the Notify icon.
The Notify icon is not included because Symantec Data Loss Prevention did not display
the particular on-screen notification that was configured in the policy.
■ The snapshot of a superseded Endpoint Quarantine incident displays the Blocked icon
because the data did not move out of the secured area. The icon also indicates if the content
was blocked because the user elected to block the content. Alternately, the icon indicates
that the user cancel time limit was exceeded and the content was blocked. The History tab
 Remediating Endpoint incidents 1325
Endpoint incident destination or protocol-specific information

of the incident snapshot always displays information on whether the Endpoint FlexResponse
rule was successful.
■ The snapshot of a superseded Endpoint FlexResponse incident displays the Blocked icon
because the data did not move out of the secured area. The icon also indicates if an
Endpoint Quarantine response rule was activated.
If you have configured Endpoint Prevent response rules to display on-screen notifications
prompting users to justify their actions, the following statements are true:
■ Symantec Data Loss Prevention displays the user justification in the snapshots of all the
incidents that are generated by the policies that include the executed response rule.
■ Symantec Data Loss Prevention displays the justification Superseded – Yes in the
snapshots of all superseded incidents that do not include the executed response rule.
■ If there is no user to enter a justification, for example if a user accesses a remote computer,
the justification reads N/A.
See “Network incident snapshot” on page 1310.
See “Configuring response rule conditions” on page 1222.
See “About incident reports” on page 1354.
See “Manage response rules” on page 1219.

Endpoint incident destination or protocol-specific

information
Depending on the type of incident, additional information that is associated with the incident
snapshot is visible.

Table 45-5 Destination or protocol-specific information

Destination or protocol Description

URL For network incidents, denotes the URL where the

incident occurred.

Source IP and Port For network incidents, denotes the IP address or

port of the endpoint that originated the incident. This
information is only shown if the incident is created
on this endpoint.

Destination IP and Port The IP address of the destination endpoint that is

associated with the incident. This information is only
shown if the incident is created on this endpoint.
 Remediating Endpoint incidents 1326
Endpoint incident summary reports

Table 45-5 Destination or protocol-specific information (continued)

Destination or protocol Description

Sender/Recipient Email For Email/SMTP and IM incidents, incidents also

contain the email addresses of the sender and
recipient. The sender or recipient email address are
only shown if the incident occurs on them.

Subject The subject line of the Email/SMTP message is

displayed.

FTP user name at the FTP Destination For FTP incidents, the user name at the FTP
destination is displayed.

Server IP For FTP incidents, the server IP address is shown.

File Name/Location For print/fax incidents, the name of the file and the
location of the file on the endpoint is displayed.

Print Job Name For print/fax incidents, the print job name is the file
name of the printing job that generated the incident.

Printer Name/Type For print/fax incidents, the printer name and type
are only displayed if the file cannot be named
through from the Print Job name. Or, if the file was
generated from an Internet browser.

Application Window For Clipboard incidents, the application window is

the application name from which the contents of the
Clipboard were taken.

Source Application For Clipboard incidents, the application name from

which the contents of the Clipboard were taken.

Source Application Window Title For Clipboard incidents, the application window
name from which the contents of the Clipboard were
taken.

Title Bar For Clipboard incidents, the title bar is the window
from which the data was copied.

See “Endpoint incident snapshot” on page 1319.

Endpoint incident summary reports

Endpoint incident summary reports provide information about those Endpoint incidents that
has been summarized by specific criteria. You can summarize incidents by one or more types
 Remediating Endpoint incidents 1327
Endpoint incident summary reports

of criteria. A single-summary report is organized by a single summary criterion, such as the

policy that is associated with each incident. A double-summary report is organized by two or
more criteria, such as policy and incident status.

Note: Endpoint reports show only the incidents that are captured by Endpoint Prevent. Incidents
from Endpoint Discover appear in Network Discover reports.

To view the primary and the secondary summary criteria available for the report, go to the
Summarize By link. Click Edit. In the Primary and Secondary drop-down menus, Symantec
Data Loss Prevention displays all of the criteria in alphabetical order, followed by custom
criteria your system administrator defined. You can select criteria from the Primary and
Secondary drop-down menus and then click Run Now to create a new summary report.
Summary reports take their name from the primary summary criterion. If you rerun a report
with new criteria, the report name changes accordingly.
See “About filters and summary options for reports” on page 1388.
Summary entries are divided into several columns. Click any column header to sort
alpha-numerically by that column's data. To sort in reverse order, click the column header a
second time.

Table 45-6 Endpoint incident summary report details

Field Description

Summary criteria This column contains the name of whichever

summery criteria you selected. If you select a
primary and a secondary summary criteria, only the
primary criteria is displayed.

Total Total number of the incidents that are associated

with the summary item. For example, in a Policy
Summary this column gives the total number of
incidents that are associated with each policy.

High Number of high-severity incidents that are

associated with the summary item. (The severity
setting of the rule that was matched determines the
level of severity.)

Med Number of medium-severity incidents that are

associated with the summary item.

Low Number of low-severity incidents that are associated

with the summary item.
 Remediating Endpoint incidents 1328
Endpoint incident summary reports

Table 45-6 Endpoint incident summary report details (continued)

Field Description

Info Number of the informational incidents that are

associated with the summary item.

Bar Chart A visual representation of the number of incidents

(of all severities) associated with the summary item.
The bar is broken into proportional colored sections
that represent the various severities.

Matches Total number of matches associated with the

summary item.

If any of the severity columns contain totals, you

can click on them to view a list of incidents of the
chosen severity.
 Chapter 46
Remediating Discover
incidents
This chapter includes the following topics:

■ About reports for Network Discover

■ About incident reports for Network Discover/Cloud Storage Discover

■ Discover incident reports

■ Discover incident lists

■ Discover incident actions

■ Discover incident entries

■ Discover incident snapshot

■ Discover summary reports

About reports for Network Discover

Symantec Data Loss Prevention has reports for incidents, Network Discover/Cloud Storage
Discover targets, scan details, and scan history.
The Network Discover/Cloud Storage Discover incident reports contain details about the
confidential data that is exposed.
See “About incident reports for Network Discover/Cloud Storage Discover” on page 1330.
For information about Network Discover/Cloud Storage Discover targets and scan history, go
to Manage > Discover Scanning > Discover Targets, then select one of the Discover targets
from the list. For information about Network Discover/Cloud Storage Discover scan details,
 Remediating Discover incidents 1330
About incident reports for Network Discover/Cloud Storage Discover

go to Manage > Discover Scanning > Scan History, then select one of the Discover scans
from the list.
See “Managing Network Discover/Cloud Storage Discover target scans” on page 1553.
Table 46-1 lists the Network Discover/Cloud Storage Discover reports.

Table 46-1 Network Discover/Cloud Storage Discover Reports

Report Navigation

Network Discover/Cloud This report is on the Enforce Server administration console, Manage menu,
Storage Discover Targets Discover Scanning > Discover Targets.

See “About the Network Discover/Cloud Storage Discover scan target list”
on page 1553.

Scan Status This report is on the Enforce Server administration console, Manage menu,
Discover Scanning > Discover Servers.

See “Viewing Network Discover/Cloud Storage Discover server status”

on page 1564.

Scan History (single This report is from the Enforce Server administration console, Manage
target) menu, Discover Scanning > Discover Targets. Click the link in the Scan
Status column to see the history of a particular scan target.

See “About Discover and Endpoint Discover scan histories” on page 1556.

Scan History (all targets) This report is from the Enforce Server administration console, Manage
menu, Discover Scanning > Scan History.
See “About Discover and Endpoint Discover scan histories” on page 1556.

Scan Details This report is from the Enforce Server administration console, Manage
menu, Discover Scanning > Scan History. Click the link in the Scan Status
column to see the scan details.

See “About Discover scan details” on page 1559.

About incident reports for Network Discover/Cloud

Storage Discover
Use incident reports to track and respond to Network Discover/Cloud Storage Discover incidents.
You can save, send, export, or schedule Symantec Data Loss Prevention reports.
See “About Symantec Data Loss Prevention reports” on page 1352.
In the Enforce Server administration console, on the Incidents menu, click Discover This
incident report displays all incidents for all Discover targets. You can select the standard reports
 Remediating Discover incidents 1331
Discover incident reports

for all incidents, new incidents, target summary, policy by target, status by target, or top shares
at risk.
Summaries and filter options can select which incidents to display.
See “About custom reports and dashboards” on page 1364.
See “About filters and summary options for reports” on page 1388.
You can create custom reports with combinations of filters and summaries to identify the
incidents to remediate.
For example you can create the following reports:
■ A summary report of the number of incidents in each remediation category.
Select the summary Protect Status.
■ A report of all the incidents that were remediated with copy or quarantine.
Select the filter Protect Status with values of File Copied and File Quarantined.
■ A report of the Network Discover incidents that have not been seen before (to identify these
incidents and notify the data owners to remediate them).
Select the filter Seen Before?. Set a value of No.
■ A report of the Network Discover incidents that are still present (to know which incidents
to escalate for remediation).
Select the filter Seen Before?. Set a value of Yes.
■ A report using the summary filters, such as months since first detected.
Select the summary Months Since First Detected.

Discover incident reports

Use Network Discover/Cloud Storage Discover incident reports to monitor and respond to
Network Discover/Cloud Storage Discover incidents. You can save, send, export, or schedule
Symantec Data Loss Prevention reports.
In the Enforce Server administration console, on the Incidents menu, click Discover This
incident report displays all incidents for all Discover targets. You can select the standard reports
for all incidents, new incidents, target summary, policy by target, status by target, or top shares
at risk.
Summaries and filter options can select which incidents to display.
See “Incident report filter and summary options” on page 1383.
You can create custom reports with combinations of filters and summaries to identify the
incidents to remediate.
See “About custom reports and dashboards” on page 1364.
 Remediating Discover incidents 1332
Discover incident lists

Network Discover has the following types of reports:

■ Incident list
See “Discover incident lists” on page 1332.
■ Incident snapshot
See “Discover incident snapshot” on page 1335.
■ Incident summary
See “Discover summary reports” on page 1338.

Discover incident lists

A Discover incident list shows the incidents that are reported during Discover scans (including
the incidents from Endpoint Discover). Individual incident records contain information such as
severity, associated policy, number of matches, and status.
See “ Discover incident entries” on page 1333.
You can select specific incidents (or a group of incidents) to modify or remediate.
See “Discover incident actions” on page 1332.
You can click on any incident to view a snapshot containing more details.
See “Discover incident snapshot” on page 1335.
See “Discover incident reports” on page 1331.

Discover incident actions

You can select one or more incidents and then remediate them using commands in the Incident
Actions drop-down list.
The incident commands are as follows:
■ Add Note
Select to open a dialog box, type a comment, and then click OK.
■ Delete Incidents
Select to delete specified incidents.
■ Export Selected: CSV
Select to save specified incidents in a comma-separated text (.csv) file, which can be
displayed in several common applications, such as Microsoft Excel.
■ Export Selected: XML
Select to save specified incidents in an XML file, which can be displayed in several common
applications.
 Remediating Discover incidents 1333
Discover incident entries

■ Hide/Unhide
Select one of the following actions to set the display state for the selected incidents:
■ Hide Incidents—Flags the selected incidents as hidden.
■ Unhide Incidents—Restores the selected incidents to the unhidden state.
■ Do Not Hide—Prevents the selected incidents from being hidden.
■ Allow Hiding—Allows the selected incidents to be hidden.
See “About incident hiding” on page 1406.
■ Set Attributes
Select to set attributes for the selected incidents.
■ Set Data Owner
Set the data owner name or email address. The data owner is the person responsible for
remediating the incident.
Reports can automatically be sent to the data owner for remediation.
■ Set Status
Select to set status.
■ Set Severity
Select to set severity.
■ Lookup Attributes
Use the lookup plug-ins to look up incident custom attributes.
■ Run Smart Response
Select to run a Smart Response rule you or your administrator configured.
See “Discover incident lists” on page 1332.

Discover incident entries

Incident information is divided into several columns. Click any column header to sort
alpha-numerically by that column's data. To sort in reverse order, click the column header a
second time.
The report includes the following columns:
■ Check boxes that let you select incidents to remediate.
You can select one or more incidents to which to apply commands from the Incident
Actions drop-down menu.
Click the checkbox at the top of the column or click Select All to select all incidents on the
current page.
 Remediating Discover incidents 1334
Discover incident entries

Note: Use caution when you use Select All. This option selects all incidents in the report,
not only those on the current page. Any incident command you subsequently apply affects
all incidents. You may want to configure the maximum-incident-batch-size property to
limit the number of incidents that a Server FlexResponse plug-in processes at one time.
See “Adding a Server FlexResponse plug-in to the plug-ins properties file” on page 1586.

■ Type
Type of target in which the match was detected.
An icon represents each target type.
This column also displays a remediation icon, if any response rule applied.
The possible values are as follows:

Blank if no response rule applied

Copied

Quarantined

Remediation Error

When you use a Server FlexResponse action for an Automated or Smart response rule,
one of the following icons may appear:

This incident was successfully remediated using a Server FlexResponse action.

The Server FlexResponse action is in process.

The Server FlexResponse action has an error.

These same icons may appear for other incident types as well, and you can execute Server
FlexResponse actions on those incidents.
See “Configuring the Server FlexResponse action” on page 1245.
■ Location/Target/Scan
Repository or file location, target name, and date and time of most recent scan.
■ File Owner
Username of file owner (for example, MYDOMAIN\Administrator).
■ ID/Policy
The Symantec Data Loss Prevention incident number and the policy the incident violated.
■ Matches
The number of matches in the incident.
 Remediating Discover incidents 1335
Discover incident snapshot

■ Severity
Incident severity as determined by the severity setting of the rule the incident matched.
The possible values are:

High

Medium

Low

For information only

■ Status
The current incident status.
The possible values are:
■ New
■ In Process
■ Escalated
■ False Positive
■ Configuration Errors
■ Resolved
The following icon may be displayed near the status if this incident was seen before:

This icon is displayed if this incident has an earlier connected incident.

You or your administrator can add new status designations on the attribute setup page.
See “Configuring custom attributes” on page 1418.
See “Discover incident lists” on page 1332.

Discover incident snapshot

An incident snapshot provides detailed information about a particular incident. It displays
general incident information, matches detected in the content, and details about policy,
attributes, and incident history. You can also search for similar incidents in the Correlations
area.
Current status and severity appear under the snapshot heading. To change one of the current
values, click it and choose another value from the drop-down list.
 Remediating Discover incidents 1336
Discover incident snapshot

Use the icons at the top right to print the report, or send it as email. To send reports, you or
your administrator must first enable report distribution in system settings.
See “Configuring the Enforce Server to send email alerts” on page 161.
If any Smart Response rules are set up, Symantec Data Loss Prevention displays a remediation
bar that includes buttons for executing the rules. Depending on the number of Smart Response
rules, a drop-down menu may also appear.
See “About incident remediation” on page 1294.
Incident data is divided into the following sections:
■ Key Info tab
■ Policy Matches
See “Incident snapshot policy section” on page 1386.
■ Incident Details
The following details are included:

Server Name of the Discover Server that detected the incident.

Remediation The latest remediation status of the file that generated the incident.
Detection Status

Target Network Discover target name.

Scan The date and time of the scan that registered the incident.

Detection Date The date and time that the incident was detected.

Protect Status For Box incidents, displays the remediation status of the content that
generated the incident.

Seen Before No, if this incident was not previously detected. Yes, if this incident was
previously detected.

Subject Email subject for integrated Exchange scans.

Sender Email sender for integrated Exchange scans.

Recipient Email recipient for integrated Exchange scans.

File Location Location of the file, repository, or item.

Click go to file to view the item or file, or go to directory to view the

directory. If you view an Endpoint Discover incident, you do not see the
go to file or go to directory links.

Is Hidden Displays the hidden state of the incident, whether or not the incident is
hideable, and lets you toggle the Do Not Hide flag for the incident. See
“About incident hiding” on page 1406.
 Remediating Discover incidents 1337
Discover incident snapshot

URL For SharePoint, this URL is the item on the SharePoint server. Click
this URL to go to the item on the SharePoint server.

Document Name File or item name(s)

File Owner Creator of the file or item.

For SharePoint and Exchange incident snapshots the File Owner is

listed as unknown because it is not applicable to these target types.

Extraction Date Date custom target adapter was run ( In the Firefox browser, these links
do not work without additional setup.

Applies to custom targets only.)

Scanned Machine Host name of the scanned computer.

For SharePoint this name is the web application name.

Notes Database Name of the IBM (Lotus) Notes database (Applies to IBM (Lotus) Notes
only.)

File Created The date and time that the file or item was created.

Last Modified Date and time of last change to the file or item.

Last Accessed Date and time of last user access to the file or item.

For SharePoint, this date is not valid.

Created By The user who created the file.

Modified By The user who last modified the file.

Data Owner Name The person responsible for remediating the incident. This field must be
set manually, or with a lookup plug-in.

Reports can automatically be sent to the data owner for remediation.

If you click on the hyperlinked Data Owner Name, a filtered list of

incidents by Data Owner Name is displayed.

Data Owner Email The email address of the person responsible for remediating the incident.
Address This field must be set manually, or with a lookup plug-in.

If you click on the hyperlinked Data Owner Email Address, a filtered

list of incidents by Data Owner Email Address is displayed.

■ Access Information
See “Incident snapshot access information section” on page 1387.
For SharePoint incident snapshots, the permission levels show the permissions from
SharePoint, for example Contribute or Design. The list in the incident snapshot shows
 Remediating Discover incidents 1338
Discover summary reports

only the first 50 entries. All the ACL entries can be exported to a CSV file. The
permissions are comma-separated. Users or groups having Limited Access permission
levels are not recorded or shown.

Note: If you are scanning a SharePoint repository without using the SharePoint solution,
the incident snapshot will not show any SharePoint permissions information.

Box incident snapshots display collaborative folder information, including the

collaborators and their roles.
■ Shared Link Information
Cloud storage incident snapshots display shared link information, including whether a
link is shared, if it is password protected, if it can be downloaded, and the expiration
date of the link.
■ Message Body
For a SharePoint list item, the message body shows the name and value pairs in the
list.

■ Attributes
See “Incident snapshot attributes section” on page 1385.
■ History tab
See “Incident snapshot history tab” on page 1385.
■ Notes tab
The notes tab displays any notes for this incident.
■ Correlations tab
See “Incident snapshot correlations tab” on page 1386.
■ Matches and file content
See “Incident snapshot matches section” on page 1386.
See “Discover incident reports” on page 1331.

Discover summary reports

Discover Summary Reports provide summary information about the incidents that are found
during Discover scans.
If you are running Endpoint Discover, the Discover Summary Reports also include Endpoint
Discover incidents.
You can filter or summarize the options in the reports.
See “Incident report filter and summary options” on page 1383.
 Remediating Discover incidents 1339
Discover summary reports

You can extract the report information in selected formats.

You can click highlighted elements, such as the entries in the Totals column, to view details.
Icons provide navigation through long reports.
See “Page navigation in incident reports” on page 1382.
See “Discover incident reports” on page 1331.
 Chapter 47
Working with Cloud
Connector incidents
This chapter includes the following topics:

■ About Application incident reports

■ Application incident list

■ Application incident entries

■ Application incident actions

■ Application incident snapshot

■ Application summary reports

About Application incident reports

Use Application incident reports to monitor and manage incidents from Cloud Service
Connectors and API Detection for Developer Apps Appliances. You can save, send, export,
or schedule Symantec Data Loss Prevention reports.
In the Enforce Server administration console, on the Incidents menu, click Applications. This
incident report displays all incidents for all Cloud Connectors.
You can pre-filter your Application incident reports by the Data-at-Rest and Data-in-Motion
data types:
■ Incidents > Applications > Data-at-Rest
■ Incidents > Applications > Data-in-Motion
You can select the following standard reports for all incidents:
■ Incidents - All
 Working with Cloud Connector incidents 1341
About Application incident reports

Displays a list of all incidents.

See “Application incident list” on page 1342.
■ DIM - Incidents - All
Displays a list of all Data-in-Motion (DIM) incidents
See “Application incident list” on page 1342.
■ DIM - Incidents - New
Displays a list of all DIM incidents with a status of New.
See “Application incident list” on page 1342.
■ DIM - Policy Summary
Displays a summary of DIM incidents by policy.
See “Application summary reports” on page 1349.
■ DIM - Status by Policy
Displays a summary of DIM incidents by policy and incident status.
See “Application summary reports” on page 1349.
■ DIM - High Risk Users - Last 30 Days
Displays a summary of DIM incidents associated with high-risk users in the last 30 days.
See “Application summary reports” on page 1349.
■ DAR - Incidents - All
Displays a list of all Data-at-Rest (DAR) incidents.
See “Application incident list” on page 1342.
■ DAR - Incidents - New
Displays a list of all DAR incidents with a status of New.
See “Application incident list” on page 1342.
■ DAR - Application Summary
Displays a summary of DAR incidents by cloud application.
See “Application summary reports” on page 1349.
■ DAR - Policy Summary
Displays a summary of DAR incidents by policy.
See “Application summary reports” on page 1349.
■ DAR - Status by Application
Displays a summary of DAR incidents by status and cloud application.
See “Application summary reports” on page 1349.
■ DAR - High Risk Users
Displays a summary of DAR incidents associated with high-risk users.
See “Application summary reports” on page 1349.
Summaries and filter options can select which incidents to display.
 Working with Cloud Connector incidents 1342
Application incident list

See “Incident report filter and summary options” on page 1383.

You can create custom reports with combinations of filters and summaries to monitor the
incidents.
See “About custom reports and dashboards” on page 1364.
Applications have the following types of reports:
■ Incident list
See “Application incident list” on page 1342.
■ Incident snapshot
See “Application incident snapshot” on page 1345.
■ Incident summary
See “Application summary reports” on page 1349.

Application incident list

An Applications incident list shows the incidents that are reported by a Cloud Service Connector
or API Detection for Developer Apps Appliance. Individual incident records contain information
such as severity, associated policy, number of matches, and status.
See “Application incident entries” on page 1342.
You can select specific incidents (or a group of incidents) to modify or manage.
See “Application incident actions” on page 1344.
You can click on any incident to view a snapshot containing more details.
See “Application incident snapshot” on page 1345.
See “About Application incident reports” on page 1340.

Application incident entries

Incident information is divided into several columns. Click any column header to sort
alpha-numerically by the data in that column. To sort in reverse order, click the column header
a second time.
The report includes the following columns:
■ Checkboxes that let you select incidents to manage.
You can select one or more incidents to which to apply commands from the Incident
Actions drop-down menu.
Click the checkbox at the top of the column or click Select All to select all incidents on the
current page.
 Working with Cloud Connector incidents 1343
Application incident entries

Note: Use caution when you use Select All. This option selects all incidents in the report,
not only those on the current page. Any incident command you subsequently apply affects
all incidents.

■ Data Type
Specifies whether the incident is from a DAR Connector or a DIM Connector.
■ Location/Application/Detection Date
The location of the sensitive data, the application with which the incident is associated,
and the date on which the policy violation was detected.
■ User
Displays the information of the user associated with the incident, if applicable.
■ ID/Policy
The Symantec Data Loss Prevention incident number and the policy the incident violated.
■ Matches
The number of matches in the incident.
■ Severity
Incident severity as determined by the severity setting of the rule the incident matched.
The possible values are:

High

Medium

Low

For information only

■ Status
The current incident status. The possible values are:
■ New
■ In Process
■ Escalated
■ False Positive
■ Configuration Errors
■ Resolved

See “Application incident list” on page 1342.

 Working with Cloud Connector incidents 1344
Application incident actions

Application incident actions

You can select one or more incidents and then manage them using commands in the Incident
Actions drop-down list.
The incident commands are as follows:
■ Add Note
Select to open a dialog box, type a comment, and then click OK.
■ Delete Incidents
Select to delete specified incidents.
■ Export Selected: CSV
Select to save specified incidents in a comma-separated text (.csv) file, which can be
displayed in several common applications, such as Microsoft Excel.
■ Export Selected: XML
Select to save specified incidents in an XML file, which can be displayed in several common
applications.
■ Mark Accepted
Select to set the remediation status to Accepted.
■ Run Smart Response
Select to run the Quarantine or Restore File Smart Response rules.
■ Hide/Unhide
Select one of the following actions to set the display state for the selected incidents:
■ Hide Incidents—Flags the selected incidents as hidden.
■ Unhide Incidents—Restores the selected incidents to the unhidden state.
■ Do Not Hide—Prevents the selected incidents from being hidden.
■ Allow Hiding—Allows the selected incidents to be hidden.
See “About incident hiding” on page 1406.
■ Set Attributes
Select to set attributes for the selected incidents.
■ Set Data Owner
Select to set the data owner by user name or email address.
■ Set Severity
Select to set severity.
■ Set Status
Select to set status.
See “Application incident list” on page 1342.
 Working with Cloud Connector incidents 1345
Application incident snapshot

Application incident snapshot

An incident snapshot provides detailed information about a particular incident. It displays
general incident information, matches detected in the content, and details about policy,
attributes, and incident history. You can also search for similar incidents in the Correlations
area.
Current status and severity appear under the snapshot heading. To change one of the current
values, click it and choose another value from the drop-down list.
You can use the Accepted checkbox to set the remediation status to User Accepted. This
remediation status indicates that the incident was remediated by the user, CASB administrator,
or another incident responder.
Use the icons at the top right to print the report, or send it as email. To send reports, you or
your administrator must first enable report distribution in system settings.
See “Configuring the Enforce Server to send email alerts” on page 161.
Cloud Connector incident data is divided into the following sections:
■ Key Info tab:
■ Policy Matches
See “Incident snapshot policy section” on page 1386.
■ Incident Details
The following details are included for both DAR and DIM incidents:

Data Type Specifies the DAR or DIM data type.

Detector Specifies the cloud detector that created the incident.

Is Hidden Displays the hidden state of the incident, whether or not the incident is hideable,
and lets you toggle the Do Not Hide flag for the incident. See “About incident
hiding” on page 1406.

Recipient For data uploads, the recipient is the site to which the data is uploaded.

For data downloads, the recipient is the user who downloads the data.

Date The date the incident was created.

Subject The subject field of the sensitive data. Click the subject link to view all incidents
with the same subject.

Data Owner The person responsible for remediating the incident. This field must be set
Name manually.

Reports can be sent automatically to the data owner for remediation.

Click Data Owner Name to view a filtered list of incidents for that data owner.
 Working with Cloud Connector incidents 1346
Application incident snapshot

Data Owner The email address of the person responsible for remediating the incident. This
Email field must be set manually.
Address
Click Data Owner Email Address to view a filtered list of incidents for that data
owner email address.

Request ID The unique detection request identifier from the Cloud Service Connector. You
can use this identifier to track this incident in external cloud consoles, such as
Symantec CloudSOC.

User Name The name of the user who is associated with the incident.

User Specifies the type of user activity on the file. The possible activities are:
Activity ■ Create
Type ■ Edit
■ Rename
■ Delete
■ Upload/Download

External The unique transaction identifier that is provided by the cloud application. You
Transaction can use this identifier to track this incident in external cloud consoles, such as
ID Symantec CloudSOC.

■ Site/Application Details
Specifies the following details about the website or cloud application that is associated
with the DAR or DIM incident:

Service Score The Shadow IT score provided by Symantec CloudSOC.

Application The name of the cloud application associated with the incident.
Name

Site Risk The site risk score provided by Blue Coat WSS, based on information from the
Score Global Intelligence Network.

HTTP URL The HTTP URL accessed by the user.

■ User Details
This section provides the following details about the user who is associated with the
DAR or DIM incident:

User Threat Specifies the user threat score as provided by Symantec CloudSOC or Blue
score Coat WSS.
 Working with Cloud Connector incidents 1347
Application incident snapshot

Documents Specifies the number of exposed documents for that user. Click More Info to
Exposed view document exposure information in your external cloud console.
Count

User Activity Provides a link to user activity details in your external cloud console.

■ Data Exposure Details (DAR only)

This section provides the following details about the exposure of the sensitive data:

Document is Specifies if the document is exposed in a publically accessible location.

Publically
Exposed

Document is Specifies if the document is shared with members of your organization.

Internally Shared

Document is Specifies if the document is exposed outside of your organization.

Exposed

Document is Specifies if the document is within your organization.

Internal

Document Specifies the number of times the document has been accessed.
Activity Count

Document The identifier of the document creator.

Creator ID

Document ID The identifier of the document.

Document Parent The identifier of the folder containing the document.

Folder ID

■ File Information (DAR only)

This section specifies the following information about the file containing the sensitive
data:

File Folder Specifies the folder that contains the file. Click More Info to go to exposures
panel for that file.

Last Modified Specifies the date and time the file was last modified.

Sharing URL Specifies the URL at which the file is shared.

Document Specifies the document type of the file.

Type
 Working with Cloud Connector incidents 1348
Application incident snapshot

File Activity Click More Info to view the file activity in your external cloud console.

Alert in CASB Click More Info to view incident information in your external cloud console.

■ Data Transfer (DIM Only)

Specifies the following details about the device that is associated with the DIM incident:

Network Specifies the direction of the network traffic, upload or download.

Direction

Connector Specifies the network protocol of the data transfer, such as https.
Source
Protocol

Source IP Specifies the originating IP address of the network traffic.

Destination IP Specifies the destination IP address of the network traffic.

Device is Specifies if the device complies with your organization's standards.

Compliant

Device is Specifies if the device is not managed by your organization.

Unmanaged

Device is Specifies if the device is the personal property of the user.

Personal

Device is Specifies if the device is trusted by your organization.

Trusted

HTTP Method Specifies the HTTP method that was called when the incident was created.

HTTP Cookies Lists any cookies that are associated with the incident.

Device OS Specifies the operating system of the device.

Device Type Specifies the type of device.

■ Location (DIM Only)

Specifies the following device location information:

Location Specifies the city and country location of the device.

Latitude Specifies the latitude coordinate of the device.

Longitude Specifies the longitude coordinate of the device.

 Working with Cloud Connector incidents 1349
Application summary reports

■ Message Body
Provides a link to the original JSON-formatted message.

■ History
See “Incident snapshot history tab” on page 1385.
■ Notes
The notes tab displays any notes for this incident.
■ Correlations
See “Incident snapshot correlations tab” on page 1386.
■ Matches
See “Incident snapshot matches section” on page 1386.
See “About Application incident reports” on page 1340.

Application summary reports

Applications Summary Reports provide summary information about Application incidents.
You can filter or summarize the options in the reports.
See “Incident report filter and summary options” on page 1383.
You can extract the report information in selected formats.
You can click highlighted elements, such as the entries in the Totals column, to drill down into
details.
Icons provide navigation through long reports.
See “Page navigation in incident reports” on page 1382.
See “About Application incident reports” on page 1340.
 Chapter 48
Managing and reporting
incidents
This chapter includes the following topics:

■ About Symantec Data Loss Prevention reports

■ About strategies for using reports

■ Setting report preferences

■ About incident reports

■ About dashboard reports and executive summaries

■ Viewing dashboards

■ Creating dashboard reports

■ Configuring dashboard reports

■ Choosing reports to include in a dashboard

■ About summary reports

■ Viewing summary reports

■ Creating summary reports

■ Viewing incidents

■ About custom reports and dashboards

■ Using IT Analytics to manage incidents

■ Filtering reports
 Managing and reporting incidents 1351

■ Saving custom incident reports

■ Scheduling custom incident reports

■ Delivery schedule options for incident and system reports

■ Delivery schedule options for dashboard reports

■ Using the date widget to schedule reports

■ Editing custom dashboards and reports

■ Exporting incident reports

■ Exported fields for Network Monitor

■ Exported fields for Network Discover/Cloud Storage Discover

■ Exported fields for Endpoint Discover

■ Deleting incidents

■ Deleting custom dashboards and reports

■ Common incident report features

■ Page navigation in incident reports

■ Incident report filter and summary options

■ Sending incident reports by email

■ Printing incident reports

■ Incident snapshot history tab

■ Incident snapshot attributes section

■ Incident snapshot correlations tab

■ Incident snapshot policy section

■ Incident snapshot matches section

■ Incident snapshot access information section

■ Customizing incident snapshot pages

■ About filters and summary options for reports

■ General filters for reports

■ Summary options for incident reports

 Managing and reporting incidents 1352
About Symantec Data Loss Prevention reports

■ Advanced filter options for reports

About Symantec Data Loss Prevention reports

Use incident reports to track and respond to incidents. Symantec Data Loss Prevention reports
an incident when it detects data that matches the detection parameters of a policy rule.
Such data may include specific file content, an email sender or recipient, attachment file
properties, or many other types of information.
Each piece of data that matches detection parameters is called a match, and a single incident
may include any number of individual matches.
You can set a hiding flag on an incident to indicate that the incident has been hidden. By
default, hidden incidents do not appear in incident reports, but you can include them in incident
reports by setting Advanced Filters on the report. Including hidden incidents in a report may
slow down reporting activities. See “About incident hiding” on page 1406.
Symantec Data Loss Prevention tracks incidents for all detection servers. These servers include
Network Discover/Cloud Storage Discover Server, Network Monitor Server, Network Prevent
for Email Server, Network Prevent for Web Server, and Endpoint Server.
You can specify the reports Symantec Data Loss Prevention displays in the navigation panel.
See “Setting report preferences” on page 1354.
Symantec Data Loss Prevention provides the following types of incident reports:
■ Incident lists show the individual incident records that contain information such as severity,
associated policy, number of matches, and status. You can click on any incident to see a
snapshot containing more details. And you can select specific incidents or groups of
incidents to modify or remediate.
Symantec Data Loss Prevention provides separate reports for incidents by selecting
Network, Endpoint, Discover, or User.
■ Summaries provide summary information about the incidents on your system. They are
organized with either one or two summary criteria. A single-summary report is organized
with a single summary criterion, such as the policy that is associated with each incident.
A double-summary report is organized with two criteria, such as policy and incident status.
By default, hidden incidents do not appear in the counts that display in summary reports,
but you can set Advanced Filters to include the hidden incidents. (See “About incident
hiding” on page 1406.)
■ Dashboards combine information from several reports. They include graphs and incident
totals representing the contents of various incident lists and summaries. Graphs can
sometimes contain lists of high-severity incidents or lists of summary groups. You can click
on report portlets (the individual tiles that contain report data) to drill down to the detailed
versions of the reports.
 Managing and reporting incidents 1353
About strategies for using reports

Symantec Data Loss Prevention ships with executive summaries for Network, Endpoint,
and Discover incidents.
Executive summaries are very similar to dashboards. The difference between them is that
you can customize a dashboard, but you cannot customize an executive summary.
You can create and save customized versions of all reports (except executive summaries) for
continued use.
See “About custom reports and dashboards” on page 1364.
Symantec Data Loss Prevention displays reports in separate sections on the Incident Reports
screen as follows:
■ The Saved Reports section contains any shared reports that are associated with your
current role. This section appears only if you or other users in your current role have created
saved reports.
See “About custom reports and dashboards” on page 1364.
■ The Network section contains Symantec-provided incident lists, summaries, and dashboards
for network incidents.
■ The Endpoint section contains Symantec-provided incident lists, summaries, and
dashboards for endpoint incidents. Endpoint reports include the incidents that Endpoint
captures, such as Endpoint Block and Endpoint Notify incidents.
Incidents that Endpoint Discover captures appear in Discover reports.
■ The Discover section contains Symantec-provided incident lists, summaries, and
dashboards for Network Discover/Cloud Storage Discover and Endpoint Discover incidents.
■ The Users section contains the user list and user risk summary, which displays users and
their associated Email and Endpoint incidents.

About strategies for using reports

Many companies configure their Symantec Data Loss Prevention reporting to accommodate
the following primary roles:
■ An executive responsible for overall risk reduction who monitors risk trends and develops
high-level initiatives to respond to those trends.
The executive monitors dashboards and summary reports (to get a general picture of data
loss trends in the organization). The executive also develops programs and initiatives to
reduce risk, and communicates this information to policy authors and incident responders.
The executive often monitors reports through email or some other exported report format.
Symantec Data Loss Prevention dashboards and summary reports let you monitor risk
trends in your organization. These reports provide a high-level overview of incidents.
Executives and managers can quickly evaluate risk trends and advise policy authors and
 Managing and reporting incidents 1354
Setting report preferences

incident responders how to address these trends. You can view existing summary reports
and dashboards and create customized versions of these reports.
See “About dashboard reports and executive summaries” on page 1356.
See “About summary reports” on page 1361.
■ An incident responder, such as an InfoSec Analyst or InfoSec Manager, who monitors and
responds to particular incidents.
The responder monitors incident reports and snapshots to respond to the incidents that
are associated with a particular policy group, organizational department, or geographic
location. The responder may also author policies to reduce risk. These policies can originate
either at the direction of a risk reduction manager or based on their own experience tracking
incidents.
See “About incident remediation” on page 1294.

Setting report preferences

You can specify the reports that Symantec Data Loss Prevention displays in the navigation
panel for each of the report types.
To set reporting preferences
1 In the Enforce Server administration console, on the Incidents menu, click All Reports.
2 On the All Reports screen, click Edit Preferences.
The Edit Report Preferences screen lists any saved reports (for all your assigned roles).
The screen also lists Network, Endpoint, and Discover reports.
3 To display a report in the list, check the Show Report box for that report. To remove a
report from the list, clear Show Report for that report.
The selected list of reports displays in a left navigation panel for each of the types of
reports.
For example, to see the list of Network reports, on the Incidents menu, click Network.
4 After changing your preferences, click Save.
See “About custom reports and dashboards” on page 1364.

About incident reports

Use incident reports to track and respond to incidents on your network. Symantec Data Loss
Prevention reports an incident when it detects data that matches a detection rule in an active
policy. Such data may include specific file content, an email sender or recipient, attachment
file properties, or many other types of information. Each piece of data that matches a detection
rule is called a match, and a single incident may include any number of individual matches.
 Managing and reporting incidents 1355
About incident reports

Note: You can configure which reports appear in navigation panel. To do so, go to All Reports
and then click on Edit Preferences

Symantec Data Loss Prevention provides the following types of incident reports:

Incident lists These show individual incident records containing information such as severity,
associated policy, number of matches, and status. You can click on any incident
to view a snapshot containing more details. You can select specific incidents or
groups of incidents to modify or remediate.

Summaries These show incident totals organized by a specific incident attribute such as status
or associated policy. For example, a Policy Summary includes rows for all policies
that have associated incidents. Each row includes a policy name, the total number
of associated incidents, and incident totals by severity. You can click on any severity
total to view the list of relevant incidents.

Double summaries These show incident totals organized by two incident attributes. For example, a
policy trend summary shows the total incidents by policy and by week. Similar to
the policy summary, each entry includes a policy name, the total number of
associated incidents, and incident totals by severity. In addition, each entry includes
a separate line for each week, showing the week's incident totals and incidents by
severity.

Dashboards and These are quick-reference dashboards that combine information from several
executive reports. They include graphs and incident totals representing the contents of various
summaries incident lists, summaries, and double summaries. Graphs are sometimes beside
lists of high-severity incidents or lists of summary groups. You can click on
constituent report names to drill down to the reports that are represented on the
dashboard.

Symantec Data Loss Prevention ships with executive summaries for Network,
Endpoint, and Discover reports, and these are not customizable.

You can create dashboards yourself, and customize them as desired.

Custom Lists the shared reports that are associated with your current role. (Such reports
appear only if you or other users in your current role have created them.)

Network Lists the network incident reports.

Endpoint Lists the Endpoint incident reports. Endpoint reports include incidents such as
Endpoint Block and Endpoint Notify incidents.

Incidents from Endpoint Discover are included in Discover reports.

 Managing and reporting incidents 1356
About dashboard reports and executive summaries

Discover Lists Network Discover/Cloud Storage Discover and Endpoint Discover incident
reports.

The folder risk report displays file share folders ranked by prioritized risk. The risk
score is based on the relevant information from the Symantec Data Loss Prevention
incidents plus the information from the VML Management Server.

See the Symantec Data Loss Prevention Data Insight Implementation Guide.

Users The User List lists the data users in your organization. The User Risk Summary
lists all users with their associated Email and Endpoint incidents.

See “About custom reports and dashboards” on page 1364.

See “Common incident report features” on page 1381.
See “Network incident snapshot” on page 1310.
See “Discover incident snapshot” on page 1335.
See “Endpoint incident snapshot” on page 1319.
See “Network incident list” on page 1304.
See “Discover incident lists” on page 1332.
See “About endpoint incident lists” on page 1316.

About dashboard reports and executive summaries

Dashboards and executive summaries are the quick-reference report screens that present
summary information from several incident reports.
Symantec Data Loss Prevention ships with one executive summary each for Network, Endpoint,
and Discover incident reports.
See “About incident reports” on page 1354.
Dashboards and executive summaries have two columns of reports. The left column displays
a pie chart or graph and an incident totals bar. The right column displays the same types of
information as in the left column. The right column also displays either a list of the most
significant incidents or a list of summary items with associated incident totals. The most
significant incidents are ranked using severity and match count. You can click on a report to
see the full report it represents.
Dashboards consist of up to six portlets, each providing a quick summary of a report you
specify.
Symantec Data Loss Prevention includes three executive summaries (which are similar to
dashboards): Executive Summary-Network, Executive Summary-Endpoint, and Executive
 Managing and reporting incidents 1357
Viewing dashboards

Summary-Discover. (Dashboards and executive summaries share the same format, but
executive summaries are not customizable.)
You can create customized dashboards for users with specific security responsibilities. If you
choose to share a dashboard, the dashboard is accessible to all users in the role under which
you create it. (Note that the Administrator user cannot create shared dashboards.)
Dashboards have two columns of report portlets (tiles that contain report data). Portlets in the
left column display a pie chart or graph and the totals bar. Portlets in the right column display
the same types of information as those in the left. However, they also display either a list of
the most significant incidents or a list of summary criteria and associated incidents. The incidents
are ranked using severity and match count. The summary criteria highlights any high-severity
incident totals. You can choose up to three reports to include in the left column and up to three
reports to include in the right column.
To create custom dashboards, click Incident Reports at the top of the navigation panel and,
in the Incident Reports screen that appears, click Create Dashboard. The Administrator can
create only private dashboards, but other users can decide whether to share a new dashboard
or keep it private.
See “About custom reports and dashboards” on page 1364.
To edit the contents of any custom dashboard, go to the desired dashboard and click Customize
near the top of the screen.
See “Configuring dashboard reports” on page 1359.
To display a custom dashboard at logon, specify it as the default logon report.
See “Setting report preferences” on page 1354.

Viewing dashboards
This procedure shows you how to view a dashboard.
 Managing and reporting incidents 1358
Creating dashboard reports

To view a dashboard
1 In the Enforce Server administration console, on the Incidents menu, click Incident
Reports. Under Reports, click the name of a dashboard.
Dashboards consist of up to six portlets that each provide a summary of a particular report.
For example, the Executive Summary-Network dashboard consists of portlets for the
Network Policy Summary, High Risk Senders, Protocol Summary, Top Recipient
Domains, Status by Week, and Incidents - All.
2 To see the entire report for a portlet, click the portlet.
Symantec Data Loss Prevention displays the appropriate incident list or summary report.
3 Browse through the incident list or summary report.
See “Viewing incidents” on page 1363.
See “About summary reports” on page 1361.

Creating dashboard reports

You can create custom dashboards and reports.
If you are logged on as a user other than the administrator, Symantec Data Loss Prevention
lets you choose whether to share your dashboard or keep it private.
To create a dashboard
1 In the Enforce Server administration console, on the Incidents menu, click Incident
Reports.
2 On the Incident Reports screen that appears, click Create Dashboard.
The Configure Dashboard screen appears.
3 Choose whether to share your dashboard or keep it private.
If you choose to share a dashboard, the dashboard is accessible to all users assigned
the role under which you create it.
If you are logged on as Administrator, you do not see this choice.

Note: Symantec Data Loss Prevention automatically designates all dashboards that the
administrator creates as private.

Click Next.
4 In the General section, for Name, type a name for the dashboard.
5 For Description, type an optional description for the dashboard.
 Managing and reporting incidents 1359
Configuring dashboard reports

6 In the Delivery Schedule section, you can regenerate and send the dashboard report to
specified email accounts.
If SMTP is not set up on your Enforce Server, you do not see the Delivery Schedule
section.
If you have configured your system to send alerts and reports, you can set a time to
regenerate and send the dashboard report to specified email accounts.
See “Configuring the Enforce Server to send email alerts” on page 161.
If you have not configured Symantec Data Loss Prevention to send reports, skip to the
next step.
To set a schedule, locate the Delivery Schedule section and select an option from the
Schedule drop-down list. (You can alternatively select No Schedule.)
For example, select Send Weekly On.
Enter the data that is required for your Schedule choice. Required information includes
one or more email addresses (separated by commas). It may also include calendar date,
time of day, day of the week, day of the month, or last date to send.
See “Delivery schedule options for dashboard reports” on page 1371.
7 For the Left Column, you can choose what to display in a pie chart or graph. For the
Right Column, you can also display a table of the information.
See “Choosing reports to include in a dashboard” on page 1361.
Select a report from as many as three of the Left Column (Chart Only) drop-down lists.
Then select a report from as many as three of the Right Column (Chart and Table)
drop-down lists.
8 Click Save.
9 You can edit the dashboard later from the Edit Report Preferences screen.
To display a custom dashboard at logon, specify it as the default logon report on the Edit
Report Preferences screen.
See “Editing custom dashboards and reports” on page 1373.

Configuring dashboard reports

You can create the custom dashboards that are tailored for users with specific roles.
Dashboards consist of up to six portlets, each providing a quick summary of a report you
specify.
If you choose to share a dashboard, the dashboard is accessible to all users assigned the role
under which you create it.
 Managing and reporting incidents 1360
Configuring dashboard reports

Note: The Administrator user cannot create shared dashboards.

To configure a custom dashboard

1 In the General section, for Name, type a name for the dashboard.
2 For Description, type an optional description for the dashboard.
3 In the Delivery Schedule section, you can regenerate and send the dashboard report to
specified email accounts.
If SMTP is not set up on your Enforce Server, you do not see the Delivery Schedule
section.
If you have configured your system to send alerts and reports, you can set a time to
regenerate and send the dashboard report to specified email accounts.
See “Configuring the Enforce Server to send email alerts” on page 161.
If you have not configured Symantec Data Loss Prevention to send reports, skip to the
next step.
To set a schedule, locate the Delivery Schedule section and select an option from the
Schedule drop-down list. (You can alternatively select No Schedule.)
For example, select Send Weekly On.
Enter the data that is required for your Schedule choice. Required information includes
one or more email addresses (separated by commas). It may also include calendar date,
time of day, day of the week, day of the month, or last date to send.
See “Delivery schedule options for dashboard reports” on page 1371.
4 For the Left Column, you can choose what to display in a pie chart or graph. For the
Right Column, you can also display a table of the information.
See “Choosing reports to include in a dashboard” on page 1361.
Select a report from as many as three of the Left Column (Chart Only) drop-down lists.
Then select a report from as many as three of the Right Column (Chart and Table)
drop-down lists.
5 Click Save.
6 You can edit the dashboard later from the Edit Report Preferences screen.
To display a custom dashboard at logon, specify it as the default logon report on the Edit
Report Preferences screen.
See “Editing custom dashboards and reports” on page 1373.
 Managing and reporting incidents 1361
Choosing reports to include in a dashboard

Choosing reports to include in a dashboard

Dashboards have two columns of report portlets.
Portlets in the left column display a pie chart or graph.
Portlets in the right column display the same information as those in the left. They also display
either a list of the most significant incidents or a summary. Incidents are ranked with severity
and match count. You can display a list of summary criteria and associated incidents that
highlight any high-severity incident totals.
You can choose up to three reports to include in the left column, and up to three reports to
include in the right column.
To choose reports to include
1 Choose a report from as many as three of the Left Column (Chart Only) drop-down lists.
2 Choose a report from as many as three of the Right Column (Chart and Table) drop-down
lists.
3 After you configure the dashboard, click Save.
See “Configuring dashboard reports” on page 1359.

About summary reports

Symantec Data Loss Prevention provides two types of summary reports: single summaries
and double summaries.
Single summaries show incident totals organized by a specific incident attribute such as status
or associated policy. For example, a policy summary includes a row for each policy that has
associated incidents. Each row includes a policy name, the total number of associated incidents,
and incident totals by severity.
Double summaries show incident totals organized by two incident attributes. For example, a
policy trend summary shows the total incidents which are organized with policy and week. As
in a policy summary, each entry includes a policy name, the total number of associated
incidents, and incident totals by severity. In addition, each entry includes a separate line for
each week, showing the week's incident totals and incidents by severity.
See “Summary options for incident reports” on page 1393.
You can create custom summary reports from any incident list.

Viewing summary reports

This procedure shows you how to view a summary report.
 Managing and reporting incidents 1362
Creating summary reports

To view a summary report

1 In the Enforce Server administration console, on the Incidents menu, select one of the
types of reports.
For example, select Network, and then click Policy Summary.
The report consists of summary entries (rows) that are divided into several columns. The
first column is named for the primary summary criterion. It lists primary and (for double
summaries) secondary summary items. For example, in a Policy Summary this column
is named Policy and it lists policies. Each entry includes a column for total number of
associated incidents. It also includes columns showing the number of incidents of High,
Medium, Low, and Informational severity. Finally, it includes a bar chart that represents
the number of incidents by severity.
2 Optionally, you can sort the report alpha-numerically by a particular column's data. To do
so, click the wanted column heading. To sort in reverse order, click the column heading
a second time.
3 To identify areas of potential risk, click the High column heading to display summary
entries by number of high-severity incidents.
4 Click an entry to see a list of associated incidents. In any of the severity columns, you can
click the total to see a list of incidents of the chosen severity.
See “Viewing incidents” on page 1363.

Creating summary reports

This procedure shows you how to create a summary report.
To create a summary report from an incident list
1 In the Enforce Server administration console, on the Incidents menu, select one of the
types of reports, and then click an incident list.
For example, select Discover, and then the report Incidents-All Scans.
2 Click the Advanced Filters & Summarization bar (near the top of the report).
In Summarize By for the primary listbox and secondary listbox that appear, Symantec
Data Loss Prevention displays all Symantec-provided criteria in alphabetical order. The
criteria precedes any custom criteria the administrator has defined.
See “Summary options for incident reports” on page 1393.
3 Select a criterion from the primary listbox, and an optional criterion from the secondary
listbox. For example, select Policy Group and then Policy. (Note that options in the
secondary listbox appear only after you choose an option from the primary listbox.)
 Managing and reporting incidents 1363
Viewing incidents

4 To create the summary report, click Apply.

Summary reports take their name from the primary summary criterion. If you rerun a report
with new criteria, the report name changes accordingly.
5 Save the report.
See “Saving custom incident reports” on page 1366.

Viewing incidents
Symantec Data Loss Prevention incident lists display the individual incident records with
information about the incidents. You can click on any incident to see a snapshot containing
more details. You can select specific incidents or groups of incidents to modify or remediate.
Symantec Data Loss Prevention provides incident lists for Network, Endpoint, and Discover
incidents.
To view incidents
1 In the Enforce Server administration console, on the Incidents menu, select one of the
types of reports.
For example, select Discover. In the left navigation panel, click Incidents-All Scans.
The incident list displays the individual incident records that contain information such as
severity, associated policy, number of matches, and status.
2 Optionally, use report filters to narrow down the incident list.
See “Filtering reports” on page 1366.
3 To view more details of a particular incident, click the incident.
The incident snapshot appears, displaying general incident information, matches detected
in the intercepted text, and details about policy, attributes, and incident history.
You can also search for similar incidents from the Correlations tab.
4 Optionally, click through the incident snapshot to view more information about the incident.
The following list describes the ways you can access more information through the
snapshot:
■ You can find information about the policy that detected the incident. On the Key Info
tab, the Policy Matches section displays the policy name. Click on the policy name
to see a list of incidents that are associated with that policy. Click view policy to see
a read-only version of the policy.
This section also lists other violated policies with the same file or message. When
multiple policies are listed, you can see the snapshot of an incident that is associated
with a particular policy. Click go to incident next to the policy name. To see a list of
all incidents that the file or message created, click show all.
 Managing and reporting incidents 1364
About custom reports and dashboards

■ You can view lists of the incidents that share various attributes with the current incident.
The Correlations tab shows a list of correlations that match single attributes. Click
on attribute values to see the lists of incidents that are related to those values.
For example, the current network incident is triggered from a message from a particular
email account. You can bring up a list of all incidents that this account created.
■ For most network incidents, you can access any attachments that are associated with
the network message. To do so, locate the Attachments field in the Incident Details
section of the snapshot and click the attachment file name.
For a detailed description of incident snapshots and the actions you can perform through
them, see the online Help.
5 When you finish viewing incidents, you can exit the incident snapshot or incident list, or
you can choose one or more incidents to remediate.
See “Remediating incidents” on page 1297.

About custom reports and dashboards

You can filter and summarize reports, and then save them for continued use. When saving a
customized report, you can configure Symantec Data Loss Prevention to send the report
according to a specific schedule.
Symantec Data Loss Prevention displays the titles of customized reports under Incidents >
Incident Reports.
The Incident Reports screen displays all out-of-the-box and custom reports available to your
assigned role(s). The list includes shared custom reports and the dashboards that you or
anyone else in your current role created. Several standard reports are available with Symantec
Data Loss Prevention.
Symantec Data Loss Prevention displays each report's name, associated product, and
description. For custom reports, Symantec Data Loss Prevention indicates whether the report
is shared or private and displays the report generation and delivery schedule.
You can modify existing reports and save them as custom reports, and you can also create
custom dashboards. Custom reports and dashboards are listed in the Saved Reports section
of the navigation panel.
You can click any report on the list to re-run it with current data.
You can view and run custom reports for reports created by users who have any of the roles
that are assigned to you. You can only edit or delete the custom reports that are associated
with the current role. The only custom reports visible to the Administrator are the reports that
the Administrator user created.
A set of tables lists all the options available for filtering and summarizing reports.
 Managing and reporting incidents 1365
Using IT Analytics to manage incidents

See “About summary reports” on page 1361.

See “Summary options for incident reports” on page 1393.
See “General filters for reports” on page 1390.
See “Advanced filter options for reports” on page 1398.

Create Dashboard Lets you create a custom dashboard that displays summary data from several
reports you specify. For users other than the Administrator, this option leads to the
Configure Dashboard screen, where you specify whether the dashboard is private
or shared. All Administrator dashboards are private.

See “Creating dashboard reports” on page 1358.

Saved (custom) reports associated with your role appear near the top of the screen.
The following options are available for your current role's custom reports:

Click this icon next to a report to display the save report or configure dashboard
screen. You can change the name, description, or schedule, or (for dashboards
only) change the reports to include.

See “Saving custom incident reports” on page 1366.

See “Configuring dashboard reports” on page 1359.

Click this icon next to a report to display the screen to change the scheduling of this
report. If this icon does not display, then this report is not currently scheduled.

See “Saving custom incident reports” on page 1366.

Click this icon next to a report to delete that report. A dialog prompts you to confirm
the deletion. When you delete a report, you cannot retrieve it. Make sure that no
other role members need the report before you delete it.

Using IT Analytics to manage incidents

IT Analytics Solution is a Business Intelligence (BI) application that complements and expands
upon the reporting that is offered by Symantec Data Loss Prevention. It provides
multi-dimensional analysis and robust graphical reporting features to Symantec Management
Platform. This functionality lets you create on-the-fly ad-hoc reports without advanced knowledge
of databases or third-party reporting tools. IT Analytics provides this powerful on-the-fly ad-hoc
reporting with pivot tables, pre-compiled aggregations for fast answers to typically long-running
queries, and easy export to .PDF, Excel, .CSV and .TIF files.
For more information, see the IT Analytics landing page at the Symantec Support Center, at
https://support.symantec.com/en_US/dpl.56005.html.
 Managing and reporting incidents 1366
Filtering reports

Filtering reports
You can filter an incident list or summary report.
To filter an incident list
1 In the Enforce Server administration console, on the Incidents menu, select one of the
types of reports.
For example, select Network, and then click Policy Summary.
2 In the Filter area, current filters are displayed, as well as options for adding and running
other filters.
3 Modify the default filters as wanted. For example, from the Status filter drop-down lists,
select Equals and New.
For Network, and Endpoint reports, the default filters are Date and Status. For Discover
reports, default filters are Status, Scan, and Target ID.
4 To add a new filter, select filter options from the drop-down lists. Click Advanced Filters
& Summarization for additional options. Click Add Filter on the right, for additional filter
options.
Select the filter type and parameters from left to right as if writing a sentence. For example,
from the advanced filters, Add Filter options, select Policy and Is Any Of, and then select
one or more policies to view in the report. Hold down Ctrl or Shift to select more than one
item in the listbox.
5 Click Apply to update the report.
6 Save the report.
See “Saving custom incident reports” on page 1366.

Saving custom incident reports

After you summarize or filter a report, you can save it for continued use. When you save a
customized report, Symantec Data Loss Prevention displays the report title under Saved
Reports in the All Reports section. If a user chooses to share the report, Symantec Data
Loss Prevention displays the report link only for users who belong to the same role as the user
who created the report.
See “About custom reports and dashboards” on page 1364.
You can edit the report later on the Edit Preferences screen.
See “Editing custom dashboards and reports” on page 1373.
Optionally, you can schedule the report to be run automatically on a regular basis.
See “Scheduling custom incident reports” on page 1367.
 Managing and reporting incidents 1367
Scheduling custom incident reports

To save a custom report

1 Set up a customized filter or summary report.
See “About custom reports and dashboards” on page 1364.
Click Save > Save As.
2 Enter a unique report name and describe the report. The report name can include up to
50 characters.
3 In the Sharing section, users other than the administrator can share a custom report.

Note: This section does not appear for the administrator.

The Sharing section lets you specify whether to keep the report private or share it with
other role members. Role members are other users who are assigned to the same role.
To share the report, select Share Report. All role members now have access to this
report, and all can edit or delete the report. If your account is deleted from the system,
shared reports remain in the system. Shared reports are associated with the role, not with
any specific user account. If you do not share a report, you are the only user who can
access it. If your account is deleted from the system, your private reports are deleted as
well. If you log on with a different role, the report is visible on the All Reports screen, but
not accessible to you.
4 Click Save.

Scheduling custom incident reports

Optionally, you can schedule a saved report to be run automatically on a regular basis.
You can also schedule the report to be emailed to specified addresses or to the data owners
on a regular schedule.
See the Symantec Data Loss Prevention Data Insight Implementation Guide.
 Managing and reporting incidents 1368
Scheduling custom incident reports

To schedule a custom report

1 Click Send > Schedule Distribution.
If SMTP is not set up on your Enforce Server, you are not able to select the Send menu
item to send the report.
See “Configuring the Enforce Server to send email alerts” on page 161.
2 Specify the Delivery Details:

To: Select whether the report is sent to specified

email addresses or to the data owners.

Manual - Sent to specified e-mail addresses Enter the specific email addresses manually in
the text box.

Auto - Send to incident data owners To send the report to the data owners, the Send
report data with emails setting must be enabled
for this option to appear.

See “Configuring the Enforce Server to send

email alerts” on page 161.

If you select to have the report sent to the incident

data owners, then the email address in the
incident attribute Data Owner Email Address is
the address where the report is sent.

This Data Owner Email Address must be set

manually, or with a lookup plug-in.

See the Symantec Data Loss Prevention Data

Insight Implementation Guide.

A maximum of 10000 incidents can be distributed

per data owner.

CC: Enter the email addresses manually in the text

box.

Subject: Use the default subject or modify it.

Body: Enter the body of the email.

Response action variables can also be entered

in the body.

See “Response action variables” on page 1300.

3 In the Schedule Delivery section, specify the delivery schedule.

See “Delivery schedule options for incident and system reports” on page 1369.
 Managing and reporting incidents 1369
Delivery schedule options for incident and system reports

4 In the Change Incident Status / Attributes section, you can implement workflow.
The Auto - Send to incident data owners option must be set for this section to appear.
See “Configuring the Enforce Server to send email alerts” on page 161.
5 After sending the report, you can change an incident's status to any of the valid values.
Select a status value from the drop-down list.
6 You can also enter new values for any custom attributes.
These attributes must be already set up.
See “About incident status attributes” on page 1410.
7 Select one of the custom attributes from the drop-down list.
8 Click Add.
9 In the text box, enter the new value for this custom attribute.
After sending the report, the selected custom attributes set the new values for those
incidents that were sent in the report.
10 Click Next.
11 Enter the name and description of the saved report.
12 Click Save.

Delivery schedule options for incident and system

reports
The Schedule Delivery section lets you set up a schedule for the report.

Note: If your Enforce Server is not configured to send email, or you are not allowed to send
reports, the Schedule Delivery section does not appear.

When you make a selection from the list, additional fields appear.
To remove scheduling of a report that was previously scheduled, click the Remove option.
The following table describes the additional fields available for each option on the list.
 Managing and reporting incidents 1370
Delivery schedule options for incident and system reports

Delivery Details Specify the following delivery details:

■ Send To
Specify Manual to specify the email addresses.
Specify Auto for automatic sending to data owners.
■ To
Enter one or more email addresses. Separate them with commas.
■ CC
Enter one or more email addresses. Separate them with commas.
■ Subject
Provide a subject for the email.
■ Body
Enter the body of the email. Use variables for items such as the policy name.
See “Response action variables” on page 1300.

One time Select One time to schedule the report to be run once at a future time, and then
specify the following details for that report:

■ Time
Select the time you want to generate the report.
■ Send Date
Enter the date you want to generate the report, or click the date widget and
select a date.

Daily Select Daily to schedule the report to be run every day, and then specify the following
details for that report:

■ Time
Select the time you want to generate the report.

■ Until

Enter the date you want to stop generating daily reports, click the date widget and
select a date, or select Indefinitely.

Weekly Select Weekly on to schedule the report to be run every week, and then specify
the following details for that report:

■ Time
Select the time you want to generate the report.
■ Days of Week
Click to check one or more check boxes to indicate the day(s) of the week you
want to generate the report.
■ Until
Enter the date you want to stop generating weekly reports, click the date widget
and select a date, or select Indefinitely.
 Managing and reporting incidents 1371
Delivery schedule options for dashboard reports

Monthly Select Monthly on to schedule the report to be run every month, and then specify
the following details for that report:

■ Time
Select the time you want to generate the report.
■ Day of Month
Enter the date on which you want to generate the report each month.
■ Until
Enter the date you want to stop generating monthly reports, click the date widget
and select a date, or select Indefinitely.

See “Saving custom incident reports” on page 1366.

See “ Working with saved system reports” on page 153.

Delivery schedule options for dashboard reports

The Delivery Schedule section lets you set up a schedule for the report.

Note: If your Enforce Server is not configured to send email, or you are not allowed to send
reports, the Delivery Schedule section does not appear.

When you make a selection from the Schedule drop-down list, additional fields appear.
The following table describes the additional fields available for each option on the list.

No Schedule Select No Schedule to save the report without a schedule.

Once Select Once to schedule the report to be run once at a future time, and then specify
the following details for that report:

■ On

Enter the date you want to generate the report, or click the date widget and select
a date.

■ At

Select the time you want to generate the report.

■ Send To

Enter one or more email addresses. Separate them with commas.

 Managing and reporting incidents 1372
Delivery schedule options for dashboard reports

Send Every Day Select Send Every Day to schedule the report to be run every day, and then specify
the following details for that report:

■ At

Select the time you want to generate the report.

■ Until

Enter the date you want to stop generating daily reports, click the date widget and
select a date, or select Indefinitely.

■ Send To

Enter one or more email addresses. Separate them with commas.

Send Weekly On Select Send Weekly on to schedule the report to be run every week, and then
specify the following details for that report:

■ Day

Click to check one or more check boxes to indicate the day(s) of the week you want
to generate the report.

■ At

Select the time you want to generate the report.

■ Until

Enter the date you want to stop generating weekly reports, click the date widget
and select a date, or select Indefinitely.

■ Send To

Enter one or more email addresses. Separate them with commas.

Send Monthly On Select Send Monthly on to schedule the report to be run every month, and then
specify the following details for that report:

■ Day of each month

Enter the date on which you want to generate the report each month.

■ At

Select the time you want to generate the report.

■ Until

Enter the date you want to stop generating monthly reports, click the date widget
and select a date, or select Indefinitely.

■ Send To

Enter one or more email addresses. Separate them with commas.

See “Configuring dashboard reports” on page 1359.

 Managing and reporting incidents 1373
Using the date widget to schedule reports

Using the date widget to schedule reports

The date widget specifies dates for reports.
The date widget enters the date for you. You can click Today to enter the current date.
To use the date widget
1 Click the date widget.
2 Click the left arrow or the right arrow on either side of the month to change the month.
3 Click the left arrow or the right arrow on either side of the year to change the year.
4 Click the desired date on the calendar.

Editing custom dashboards and reports

You can edit any custom report or dashboard that you create.
To edit a custom dashboard or report
1 In the Enforce Server administration console, on the Incidents menu, select Incident
Reports.
The Incident Reports dashboard appears and displays Saved Reports near the top.
2 Click the edit icon next to the report or dashboard to edit.
The Save Report screen or the Save Dashboard screen appears. You can edit the name,
description, and schedule of any custom report or dashboard, and you can select different
component reports for a custom dashboard.
See “Saving custom incident reports” on page 1366.
3 When you finish editing, click Save.

Exporting incident reports

A report can be exported to a comma-separated text (.csv) file or to an XML file.
You can set up a CSV delimiter other than a comma. You can specify which fields are exported
to XML. These options must be set in your profile before you export a report.
See “Editing a user profile” on page 70.
 Managing and reporting incidents 1374
Exported fields for Network Monitor

To export a report
1 Click Incidents, and select a type of report.
2 Navigate to the report that you want to export. Filter or summarize the incidents in the
report, as desired.
See “Common incident report features” on page 1381.
3 Check the boxes on the left side of the incidents to select the incidents to export.
4 In the Export drop-down, select Export All: CSV or Export All: XML

Note: See the current version of the Incident Reporting and Update API Developers Guide
for the location of the XML schema files for exported reports and for a description of
individual XML elements.

5 Click Open or Save. If you selected Save, a Save As dialog box opens, and you can
specify the location and the file name.
See “Exported fields for Network Monitor” on page 1374.
See “Exported fields for Endpoint Discover” on page 1376.
See “Exported fields for Network Discover/Cloud Storage Discover” on page 1375.
See “Printing incident reports” on page 1385.
See “Sending incident reports by email” on page 1384.

Exported fields for Network Monitor

The following fields are exported for Network Monitor:

Type Incident type (for example SMTP, HTTP, or FTP).

Message Status of this incident message.

Status

Severity Severity of this incident (High, Medium, or Low).

Sent Date and time the message was sent.

ID Unique identifier for this incident.

Policy Name of the policy that triggered this incident.

Matches The number of times that this item matches the detection parameters of a policy rule.

Subject Subject of the message.

 Managing and reporting incidents 1375
Exported fields for Network Discover/Cloud Storage Discover

Recipient(s) Recipient of the message.

Status Status of this incident (New, Escalated, Dismissed, or Closed).

Has Indicates if this message has an attachment.

Attachment

Data Owner The person responsible for remediating the incident. This field must be set manually,
Name or with one of the lookup plug-ins.

Reports can automatically be sent to the data owner for remediation.

Data Owner The email address of the person responsible for remediating the incident. This field
Email must be set manually, or with one of the lookup plug-ins.

Custom attributes are also exported.

Exported fields for Network Discover/Cloud Storage

Discover
The following fields are exported for Network Discover/Cloud Storage Discover:

Type Target type (for example file system, Lotus Notes, or SQL Database).

Message Status of this incident message.

Status

Severity Severity of this incident (High, Medium, or Low).

Detection Date Date that an incident was detected.

Seen Before Was this incident previously seen? The value is Yes or No.

Subject Email subject for integrated Exchange scans.

Sender Email sender for integrated Exchange scans.

Recipient Email recipient for integrated Exchange scans.

ID Unique identifier for this incident.

Policy Name of the policy that triggered this incident.

Matches The number of times that this item matches the detection parameters of a policy rule.

Location Location (path) of this item.

Status Status of this incident (New, Escalated, Dismissed, or Closed).

 Managing and reporting incidents 1376
Exported fields for Endpoint Discover

Target Name of the scan target.

Scan Date and time when the file was scanned.

File Owner Owner of the file.

Last Modified Date and time when the item was last modified.
Date

File Create Date and time when the item was created.
Date

Last Access Date and time when the item was last accessed (not shown for NFS targets).
Date

Data Owner The person responsible for remediating the incident. This field must be set manually,
Name or with one of the lookup plug-ins.

Reports can automatically be sent to the data owner for remediation.

Data Owner The email address of the person responsible for remediating the incident. This field
Email must be set manually, or with one of the lookup plug-ins.

Custom attributes are also exported.

Exported fields for Endpoint Discover

The following fields are exported for Endpoint Discover:

Type Target type (for example Removable Storage).

Severity Severity of this incident (High, Medium, or Low).

Occurred On Date that an incident was detected.

ID Unique identifier for this incident.

Policy Name of the policy that triggered this incident.

Matches The number of times that this item matches the detection parameters of a policy rule.

Status Status of this incident (New, Escalated, Dismissed, or Closed).

File Name Name of the file that violated the policy.

File Path Path of the file.

Note: The file location appears only for fixed drive incidents.

Machine Computer on which the incident occurred.

 Managing and reporting incidents 1377
Deleting incidents

User Endpoint user name.

Prevention Status from Endpoint (for example Action Blocked).

Status

Subject Subject of the message.

Recipient(s) Recipient of the message.

Has Indicates if this message has an attachment.

Attachment

Data Owner The person responsible for remediating the incident. This field must be set manually,
Name or with one of the lookup plug-ins.

Reports can automatically be sent to the data owner for remediation.

Data Owner The email address of the person responsible for remediating the incident. This field
Email must be set manually, or with one of the lookup plug-ins.

Custom attributes are also exported.

Deleting incidents
Incident reporting performance often deteriorates when the number of incidents in your system
exceeds one million (1,000,000). Symantec recommends keeping your incident count below
this threshold by deleting incidents to maintain good system performance.
Incident deletion is permanent: you can delete incidents, but you cannot recover the incidents
that you have deleted. Symantec Data Loss Prevention offers options for deleting only certain
parts of the data that triggered the incident.
After you have marked incidents for deletion, you can view, configure, run, and troubleshoot
the incident deletion process from the Enforce Server administration console.
For information about deleting hidden incidents, See “Deleting hidden incidents” on page 1409.
To delete an incident
1 On the Incident Report screen, select the incident or incidents you want to delete, then
click Incident Actions > Delete Incidents.
2 On the Delete Incidents screen, select from the following deletion options:

Delete incident Permanently deletes the incident(s) and all associated data (for example,
completely any emails and attachments). Note that you cannot recover the incidents
that have been deleted.
 Managing and reporting incidents 1378
Deleting incidents

Retain incident, but Retains the actual incident(s) but discards the Symantec Data Loss
delete message data Prevention copy of the data that triggered the incident(s). You have the
option of deleting only certain parts of the associated data. The rest of the
data is preserved.

Delete Original Deletes the message content (for example, the email message or HTML
Message post). This option applies only to Network incidents.

Delete This option refers to files (for Endpoint and Discover incidents) or email or
Attachments/Files posting attachments (for Network incidents). The options are:

■ All, which deletes all attachments. Choose this option to delete all files
(for Endpoint and Discover incidents) or email attachments (for Network
incidents). Attachments and files are added to the incident deletion
queue after their associated incidents have been deleted.

■ Attachments/Files with no violations. This option deletes only those

attachments in which Symantec Data Loss Prevention found no matches.
Choose this option when you have incidents with individual files taken
from a compressed file (Endpoint and Discover incidents) or several
email attachments (Network incidents).

3 Click Cancel or Delete.

Delete marks the incident for deletion and adds it to the incident deletion queue. You
cannot recover an incident after it has been marked for deletion. Symantec Data Loss
Prevention permanently deletes the incidents in the incident deletion queue when it runs
the incident deletion job.

About the incident deletion process

You can view, configure, run, and troubleshoot the incident deletion process on the Incident
Deletion screen of the Enforce Server administration console: System > Incident Data >
Incident Deletion.This screen shows you the number of incidents in the incident deletion
queue, the deletion schedule, and a history of deletion jobs.
The incident deletion queue includes all incidents marked for deletion by all your Symantec
Data Loss Prevention users. In addition to viewing the number of incidents marked for deletion,
you can start and stop a deletion job manually from the incident deletion queue.
You can view detailed information about your deletion jobs in the deletion jobs history section,
including the number of incidents and attachments or files deleted, the job start and end time,
the job duration, whether or not the job was stopped manually, and the job status (Completed,
Failed, or In Progress). In the case of failed deletion jobs, you can click the Failed link to see
the error message and problem statement. This information may be useful to your Oracle
database administrator in troubleshooting the job failure. If this information is insufficient to
 Managing and reporting incidents 1379
Deleting incidents

resolve your deletion job issues, you can export information from any job to a CSV file and
send it to Symantec Data Loss Prevention Support for additional help.
By default, the incident deletion job runs nightly at 11:59 P.M. in the Enforce Server's local
time zone. When the job runs, it also creates an event on the System > Servers and Detectors
> Events screen. This event is created whether or not any incidents are actually deleted.

Configuring the incident deletion job schedule

The default incident deletion job schedule is daily at 11:59 P.M. in the Enforce Server's local
time zone. You can configure the deletion job schedule to run at any other scheduled time.
Symantec suggests running your incident deletion at a time when your system is idle or not
in heavy use.
To configure the incident deletion job schedule
1 Click the Schedule Deletion Job calendar icon.
2 In the Schedule Incident Deletion dialog box, specify one of the following options:
■ No Regular Schedule: Select this option to turn off the deletion job schedule.
■ Once: Specify a day and time for a single incident deletion job.
■ Daily: Specify a daily time for incident deletion jobs.
■ Weekly: Specify a day and time for incident deletion jobs.
■ Monthly: Specify a day of the month and time for incident deletion jobs. To
accommodate differences between months, the day value must be between 1 and 28.

3 Click Submit.

Note: The incident deletion job schedule is reset to the default value during the upgrade process.
If you are using a custom incident deletion job schedule, reconfigure the schedule after the
upgrade process is complete.

Starting and stopping incident deletion jobs

If there are incidents pending deletion, you can start an incident deletion job manually from
the incident deletion queue. You can also stop any incident deletion job that is currently running.
To start and stop incident deletions job manually
1 Click Start Deletion to start an incident deletion job manually.
2 When an incident deletion job is running, the progress bar will show you how many
incidents have been deleted.
3 Click Stop Deletion to stop an incident deletion job.
 Managing and reporting incidents 1380
Deleting incidents

The progress bar refreshes every 30 seconds by default. If you are deleting a large number
of incidents (over 500,000), the refresh process may degrade the performance of the deletion
job. You can adjust the refresh rate in the manager.properties file.
To configure the progress bar refresh rate
1 Open the manager.properties file:
■ On Windows systems: \SymantecDLP\Protect\config\manager.properties
■ On Linux systems: /opt/SymantecDLP/Protect/config/manager.properties

2 Set a new value in milliseconds for the

com.vontu.incident.deletion.progress.refreshRate property. For example, to set
the refresh rate to two minutes (120 seconds):

com.vontu.incident.deletion.progress.refreshRate=120000

3 Save and close the manager.properties file, then restart the Vontu Manager service.
See “About Symantec Data Loss Prevention services” on page 85.

Working with the deletion jobs history

The deletion jobs history section shows you your previously run incident deletion jobs, including:
■ The number of incidents deleted.
■ The number of attachments and files deleted.
■ The deletion job start and end time.
■ The deletion job duration.
■ Whether or not the deletion job was stopped manually.
■ The deletion job status.
If a deletion job failed, a link will appear in the status column. Click the link to see the error
message and problem statement. This information may be useful to your Oracle database
administrator for troubleshooting a failed deletion job.
If you are having trouble troubleshooting incident deletion job issues, you can export detailed
deletion job information to send to Symantec Data Loss Prevention Support.
 Managing and reporting incidents 1381
Deleting custom dashboards and reports

To view and export failed deletion job information

1 In the Deletion jobs history list, click the Failed link for the failed job you want to view.
The error message and problem statement that appear may be useful to your Oracle
database administrator for troubleshooting your incident deletion job issues. If you need
additional help, continue to step 2.
2 To export information for a failed deletion job, select the job in the Deletion jobs history
list, then click Export.
3 Save the ZIP file to send to Symantec Data Loss Prevention Support for analysis. The
data contained in the ZIP file is intended for use by Symantec Data Loss Prevention
Support only, and will not be helpful for your in-house troubleshooting efforts.

Deleting custom dashboards and reports

You can delete any custom report or dashboard that you create.
To delete a custom dashboard or report
1 In the Enforce Server administration console, on the Incidents menu, select Incident
Reports.
The Incident Reports dashboard appears and displays Saved Reports near the top.
2 Click the delete icon next to the report or dashboard to delete it.
3 Click OK to confirm.
4 Symantec Data Loss Prevention deletes the report, and removes it from the Incident
Reports screen.

Common incident report features

The following options are common to incident report lists:
■ Icons to perform the following tasks for a report:
■ Save
You can save the current report as a custom saved report.
See “Saving custom incident reports” on page 1366.
■ Send
You can email the report or schedule the report distribution.
See “Saving custom incident reports” on page 1366.
■ Export
You can export the current report as CSV or XML.
See “Exporting incident reports” on page 1373.
 Managing and reporting incidents 1382
Page navigation in incident reports

■ Delete Report
If this report is not a saved report, then the Delete Report option does not appear.

■ Report filters and summary options

See “Incident report filter and summary options” on page 1383.
■ Page navigation icons
See “Page navigation in incident reports” on page 1382.
The following summary reports are available for the types of incidents:
■ Network
See “Network summary report” on page 1314.
■ Endpoint
See “Endpoint incident summary reports” on page 1326.
■ Discover
See “Discover summary reports” on page 1338.

Page navigation in incident reports

All reports except executive summaries include page navigation options. Symantec Data Loss
Prevention displays the number of currently visible incidents out of total report incidents (for
example, 1-19 of 19 or 1-50 of 315).
Reports with more than 50 incidents have the following options:

Displays the first page of the report.

Displays the previous page.

Displays the next page.

Displays the last page.

Show All Displays all items on one single page.

Use the Show All link on an Incident List with caution when the system contains
more than 500 incidents. Browser performance degrades drastically if more than
500 incidents are displayed on the Incident List page.
 Managing and reporting incidents 1383
Incident report filter and summary options

Select All Selects all incidents on all pages, so you can update them all at once. (Available
only on Incident Lists.) Click Unselect All to cancel.
Note: Use caution when you choose Select All. This option selects all the incidents
in the report (not only those on the current page). Any incident command that you
subsequently apply affects all the incidents.

To select only the incidents on the current page, select the checkbox at top left of
the incident list.

See “Common incident report features” on page 1381.

Incident report filter and summary options

Filters are separated into commonly used filters, and advanced filters and summarizations.
The common filters include the following options:

Status Select Equals, Is Any Of, or Is None Of. Then select status values.
Hold down Ctrl and click to select more than one separate status
value. Hold down Shift and click to select a range.

Date Use the drop-down menu to select a date range, such as Last Week
or Last Month. The default is All Dates.
Network and Endpoint reports

Severity Check the boxes to select the severity values.

Scan For Discover reports, select the scan to report. You can select the
most recent scan, the initial scan, or a scan in progress. All Scans
Discover reports
is the default.

Target ID For Discover reports, select the name of the target to report. All
Targets is the default.

Click the Advanced Filters & Summarization bar to expand the section with filter and summary
options.
Click Add Filter to add an advanced filter.
Select a primary and optional secondary option for summarization. A single-summary report
is organized with a single summary criterion, such as the policy that is associated with each
incident. A double-summary report is organized with two criteria, such as policy and incident
status.
 Managing and reporting incidents 1384
Sending incident reports by email

Note: If you select a condition in which you enter the content to be matched in the text field,
your entire entry must match exactly. For example, if you enter "apples and oranges", that
exact text must appear in the specified component for it to be considered a match. The sentence
"Bring me the apples and the oranges" is not considered a match.

For a complete list of the report filter and summary options, see the Symantec Data Loss
Prevention Administration Guide.
See “Common incident report features” on page 1381.

Sending incident reports by email

You can send a copy of the current report to any email address.
To send reports, your system administrator must configure an SMTP server. The Administrator
must specify a report distribution option on the System > Settings page. You must also specify
an email address for your user account.
See “Configuring the Enforce Server to send email alerts” on page 161.
To send a report
1 Click Incidents, and select a type of report.
2 Navigate to the report that you want to export. Filter or summarize the incidents in the
report, as desired.
See “Common incident report features” on page 1381.
3 Click Send in the upper right corner.
Alternatively, you can use the Send menu (above the filters).
See “Saving custom incident reports” on page 1366.
4 In the Send Report dialog box, specify the following options:

To Enter one or more email addresses (comma-separated).

Subject Enter a subject for the message.

Message Enter the message.

5 Click Send or Cancel.

See “Printing incident reports” on page 1385.
See “Exporting incident reports” on page 1373.
 Managing and reporting incidents 1385
Printing incident reports

Printing incident reports

You can print a report to any available printer.
To print a report
1 Click Incidents, and select a type of report.
2 Navigate to the report that you want to export. Filter or summarize the incidents in the
report, as desired.
See “Common incident report features” on page 1381.
3 Click Print in the upper right corner.
4 An image of the report appears in a browser window.
5 The printer selection dialog box appears, and you can select a printer.
See “Sending incident reports by email” on page 1384.
See “Exporting incident reports” on page 1373.

Incident snapshot history tab

You can view the actions that were performed on the incident. For each action, the History
tab displays the action date and time, the actor (a user or server), and the action or the
comment. Click Add Comment to add a comment.
See “Discover incident snapshot” on page 1335.
See “Network incident snapshot” on page 1310.
See “Endpoint incident snapshot” on page 1319.

Incident snapshot attributes section

You can view a list of custom attributes and their values, if any have been specified. Click on
attribute values to view an incident list that is filtered on that value. To add new values or edit
existing ones, click Edit. In the Edit Attributes dialog box that appears, type the new values
and click Save. Hidden incidents are not displayed in the filtered list.

Note: This section appears only if a system administrator has configured custom attributes.

See “Discover incident snapshot” on page 1335.

See “Endpoint incident snapshot” on page 1319.
See “Network incident snapshot” on page 1310.
 Managing and reporting incidents 1386
Incident snapshot correlations tab

Incident snapshot correlations tab

You can view lists of the incidents that share various attributes of the current incident.
For example, if the copying of a file triggered the current incident, you can bring up a list of all
the incidents that are related to the copying of this file. The Correlations tab shows a list of
correlations that are matched to single attributes. Click on attribute values to view lists of the
incidents that are related to those values.
To search for other incidents with the same attributes, click Find Similar. In the Find Similar
Incidents dialog box that appears, select the desired search attributes. Then click Find
Incidents. Hidden incidents are not displayed when you search for similar incidents.
See “Discover incident snapshot” on page 1335.
See “Endpoint incident snapshot” on page 1319.
See “Network incident snapshot” on page 1310.

Incident snapshot policy section

The Policy area shows the policy that was violated in the incident and indicates if the policy
blocked a move or notified the user. It also shows the total number of matches for the policy,
as well as matches per policy rule. Click the policy name to view a list of all incidents that
violated the policy. Click view policy to view a read-only version of the policy.
You see the icons that describe the following information:
■ Symantec Data Loss Prevention blocked a copy of the sensitive information.
■ Symantec Data Loss Prevention notified the user about the copy of confidential data.
This section also lists other policies that are violated from the same file. To view the snapshot
of an incident that is associated with a particular policy, click the Go to Incident link next to
the policy name. To view a list of all incidents that are related to the file, click show all.
See “Discover incident snapshot” on page 1335.
See “Endpoint incident snapshot” on page 1319.
See “Network incident snapshot” on page 1310.

Incident snapshot matches section

In the Matches section, Symantec Data Loss Prevention displays the content (if applicable)
and the matches that caused the incident.
 Managing and reporting incidents 1387
Incident snapshot access information section

Matches are highlighted in yellow. This section shows the match total and displays the matches
in the order in which they appear in the original content. To view the rule that triggered a match,
click on the highlighted match.
See “Discover incident snapshot” on page 1335.
See “Endpoint incident snapshot” on page 1319.
See “Network incident snapshot” on page 1310.
See “About the Similarity Threshold and Similarity Score” on page 567.

Incident snapshot access information section

The Access Information section of an incident snapshot shows the Access Control Lists for
that object.
Access Control Lists (ACL) are lists of the permissions that are attached to an object or piece
of data. The list contains information about all users who have read and write permissions for
the file. Use the list to view which users have access to the file as well as which actions each
user can perform. The permissions for each user or group are not set through Symantec Data
Loss Prevention. Administrators set the permissions for each file using other types of programs
on the endpoint. Permissions are generally set at the time that the file is created.
For example, User 1 has permission to access the file Example1.doc. User 1 can view and
edit the file. User 2 also has access to the file Example1.doc. However, User 2 can only view
the file. User 2 does not have permission to make changes to the file. In the ACL, both User
1 and User 2 are listed with the permissions that have been granted to them.
Table 48-1 shows the combinations.

Table 48-1 Access control list example

Name Permission

User 1 GRANT READ

User 1 GRANT WRITE

User 2 GRANT READ

The ACL contains a new line for each permission granted. The ACL only contains one line for
User 2 because User 2 only has one permission, to read the file. User 2 cannot make any
changes to the file. User 1 has two entries because User 1 has two permissions: reading the
file and editing it.
You can view ACL information only on Discover and Endpoint local drive incident snapshots.
You cannot view ACL information on any other type of incidents.
 Managing and reporting incidents 1388
Customizing incident snapshot pages

The Access Information section appears on the Key Info tab of the incident snapshot.
See “Discover incident snapshot” on page 1335.
See “Endpoint incident snapshot” on page 1319.
See “Network incident snapshot” on page 1310.

Customizing incident snapshot pages

You can customize the appearance of the incident snapshot page.
To customize the appearance of the incident snapshot page
1 From an incident snapshot, click Customize Layout (in the upper-right corner).
2 Select the information to appear on each of the tabs in the incident snapshots.
Tab 1 always contains the Key Info, and cannot be changed.
3 For each of the areas on the incident snapshot screen, select the information that appears.
4 Click Save.

About filters and summary options for reports

You can set a number of filters and summaries for Symantec Data Loss Prevention incident
reports.
These filters let you see the incidents and incident data in different ways.
The set of filters apply separately to Network, Endpoint, and Storage events.
Figure 48-1 shows the locations of the options to filter and summarize reports.
 Managing and reporting incidents 1389
About filters and summary options for reports

Figure 48-1 Filter and summary options

General filters

Advanced filters

Summary options

Current filters and

summary options

The filters and summary options are in the following sections:

General filters The general filter options are the See “General filters for reports”
most commonly used. They are on page 1390.
always visible in the incident list
report.

Advanced filters
The advanced filters provide many See “Advanced filter options for
additional filter options. You must reports” on page 1398.
click the Advanced Filters &
Summarization bar, and then
click Add Filter to view these filter
options.

Summary options The summary options provide See “Summary options for
ways to summarize the incidents incident reports” on page 1393.
in the list. You must click the
Advanced Filters &
Summarization bar to view these
summary options.
 Managing and reporting incidents 1390
General filters for reports

Symantec Data Loss Prevention contains many standard reports. You can also create custom
reports or save report summary and filter options for reuse.
See “About Symantec Data Loss Prevention reports” on page 1352.

General filters for reports

General filters for reports include a set of a few common filters.
Most of these filters are applicable for all the products. Network Discover/Cloud Storage
Discover contains some general filters that relate to scans of storage. For example, you can
filter the incidents that are in a particular scan. These filters are not applicable to Network
Prevent or Endpoint Prevent.
Table 48-2 lists the general filter options for report status values.
You can also create custom status values.
See “About incident status attributes” on page 1410.
These status filters are available for Network, Endpoint, and Discover incidents.

Table 48-2 General filters for status values

Name Description

Equals The status is equal to the field that is selected in the next drop-down.

Is Any Of The status can be any of the fields that are selected in the next drop-down.
Shift-click to select multiple fields.

Is None Of The status is none of the fields that are selected in the next drop-down.
Shift-click to select multiple fields.

Table 48-3 lists the general filter options by date.

These date filters are available for Network, and Endpoint incidents.

Table 48-3 General filters by date

Name Description

All Dates All of the dates that contain incidents.

Current Month to Date All of the incidents that were reported for the current month up to today's
date.

Current Quarter to Date All of the incidents that were reported for the current quarter up to today's
date.
 Managing and reporting incidents 1391
General filters for reports

Table 48-3 General filters by date (continued)

Name Description

Current Week to Date All of the incidents that were reported for the current week.

Current Year to Date All of the incidents that have been reported for the current year up to today's
date.

Custom A custom time frame. Select the dates that you want to view from the
calendar menu.

Last 7 Days All of the incidents that were reported in the previous seven days.

Last 30 Days All of the incidents that were reported in the previous 30 days.

Last Month All of the incidents that were reported during the previous calendar month.

Last Week All of the incidents that were reported during the previous calendar week.

Last Quarter All of the incidents that were reported during the previous quarter.

Last Year All of the incidents that were reported during the last calendar year.

Today All of the incidents that were reported today.

Yesterday All of the incidents that were reported yesterday.

Table 48-4 lists the general filter options by severity. Check the box to select the severities to
include in the filter.
These severity filters are available for Network, Endpoint, and Discover incidents.

Table 48-4 General filters for severity values

Name Description

High Lists only the high-severity incidents. Displays how many high-severity
incidents are in the incident list.

Info Lists only the incidents that are informational only. Informational incidents
are not assigned any other severity. Displays how many informational
incidents are in the incident list.

Low Lists only the low-severity incidents. Displays how many low-severity
incidents are in the incident list.

Medium Lists only the medium-severity incidents. Displays how many

medium-severity incidents are in the incident list.
 Managing and reporting incidents 1392
General filters for reports

Table 48-5 lists the general filter options for Network Discover scans. This filter is only available
for Discover incidents.

Table 48-5 General filters for scans

Name Description

All Scans All of the incidents that have been reported in all of the scans that have
been run.

Initial Scan All of the incidents that were reported in the initial scan.

In Process All of the incidents that have been reported in the scans that are currently
in progress.

Last Completed Scan All of the incidents that were reported in the last complete scan.

You can filter Discover incidents by Target ID. This filter is only available for Discover incidents.
Select the target, or select All Targets. Shift-click to select multiple fields.
Table 48-6 lists the general filter options by detection date for Discover incidents.

Table 48-6 General filters by date

Name Description

All Dates All of the dates that contain incidents.

Current Month to Date All of the incidents that were reported for the current month up to today's
date.

Current Quarter to Date All of the incidents that were reported for the current quarter up to today's
date.

Current Week to Date All of the incidents that were reported for the current week.

Current Year to Date All of the incidents that have been reported for the current year up to today's
date.

Custom A custom time frame. Select the dates that you want to view from the
calendar menu.

Custom Since The Symantec DLP Agents that have connected to the Endpoint Server
from a specific date to the present date. Select the date where you want
the filter to begin.

Custom Before The Symantec DLP Agents that have connected to an Endpoint Server
before a specific date. Select the final date for the filter.

Last 7 Days All of the incidents that were reported in the previous seven days.
 Managing and reporting incidents 1393
Summary options for incident reports

Table 48-6 General filters by date (continued)

Name Description

Last 30 Days All of the incidents that were reported in the previous 30 days.

Last Month All of the incidents that were reported during the previous calendar month.

Last Week All of the incidents that were reported during the previous calendar week.

Last Quarter All of the incidents that were reported during the previous quarter.

Last Year All of the incidents that were reported during the last calendar year.

Today All of the incidents that were reported today.

Yesterday All of the incidents that were reported yesterday.

Summary options for incident reports

Incident report summaries provide options for a summary of the information that is contained
within the incidents. For example, you can summarize incidents by the status or the policy.

Note: Hidden incidents are not included in report summaries unless the Advanced filter option
for the Is Hidden filter is set to Show All.
See “About incident hiding” on page 1406.

Table 48-7 lists the summary options for incident reports.

Table 48-7 Summary filters

Name Description Applicable products

Agent Configuration Summarize the agents and incidents by Endpoint

the associated agent configuration entity.
If you have more than one agent
configuration entity configured, you can
summarize or filter by a specific entity
drop down menu. If the default agent
configuration entity is the only entity
configured, you will not see the drop
down menu.

Agent Response Summarize incidents by how the agent Endpoint

has responded to the incident.
 Managing and reporting incidents 1394
Summary options for incident reports

Table 48-7 Summary filters (continued)

Name Description Applicable products

Content Root Summarize the incidents by the content Discover

root path.

Data Owner Email Address The email address of the person Network
responsible for remediating the incident.
Endpoint
This field must be set manually, or with
a lookup plug-in. Discover

Data Owner Name The person responsible for remediating Network

the incident. This field must be set
Endpoint
manually, or with a lookup plug-in.
Discover
Reports can automatically be sent to the
data owner for remediation.

Destination IP Summarize the incidents by the Network

destination IP address.
Endpoint

Detection Month Summarize the incidents by the month Discover

in which they were detected.

Detection Quarter Summarize the incidents by the calendar Discover

quarter in which they were detected.

Detection Week Summarize the incidents by the week in Discover

which they were detected.

Detection Year Summarize the incidents by the year in Discover

which they were detected.

Device Instance ID Summarize the incidents by the specific Endpoint

device that created the violation.

Domain Summarize the incidents by the domain Network

name.

Endpoint Location Summarize the incidents by the location Endpoint

of the endpoint.

The location can be one of the following:

■ On the Corporate Network

■ Off the Corporate Network

File Name Summarize the incidents by the file name Endpoint

that is associated with the incident.
 Managing and reporting incidents 1395
Summary options for incident reports

Table 48-7 Summary filters (continued)

Name Description Applicable products

File Owner Summarize the incidents by the owner Discover

of the file.

Investigating State Summarize the agents by the current Endpoint

status.
Discover

Location Summarize the incidents by their Discover

location.

Log Level Summarize the agents by their Endpoint

configured log levels.

Machine IP (Corporate) Summarize the incidents by the IP Endpoint

address of a machine on the corporate
network.

Machine Name Summarize the incident by the computer Endpoint

name on which the incidents were
created.

Month Summarize the incidents by the month Network

in which they were created.
Endpoint

Months Since First Summarize the incidents by how many Discover

Detected months have passed since the incident
was first detected.

Network Prevention Action Summarize the incidents by the action Network

from Network Prevent.

No primary summary Placeholder selection to denote that no Network

selected primary summary has been selected.
Endpoint

Discover

No secondary summary Placeholder selection to denote that no Network

selected summary has been selected.
Endpoint

Discover

Policy Summarize the incidents by the policy Network

from which they were created.
Endpoint

Discover
 Managing and reporting incidents 1396
Summary options for incident reports

Table 48-7 Summary filters (continued)

Name Description Applicable products

Policy Group Summarize the incidents by the policy Network

group to which they belong.
Discover

Protect Status Summarize the incidents by the Network Discover

status of the incidents.

Protocol Summarize the incidents by the protocol Network

that generated the incident.

Protocol or Endpoint Summarize the incidents by the protocol Endpoint

Destination or the endpoint destination where the
incidents were created.

Remediation Detection Summarize the incidents by their Discover

Status remediation detection status.

Quarantine Failure Reason Summarize the incidents by the reason Endpoint

that the quarantine response action
Discover
failed.

Quarter Summarize the incidents by the quarter Network

in which they were created.
Endpoint

Quarters Since First Summarize the incidents by how many Discover

Detected quarters have passed since the incident
was first detected.

Recipient Summarize the incidents by the recipient. Discover

Scan Summarize the incidents by which scan Discover

was used to find the incidents.

Scanned Machine Summarize the incidents by the Discover

computers that have been scanned.

Sender Summarize the incidents by the sender. Network

Endpoint

Discover

Server or Detector Summarize the incidents by the server Network

on which they were created.
Endpoint
 Managing and reporting incidents 1397
Summary options for incident reports

Table 48-7 Summary filters (continued)

Name Description Applicable products

Source IP Summarize the incidents by the source Network

IP address from which they were
Endpoint
created.

Source File Summarize the incidents by the source Endpoint

file that violated the policy.

Status Summarize the incidents by the incident Network

status.
Endpoint

Discover

Subject Summarize the incidents by the subject. Discover

Target ID Summarize the incidents by the target Discover

scan ID.

Target Type Summarize the incidents by the type of Discover

target on which the incident was
generated.

User Justification Summarize the incidents by the Endpoint

justification that was input by the user.

User Name Summarize the incidents by the user who Endpoint

generated the incident.

Week Summarize the incidents by the week in Network

which they were created.
Endpoint

Weeks Since First Summarize the incidents by how many Discover

Detected weeks have passed since the incident
was first detected.

Year Summarize the incidents by the year in Network

which they were created.
Endpoint

Years Since First Detected Summarize the incident by how many Discover
years have passed since the incident
was first detected.
 Managing and reporting incidents 1398
Advanced filter options for reports

Advanced filter options for reports

Advanced report filters let you filter incidents related to specific actions or text strings. For
example, you can filter the incidents that relate to a specific keyword. Or, you can filter out the
incidents that relate to a certain action. These filters combine a set of chooser fields or text
boxes to create the advanced filter.
Table 48-8, Table 48-9, and Table 48-10 list the advanced filter options for reports.

Table 48-8 Advanced filters, first field

Name Description Applicable

products

Agent Configuration Summarize the agents and incidents by the Endpoint

associated agent configuration entity. If you
have more than one agent configuration entity
configured, you can summarize or filter by a
specific entity drop down menu. If the default
agent configuration entity is the only entity
configured, you will not see the drop down
menu.

Agent Configuration Status Summarize the agent by the status of the Endpoint
configuration entity.

■ Current Configuration
The configuration on the agent is the same
as the configuration on the Endpoint Server.
■ Outdated Configuration
The configuration on the agent is different
than the configuration on the Endpoint
Server.
■ Unknown/deleted Configuration
The agents either cannot report which
configuration is installed, or the configuration
on the agent has been deleted from the
Endpoint Server.

Agent Response Filter incidents by how the agent has responded Endpoint
to the incident.

Application Name Filter the incidents by the name of the Endpoint

application where the incident was generated.

Application Window Title Filter the incidents by a string in the title of the Endpoint
window where the incident was generated.
 Managing and reporting incidents 1399
Advanced filter options for reports

Table 48-8 Advanced filters, first field (continued)

Name Description Applicable

products

Attachment File Name Filter incidents by the file name of the Network
attachment that is associated with the incident.

Attachment File Size Filter incidents by the size of the attachment that Network
is associated with the incident.

Box: Collaborator Filter incidents by Box collaborators. Discover

Box: Collaborator Role Filter incidents by the role of the Box Discover
collaborator. Roles include:

■ Co-owner
■ Editor
■ Previewer
■ Previewer Uploader
■ Uploader
■ Viewer
■ Viewer Uploader

Box: Shared Link Filter incidents by the presence or absence of Discover

a shared link.

Box: Shared Link Download Allowed Filter incidents by the presence or absence of Discover
a shared link that allows downloads.

Box: Shared Link Expiration Date Filter incidents by the expiration date setting of Discover
a shared link.

Box: Shared Link Password Protected Filter incidents by the presence or absence of Discover
a password-protected shared link.

Content Root Filter the incidents by the content root path. Discover

Data Owner Email Address
The email address of the person responsible for Network
remediating the incident. This field must be set
Endpoint
manually, or with a lookup plug-in.
Discover

Data Owner Name The person responsible for remediating the Network
incident. This field must be set manually, or with
Endpoint
a lookup plug-in.
Discover
Reports can automatically be sent to the data
owner for remediation.
 Managing and reporting incidents 1400
Advanced filter options for reports

Table 48-8 Advanced filters, first field (continued)

Name Description Applicable

products

Destination IP Filter the incidents by the destination IP address Network

for the message that generated the incident.
Endpoint

Detection Date Filter the incidents by the date that the incident Discover
was detected.

Device Instance ID Summarize the incidents by the specific device Endpoint

that created the violation.

Document Name Filter the incidents by the name of the violating Discover
document.

Domain Filter the incidents by the domain name that is Network

associated with the incident.

Endpoint Location Filter the incidents by the endpoint location. Endpoint

The location can be one of the following:

■ On the Corporate Network

■ Off the Corporate Network

File Last Modified Date Filter the incidents by the last date when the file Endpoint
was modified.
Discover

File Location Filter the incidents by the location of the violating Endpoint
file.

File Name Filter the incidents by the name of the violating Endpoint
file. No wildcards, but you can specify a partial
Discover
match, for example .pdf.

File Owner Filter the incidents by the owner of the violating Discover
files.

File Size Filter the incidents by the size of the violating Endpoint
file.
Discover

Incident History Issuer Filter the incidents by the user responsible for Network
issuing the history of the incident.
Endpoint

Discover
 Managing and reporting incidents 1401
Advanced filter options for reports

Table 48-8 Advanced filters, first field (continued)

Name Description Applicable

products

Incident ID Filter the incidents by the ID of the incidents. Network

Endpoint

Discover

Incident Match Count Filter the incidents by the number of incident Network
matches.
Endpoint

Discover

Incident Notes Filter the incidents by a string in the incident Network

notes.
Endpoint

Discover

Incident Reported On Filter the incidents by the date that the incident Endpoint
was reported.

Investigating State Filter the agents by the investigation state. You Discover
can select one of the following:
Endpoint
■ Investigating
■ Not Investigating

Is Hidden Filters hidden incidents. You can select one of Network

the following:
Endpoint
■ Show All
Discover
■ Show Hidden

See “About incident hiding” on page 1406.

Is Hiding Allowed Filters the incidents based on the state of the Is Network
Hiding Allowed flag. Select the Is Any Of
Endpoint
operator from the second field, then select either
the Allow Hiding or Do Not Hide option from Discover
the third field.

See “About incident hiding” on page 1406.

Last Connection Time Filter agents according to the last time each Endpoint
agent connected to the Endpoint Server.

Location Filter the incidents by their location. Location Discover

can include the server where the incidents were
generated.
 Managing and reporting incidents 1402
Advanced filter options for reports

Table 48-8 Advanced filters, first field (continued)

Name Description Applicable

products

Machine IP (Corporate) Filter the incidents by the IP address of the Endpoint

computer on which the incidents were created.

Machine Name Filter the incidents by the computer name on Endpoint

which the incidents were created.

Network Prevent Action Filter the incidents by the action from Network Network
Prevent.

Policy Filter the incidents by the policy from which they Network
were created.
Endpoint

Discover

Policy Group Filter the incidents by the policy group to which Network
they belong.
Endpoint

Discover

Policy Rule Filter the incidents by the policy rule that Network
generated the incidents.
Endpoint

Discover

Protect Status Filter the incidents by the Network Protect status Discover
of the incidents.

Protocol Filter the incidents by the protocol to which they Network

belong.

Protocol or Endpoint Destination Filter the incidents by the protocol or the Endpoint
endpoint destination that generated the incident.

Read ACL: File Filter the incidents by the File access control Endpoint
list.
Discover

Read ACL: Share Filter the incidents by the Share access control Discover
list.

Recipient Filter the incidents by the name of the recipient Network

of the message that generated the incident.
Endpoint

Discover
 Managing and reporting incidents 1403
Advanced filter options for reports

Table 48-8 Advanced filters, first field (continued)

Name Description Applicable

products

Remediation Detection Status Filter the incidents by their remediation detection Discover
status.

Scanned Machine Filter the incidents by the computers that have Discover
been scanned.

Seen Before Filter the incidents on whether an earlier Discover, but not
connected incident exists. for SQL Database
incidents (where
Seen Before is
always false)

Sender Filter the incidents by the sender. Network

Endpoint

Discover

Server or Detector Filter the incidents by the server on which they Network
were created.
Endpoint

Discover

SharePoint ACL: Permission Level Filter the incidents on the permission level of Discover
the SharePoint access control list.

SharePoint ACL: User/Group Filter the incidents on the user or group in the Discover
SharePoint access control list.

Source IP Filter the incidents by the source IP address Network

from which they were created.

Subject Filter incidents by the subject line of the Network

message that generated the incident.
Discover

Superseded Filter the incidents by the incident responses Discover

have been superseded by other responses.
Endpoint

Target Type Filter the incidents by the type of target that is Discover
associated with the incidents.

Time Since First Detected Filter the incidents by how much time has Discover, but not
passed since the incident was first detected. for SQL Database
incidents
 Managing and reporting incidents 1404
Advanced filter options for reports

Table 48-8 Advanced filters, first field (continued)

Name Description Applicable

products

URL Filter the incidents by the URL where the Discover

violations occurred.

User Justification Filter the incidents by the justification that was Endpoint
input by the user.

User Name Filter the incidents by the user who generated Endpoint
the incident.

The second field in the advanced filters lets you select the match type in the filter.

Table 48-9 Advanced filters, second field

Name Description

Contains Any Of Lets you modify the filter to include any words in the text string, or lets
you choose from a list in the third field.

Contains Ignore Case Lets you modify the filter to ignore a specific text string.

Does Not Contain Ignore Lets you modify the filter to filter out the ignored text string.
Case

Does Not Match Exactly Lets you modify the filter to match on any combination of the text string.

Ends with Ignore Case Lets you modify the filter so that only the incidents that end with the ignored
text string appear.

Is Any Of Lets you modify the filter so that the results include any of the text string,
or lets you choose from a list in the third field.

Is Between Lets you modify the filter so that the numerical results are between a range
of specified numbers.

Is Greater Than Lets you modify the filter so that the numerical results are greater than a
specified number.

Is Less Than Lets you modify the filter so that the numerical results are less than a
specified number.

Is None Of Lets you modify the filter so that the results do not include any of the text
string, or lets you choose from a list in the third field.

Is Unassigned Lets you modify the filter to match incidents for which the value specified
in the first field are unassigned.
 Managing and reporting incidents 1405
Advanced filter options for reports

Table 48-9 Advanced filters, second field (continued)

Name Description

Matches Exactly Lets you modify the filter to match exactly the text string.

Matches Exactly Ignore Lets you modify the filter so that the filter must match the ignored text
Case string exactly.

Starts with Ignore Case Lets you modify the filter so that only the incidents that start with the
ignored text string appear.

The third field in the advanced filters lets you select from a list of items, or provides an empty
box to enter a string.
This third field varies depending on the selections in the first and second fields.
For a list of items, use Shift-click to select multiple items.
For strings, wildcards are not allowed, but you can enter a partial string.
For example, you can enter .pdf to select any PDF file.
If you do not know what text to enter, use the summary options to view the list of possible text
values. You can also see a summary of how many incidents are in each category.
See “Summary options for incident reports” on page 1393.
Table 48-10 lists some of the options in the third field.

Table 48-10 Advanced filters, third field

Name Description

Blocked The user was blocked from performing the action that cause the incident.

Content Removed The content in violation was removed.

No Remediation No incident remediation has occurred for this incident.

None No action was taken regarding the violation that caused the incident.

Protect File Copied The file in violation was copied to another location.

Protect File Quarantined The file in violation was quarantined to another location.

User Notified The user was notified that a violation had occurred.
 Chapter 49
Hiding incidents
This chapter includes the following topics:

■ About incident hiding

■ Hiding incidents

■ Unhiding hidden incidents

■ Preventing incidents from being hidden

■ Deleting hidden incidents

About incident hiding

Incident hiding lets you flag specified incidents as "hidden." Because these hidden incidents
are excluded from normal incident reporting, you can improve the reporting performance of
your Symantec Data Loss Prevention deployment by hiding any incidents that are no longer
relevant. The hidden incidents remain in the database; they are not moved to another table,
database, or other type of offline storage.
You can set filters on incident reports in the Enforce Server administration console to display
only hidden incidents or to display both hidden and non-hidden incidents. Using these reports,
you can flag one or more incidents as hidden by using the Hide/Unhide options that are
available when you select one or more incidents and click the Incident Actions button. The
Hide/Unhide options are:
■ Hide Incidents—Flags the selected incidents as hidden.
■ Unhide Incidents—Restores the selected incidents to the unhidden state.
■ Do Not Hide—Prevents the selected incidents from being hidden.
■ Allow Hiding—Allows the selected incidents to be hidden.
 Hiding incidents 1407
Hiding incidents

The hidden state of an incident displays in the incident snapshot screen in the Enforce Server
administration console. The History tab of the incident snapshot includes an entry for each
time the Do Not Hide or Allow Hiding flags are set for the incident.
See “Filtering reports” on page 1366.
Access to hiding functionality is controlled by roles. You can set the following user privileges
on a role to control access:
■ Hide Incidents—Grants permission for a user to hide incidents.
■ Unhide Incidents—Grants permission for a user to show hidden incidents.
■ Remediate Incidents—Grants permission for a user to set the Do Not Hide or Allow
Hiding flags.
See “About role-based access control” on page 93.
See “Hiding incidents ” on page 1407.
See “Unhiding hidden incidents ” on page 1407.
See “Preventing incidents from being hidden” on page 1408.

Hiding incidents
To hide incidents
1 Open the Enforce Server administration console and navigate to an incident report.
2 Select the incidents you want to hide, either by selecting the incidents manually or by
setting filters or advanced filters to return the set of incidents that you want to hide.
3 Click the Incident Actions button and select Hide/Unhide > Hide Incidents.
The selected incidents are hidden.

Unhiding hidden incidents

To restore hidden incidents
1 Open the Enforce Server administration console and navigate to an incident report.
2 Select the Advanced Filters & Summarization link.
3 Click the Add filter button.
4 Select Is Hidden in the first drop-down list.
 Hiding incidents 1408
Preventing incidents from being hidden

5 Select Show Hidden from the second drop-down list.

6 Select the incidents you want to unhide, either by selecting incidents manually or by setting
filters or advanced filters to return the set of incidents you want to unhide.
The selected incidents are unhidden.

Preventing incidents from being hidden

You can prevent incidents from being hidden using either an incident report or an incident
snapshot.
To prevent incidents from being hidden using an incident report
1 Open the Enforce Server administration console and navigate to an incident report.
2 Select the incidents you want to prevent from being hidden. You can select incidents
manually or by setting filters or advanced filters to return the set of incidents you want to
prevent from being hidden.
3 Click the Incident Actions button and select Hide/Unhide > Do Not Hide.
The selected incidents are prevented from being hidden.

Note: You can allow incidents to be hidden that you have prevented from being hidden
by selecting the incidents and then selecting Hide/Unhide > Allow Hiding from the
Incident Actions button.

To prevent an incident from being hidden using the incident snapshot

1 Open the Enforce Server administration console and navigate to an incident report.
2 Click on an incident to open the incident snapshot.
3 On the Key Info tab, in the Incident Details section, click Do Not Hide.

Note: You can allow an incident to be hidden that you have prevented from being hidden
by opening the incident snapshot and then clicking Allow Hiding in the Incident Details
section.
 Hiding incidents 1409
Deleting hidden incidents

Deleting hidden incidents

To delete hidden incidents
1 Open the Enforce Server administration console and navigate to an incident report.
2 Click the Advanced Filters & Summarization link.
3 Click Add filter.
4 Select Is Hidden in the first drop-down list.
5 Select Show Hidden from the second drop-down list.
6 Select the incidents you want to delete. You can select the incidents manually or you can
set filters or advanced filters that return the set of incidents you want to delete.
7 Click the Incident Actions button and select Delete incidents.
8 Select one of the following delete options:

Delete incident Permanently deletes the incident(s) and all associated data (for example,
completely any emails and attachments). Note that you cannot recover the incidents
that have been deleted.

Retain incident, but Retains the actual incident(s) but discards the Symantec Data Loss
delete message data Prevention copy of the data that triggered the incident(s). You have the
option of deleting only certain parts of the associated data. The rest of the
data is preserved.

Delete Original Deletes the message content (for example, the email message or HTML
Message post). This option applies only to Network incidents.

Delete This option refers to files (for Endpoint and Discover incidents) or email or
Attachments/Files posting attachments (for Network incidents). The options are All, which
deletes all attachments, and attachments with no violations. For example,
choose this option to delete files (for Endpoint and Discover incidents) or
email attachments (for Network incidents).

This option deletes only those attachments in which Symantec Data Loss
Prevention found no matches. For example, choose this option when you
have incidents with individual files taken from a compressed file (Endpoint
and Discover incidents) or several email attachments (Network incidents).

9 Click the Delete button.

 Chapter 50
Working with incident data
This chapter includes the following topics:

■ About incident status attributes

■ Configuring status attributes and values

■ Configuring status groups

■ Export web archive

■ Export web archive—Create Archive

■ Export web archive—All Recent Events

■ About custom attributes

■ About using custom attributes

■ How custom attributes are populated

■ Configuring custom attributes

■ Setting custom attributes

■ Setting the values of custom attributes manually

About incident status attributes

Incident status attributes are specified and configured from the Attributes screen (System >
Incident Data > Attributes).
Any status attribute listed on this screen can be assigned to any given incident by selecting it
from the incident snapshot Status drop-down menu.
The system attributes page contains the following attributes to assist in incident remediation:
■ Status Values
 Working with incident data 1411
About incident status attributes

The Status Values section lists the current incident status attributes that can be assigned
to a given incident. Use this section to create new status attributes, modify them, and
change the order that each attribute appears in drop-down menus.
See “Configuring status attributes and values” on page 1412.
■ Status Groups
The Status Groups section lists the current incident status groups and their composition.
Use this section to create new status groups, modify them, and change the group order
they appear in drop-down menus.
See “Configuring status groups” on page 1413.
■ Custom Attributes on the Custom Attributes tab
The Custom Attributes tab provides a list of all of the currently defined custom incident
attributes. Custom attributes provide information about the incident or associated with the
incident. For example, the email address of the person who caused the incident, that
person's manager, why the incident was dismissed, and so on. Use this tab to add, configure,
delete, and order custom incident attributes.
See “About custom attributes” on page 1416.
The process for handling incidents goes through several stages from discovery to resolution.
Each stage is identified by a different status attribute such as "New," "Investigation," "Escalated,"
and "Resolved." This lets you track the progress of the incident through the workflow, and filter
lists and reports by incident status.
The solution pack you installed when you installed Symantec Data Loss Prevention provides
an initial default set of status attributes and status attribute groups. You can create new status
attributes, or modify existing ones. The status attribute values and status groups you use
should be based on the workflow your organization uses to process incidents. For example,
you might assign all new incidents a status of "New." Later, you might change the status to
"Assigned," "Investigation," or "Escalated." Eventually, most incidents will be marked as
"Resolved" or as "Dismissed."
For list and report filtering, you can also create status groups.
Based on the preferences of your organization and the commonly used terminology in your
industry, you can:
■ Customize the names of the status attributes and add new status attributes.
■ Customize the names of the status groups and add new status groups.
■ Set the order in which status attributes appear on the Status drop-down list of an incident.
■ Specify the default status attribute that is automatically assigned to new incidents.
See “Configuring status attributes and values” on page 1412.
See “About incident reports” on page 1354.
See “About incident remediation” on page 1294.
 Working with incident data 1412
Configuring status attributes and values

See “About custom attributes” on page 1416.

Configuring status attributes and values

As incidents are processed from discovery to resolution, each stage can be marked with a
different status. The status lets you track the progress of the incident through your workflow.
Based on the preferences of your organization and the commonly used terminology in your
industry, you can define the different statuses that you want to use for workflow tracking.
The Status Values section lists the available incident status attributes that can be assigned
to a given incident. The order in which status attributes appear in this list determines the order
they appear in drop-down menus used to set the status of an incident. You can perform the
following actions from the Status Values section:

Action Procedure

Create a new incident status attribute. Click the Add button.

Delete an incident status attribute. Click the attribute's red X and then confirm your decision.

Change an incident status attribute. Click on the attribute you want to change, enter a new name,
and click Save.

To change the name of an existing status, click on the pencil

icon for that status, enter the new name, and click Save.

Make an incident status attribute the Click [set as default] for an attribute to make it the default
default. status for all new incidents.

Change an incident status attribute's ■ Click [up] to move an attribute up in the order.
order in drop-down menus. ■ Click [down] to move an attribute down in the order.

To create a new incident status attribute

1 Go to the Attributes screen (System > Incident Data > Attributes) screen.
Click the Status tab.
2 Click the Add button in the Status Values section.
3 Enter a name for the new status attribute.
4 Click Save.
See “Configuring status groups” on page 1413.
See “About incident status attributes” on page 1410.
 Working with incident data 1413
Configuring status groups

Configuring status groups

Incident status attributes can be assigned to status groups that match the workflow of your
organization. For example, an Open status group might include the status attributes of New,
Investigation, and Escalated. You can then filter incident lists and reports based on their
status group. For example, you can list all incidents with status attributes that belong to the
Open status group.
System > Incident Data > Attributes brings you to Status Groups.
For your convenience, you can group incident statuses to match the workflow of your
organization. You use Status Groups to add or modify the name of a status group, and specify
which status values to include in the group.
The Status Groups section lists the available incident status groups that can be used to filter
incidents. For each group, the status attributes included in the group are listed. You can perform
the following actions from the Status Values section:

Action Procedure

Create a new incident status group. Click the Add Status Group button.

Delete an incident status group. Click the group's red X and then confirm your decision.

Change the name or incident status Click on the group you want to change.Click the pencil icon.
attributes of a group. Change the name, check or uncheck attributes, and click Save.

Change a status group's order in ■ Click [up] to move a group up in the order.
drop-down menus. ■ Click [down] to move a group down in the order.

To define a new status group

1 Go to the Attributes screen (System > Incident Data > Attributes) screen.
Click the Status tab.
2 Click the Add Status Group button in the Status Groups section.
3 Enter a name for the new status group.
4 Click the check boxes for the status attributes that you want to include in this group.
Status attributes are defined with the Add button in the Status Values section.
See “Configuring status attributes and values” on page 1412.
5 Click Save.
See “Configuring status attributes and values” on page 1412.
See “About incident status attributes” on page 1410.
 Working with incident data 1414
Export web archive

Export web archive

Use this screen to save an incident list report as an archive of HTML pages. An archive allows
personnel without direct access to Symantec Data Loss Prevention to study incident data,
drilling down into individual incidents as needed.
When you export incidents as a Web Archive, the archive is placed in directory
\SymantecDLP\Protect\archive\webarchive.

Note: You cannot archive summary reports or dashboards.

When exporting incidents, please note the following considerations:

■ An archive cannot be summarized like a normal report.
■ An archive contains no filters, so it may be difficult to locate a specific incident in an archive
containing a large number of incidents.
■ Exporting an archive of incidents does not remove the incidents from the administration
console.
■ You can export only one archive at a time.
Export Web Archive is a user privilege that must be assigned to a role. You can export web
archives only if your role provides access to this feature. Since role access also determines
what information is contained in incident reports, it also applies to archiving those incident
reports. The information that is contained in the archive you create is the same information
contained in the original incident report.
See “About configuring roles and users” on page 94.
The Export web archive screen is divided into two sections:
See “Export web archive—Create Archive” on page 1414.
See “Export web archive—All Recent Events” on page 1415.

Export web archive—Create Archive

In the Create Archive section, complete the following information:

Field Description

Archive Name Specify a name for the archive you are creating
using normal Windows naming conventions.
 Working with incident data 1415
Export web archive—All Recent Events

Field Description

Report to Export From the drop-down list, select the report that you
want to archive. Any reports you created are
available along with default report options.
The Network options are as follows:

■ Incidents - Week, Current—Network incidents

from the current week.
■ Incidents - All—All network incidents.
■ Incidents - New—Network incidents with status
of New.
The Endpoint options are as follows:

■ Incidents - Week, Current—Endpoint incidents

from the current week.
■ Incidents - All—All endpoints incidents.
■ Incidents - New—Only endpoint incidents with
status of New.
The Discover options are as follows:

■ Incidents - Last Scan—Discover incidents from

the last completed scan. (Incidents from a
currently active scan are not included.)
■ Incidents - Scan in Process—Discover
incidents from the current scan.
■ Incidents - All Scans—All Discover incidents.
■ Incidents - New—Discover incidents with status
of New.

After you complete the fields, click Create to compile the archive.
See “Export web archive” on page 1414.

Export web archive—All Recent Events

The All Recent Events section displays a list of events related to this archive. (The list appears
only after you click Create to create the archive.) Event entries show the following information:
■ The event type (Error, Warning, or System Information).
■ The event date and time
■ A brief description of the event
To see the details of any event, click on the event entry in the list. To see the full Events Report
for this archive, click show all.
 Working with incident data 1416
About custom attributes

See “Export web archive” on page 1414.

About custom attributes

"Custom attributes" are incident data fields that provide a way to capture and store supplemental
incident information. The additional data that is contained in custom attributes can be:
■ Used to drive workflow.
■ Execute incident response actions.
■ Used in report metrics.
■ Enable Incident Response Teams to act faster on incidents.
■ Enable increased remediation and report automation.
You create the custom attributes that you need for these purposes. Custom attributes provide
information about an incident or associated with an incident; for example, the email address
of the person who caused the incident, that person's manager, why the incident was dismissed,
and so on.
The Custom Attributes tab of the Attributes screen (System > Incident Data > Attributes)
is used for working with custom attributes. The Attributes screen contains the following tabs:
■ Status. The Status tab provides a list of all of the currently defined incident status attributes
and status attribute groups. Use this tab to add, configure, delete, and order incident status
attributes and incident status groups.
See “About incident status attributes” on page 1410.
■ Custom Attributes. The Custom Attributes tab provides a list of all of the currently defined
custom incident attributes. Use this tab to add, configure, delete, and order custom incident
attributes.
The solution pack you loaded when you installed Symantec Data Loss Prevention provides
an initial default set of custom attributes. The Custom Attributes tab provides a list of all of the
currently defined custom attributes that may be applied to any incident. This tab is for creating,
modifying, and deleting custom attributes for your installation as a whole. Applying any of these
custom attributes, or attribute values, to an individual incident is done from the incident snapshot,
or by using a lookup plug-in.
On the Custom Attributes tab, you can perform the following functions:

Action Procedure

Create a new custom attribute. Click the Add button.

 Working with incident data 1417
About using custom attributes

Action Procedure

Delete a custom attribute. Click the attribute's red "X" and then confirm your decision.

Note that you cannot delete a custom attribute that is currently

assigned to one or more incidents. You must assign a different
attribute to the affected incident(s) before you can delete the
custom attribute successfully.

Change the name, email status, or Click on the attribute you want to change, change its
attribute group of an attribute. parameters, and Click Save.

Change the attributes order in 1 Click [up] to move an attribute up in the order.
drop-down menus.
2 Click [down] to move an attribute down in the order.

Reload Lookup Plugins Click Reload Lookup Plug-ins to reload any custom attribute
plug-ins that have been unloaded by the system.

Reloading look-up plugins affects all incidents. You may need

to reload lookup plug-ins if any of the following are true:

■ A plug-in was problematic and the system unloaded it, but

now the problem is fixed.
■ The network was down or disconnected for some reason,
but it is functioning properly now.
■ A plug-in stores data in a cache, and you want to update
the cache manually.

See “About incident status attributes” on page 1410.

See “Configuring custom attributes” on page 1418.
See “Setting the values of custom attributes manually” on page 1420.

About using custom attributes

When an incident is created, the Enforce Server retrieves data regarding that incident. Some
of that data is in the form of "attributes." See the Symantec Data Loss Prevention Administration
Guide for more information about incident attributes.
"Custom attributes" are a particular kind of attribute that is used to capture and store
supplemental data. This data is related to the incident such as the name of a relevant manager
or department. You create the custom attributes that you need.
The additional data that is contained in custom attributes can be used for:
■ Enabling a workflow
■ Executing incident response actions
 Working with incident data 1418
How custom attributes are populated

■ Including in report metrics

■ Enabling incident response teams to act faster on incidents
■ Enabling increased remediation and report automation

How custom attributes are populated

For each incident, custom attributes can be populated (their values can be set in the incident
data) in the following ways:
■ Automatically when the incident is detected by means of a lookup plug-in, as described in
this guide
■ Automatically when the incident is detected by means of an automated response rule
■ Automatically when a user executes a Smart Response Rule
■ Manually (through data entry) by specific users after detection
Custom attributes can also be re-populated automatically by clicking on the Lookup option in
the Attribute section of the Incident Snapshot screen. This action replaces the existing values
that are stored in the custom attribute fields with the values returned by the new lookup.

Note: If the new lookup returns null or empty values for any custom attribute fields, those empty
values overwrite the existing values.

Configuring custom attributes

Use the Configure Custom Attribute screen to add or modify the a custom attribute.
Custom attributes can be grouped into attribute groups, similar to how statuses are grouped
into status groups, to organize the information in a useful way. Examples of common attribute
groups include Employee Information, Manager Information, and Remediation Information.
All custom attributes are available for all incidents.
To create custom attributes and add them to a group
1 On the Enforce Server, click System > Incident Data > Attributes > Custom Attributes.
Note that a number of custom attributes were defined and loaded for you by the Solution
Pack that you selected during installation. All existing custom attributes are listed in the
Custom Attributes window.
2 To create a new custom attribute, click the Add option.
 Working with incident data 1419
Setting custom attributes

3 Type a name for the custom attribute in the Name box. If appropriate, check the Is Email
Address box.
The name you give to a custom attribute does not matter. But a custom attribute you
create must be structured the same as the corresponding external data source. For
example, suppose an external source stores department information as separate
geographic location and department name. In this case, you must create corresponding
location and department name custom attributes. You cannot create a single department
ID custom attribute combining both the location and the department name.
4 Select an attribute group from the Attribute Group drop-down list. If necessary, create
a new attribute group. Select Create New Attribute Group from the drop-down list, and
type the new group name in the text box that appears.
5 Click Save.
See “Configuring custom attributes” on page 1418.
See “About incident status attributes” on page 1410.
See “Configuring status groups” on page 1413.
See “Configuring status attributes and values” on page 1412.

Setting custom attributes

Once you define your custom attributes, they become available to every incident. Each incident
receives its own set of custom attributes (though some name-value pairs may be empty
depending on circumstances). The custom attribute values for an incident can be populated
and changed independently of other incidents.
You can edit the custom attribute values if you have been assigned to a role that includes edit
access for custom attributes. If you want to update a group of incidents, you can select those
incidents on the incident list page. You can then select the Set Attributes command from the
Incident Actions menu. You can select Lookup Attributes, to look up the values of custom
attributes. Note that the Set Attributes command and Attributes section on the Incident
Snapshot page are available only if at least one custom attribute is defined.
To set custom attributes for incidents
1 On the incident list page, select the incident or incidents you want to set custom attributes
for, then click Incident Actions > Set Attributes.
The Set Incident Attributes page appears.
2 Select the custom attributes you want to set for the incident or incidents.
3 Click Save..
4 Generate a new incident, or view an existing incident, and verify that it contains the new
custom attribute.
 Working with incident data 1420
Setting the values of custom attributes manually

See “Configuring custom attributes” on page 1418.

See “About incident status attributes” on page 1410.
See “Configuring status attributes and values” on page 1412.

Setting the values of custom attributes manually

You can manually specify incident remediation status or workflow progress with values in
custom attributes.

Note: To auto-populate custom attribute values, use one or more lookup plugins. See “About
lookup plug-ins” on page 1434.

To set the value of custom attributes

1 Display an incident snapshot.
2 Click the Edit option in the Attributes section of the incident snapshot.
3 To set a value for a custom attribute, enter the value in the appropriate attributes field.
4 When you are finished setting values, click Save.
 Chapter 51
Working with user risk
This chapter includes the following topics:

■ About user risk

■ About user data sources

■ About identifying users in web incidents

■ Viewing the user list

■ Viewing user details

■ Working with the user risk summary

About user risk

The user risk summary gives you insight into the behavior of specific individuals in your
organization by associating users with web, email, and endpoint incidents. This information
helps you focus your data loss prevention efforts on those users posing the highest risk to the
security of your data.
The Table 51-1 table provides an overview of the steps for creating and working with user risk
summary reports.

Table 51-1 User Risk Summary workflow

Step Action Description

1 Create custom user attributes
You can create custom attributes for filtering and working with user
risk summary reports. For example, you can create an attribute named
Employment Status to track the employment status of each of your
users. You can then import that information in a file that is exported
from your enterprise resource planning system, such as SAP.

See “Defining custom attributes for user data” on page 1424.

 Working with user risk 1422
About user risk

Table 51-1 User Risk Summary workflow (continued)

Step Action Description

2 Import user data You can import user data from an Active Directory connection or from
a CSV file. Incidents are associated with specific users by email
address and logon credentials. You can also upload files with your
custom attributes, such as information from your enterprise resource
planning system. Symantec Data Loss Prevention provides a CSV
template file that you can use to format any data you want to upload.

See “Bringing in user data” on page 1425.

3 Configure IP address to user name
resolution
Symantec Data Loss Prevention can resolve user names from IPv4
addresses in HTTP/S and FTP incidents. The domain controller agent
queries Windows Events in the Microsoft Active Directory Security
Event Log of the domain controller. Symantec Data Loss Prevention
associates these Windows Events with user data in your database.

See “About identifying users in web incidents ” on page 1429.

3 View the User List The User List is a list of all users in your system, including their email
address, domain, and logon name.

See “Viewing the user list” on page 1431.

You can view details for specific users in the user snapshot.

See “Viewing user details” on page 1432.

4 View the User Risk Summary
The User Risk Summary displays your users and their associated
Endpoint and Network incidents. Use the User Risk Summary to
drill into your user-centric incident data to help you find the
highest-risk users. You can sort and filter this list by policies, custom
attributes, incident status, incident severity, user name identified by
IP address, number of incidents, date, incident type, and user name.

See “Working with the user risk summary” on page 1432.

5 Export user risk summary or user You can export data from the user risk summary and user snapshots
snapshot data. to a CSV file.

See “Working with the user risk summary” on page 1432.

See “Viewing user details” on page 1432.

Using the information that is provided in the user risk summary, you can see who the high-risk
users are and determine the appropriate course of action to take. Such actions might include:
■ Determining whether or not a user poses an active threat to your data security.
■ Applying additional policies to monitor a user's behavior more closely.
■ Applying additional response rules to block actions or send alerts.
 Working with user risk 1423
About user data sources

■ Escalating a user's behavior to their manager or other responsible party.

To work with user risk data, a Symantec Data Loss Prevention user must have the User
Reporting privilege. Be aware that users with this privilege are automatically able to view and
access all incidents and incident types in Symantec Data Loss Prevention. The user risk
summary is intended for use by high-level remediators or information security officers. This
privilege is not part of any predefined role.
See “Configuring roles” on page 98.

About user data sources

You can bring in data about your users in CSV file format or through an Active Directory
connection.
User data is information about people in your organization who may have access to data that
you want to keep secure. To track user risk, you must provide the user's first and last name,
their email address (to track Network incidents) and logon information (to track Endpoint
incidents). You can also provide additional standard directory attribute information, such as
the user's address and phone number, as well as custom attributes such as the user's
employment status.
The Table 51-2 table lists the required and optional standard user data attributes:

Table 51-2 Standard user data

Attribute Required or optional Description

FIRST_NAME Required The user's given name.

LAST_NAME Required The user's surname.

EMAIL Required if no logon information is The user's email address.

included

LOGIN Required if no email address is The user's logon information, in

included DOMAIN\LOGIN format

TELEPHONE_NUMBER Optional The user's telephone number.

EMPLOYEE_ID Optional The user's employee identification

number.

TITLE Optional The user's job title.

DEPARTMENT Optional The user's job department.

STREET_ADDRESS Optional The user's street address

 Working with user risk 1424
About user data sources

Table 51-2 Standard user data (continued)

Attribute Required or optional Description

STATE_OR_PROVINCE Optional The state or province in which the user

resides.

COUNTRY Optional The country in which the user resides.

POSTAL_CODE Optional The postal code for the user's address.

See “Defining custom attributes for user data” on page 1424.

See “Bringing in user data” on page 1425.

Defining custom attributes for user data

You can create custom attributes to improve relevance while filtering and working with user
risk summary reports. Useful custom attributes might include employment status, the name
of the user's manager, the user's job function, and other information that might be stored in
your enterprise resource planning system or additional user data source.
You must create custom attributes before entering any user data. Each custom attribute is
assigned a unique identification number as it is created. You must add these custom attribute
identification numbers to your data file before you import it to Symantec Data Loss Prevention.
See “Adding a file-based user data source” on page 1425.
To define custom attributes for user data
1 In the Enforce Server administration console, go to System > Users > Attributes.
2 Click Add. The User Attribute dialog box appears.
3 Enter the custom attribute in the Name field. The custom attribute can be a maximum of
60 characters.
4 Click Submit.
To view and edit user custom attributes
1 In the Enforce Server administration console, go to System > Users > Attributes.
2 The custom attributes appear in the User Custom Attributes list. You can take these
actions:
■ To filter the User Custom Attributes list, click Filters, then use the text fields for ID
or Attribute Name to enter a filter value.
■ To edit a custom attribute, click the attribute name or click the edit icon in the Actions
column, then edit the attribute in the User Attribute dialog box.
■ To delete a custom attribute, click the delete icon in the Actions column.
 Working with user risk 1425
About user data sources

Bringing in user data

You can bring in user data from a file or an Active Directory connection.
See “Adding a file-based user data source” on page 1425.
See “Adding an Active Directory user data source” on page 1426.
After you have added your user data sources, you can schedule Symantec Data Loss Prevention
to regularly import data from those data sources to ensure that your user data is always up to
date. You can also import a user data source manually.
See “Importing a user data source” on page 1428.

Adding a file-based user data source

You can bring in user data from a .csv file. For your convenience, Symantec Data Loss
Prevention provides an annotated .csv template that you can use to ensure that your data is
formatted correctly. The template includes all the standard user attributes, as well as formatting
examples and instructions for adding custom attributes. The template also includes headers
for any custom attributes that you have defined at the time you download the template.
To create a user data file from a template
1 In the Enforce Server administration console, go to System > Users > Data Sources.
2 On the Data Sources page, click Download CSV Template on the right-hand side of the
page.
3 Open the template file and provide the information for the standard user-data attributes.
See “About user data sources” on page 1423.
4 The template file includes column headers for any custom attributes you have defined.
To add custom attributes manually, create a new column for each attribute, then populate
the rows as appropriate.
You must enter the column headers in this format: ID[Attribute Name]. For example,
1[Employment Status].
See “Defining custom attributes for user data” on page 1424.
5 Save the file (in .csv format) to a location on your Enforce Server.
To add a file-based user data source
1 In the Enforce Server administration console, go to System > Users > Data Sources.
2 On the Data Source Management page, click Add > CSV User Source. The Add CSV
User Source dialog box appears.
3 In the Add CSV User Source dialog box, enter the following information:
 Working with user risk 1426
About user data sources

■ Name: Specify a name for the data source.

■ File Path: Specify the path to the user data file. This file must be on the Enforce Server.
■ Delimited by: Specify the delimiter for the file. Valid delimiters are comma, pipe,
semicolon, and tab.
■ Encoded by: Specify the character encoding format.
■ Error Threshold Percentage: Specify the percentage of user records that can be
invalid before the file is rejected and the import process fails. Records with duplicate
email addresses or logons count against the error threshold.

4 Click Submit.

Adding an Active Directory user data source

You can use an existing Active Directory connection to bring in user data. To add custom
attributes for users that are added from an Active Directory source, create and import a data
user file that includes the users' first and last names, email or logon information, and the custom
attributes you want to use. Symantec Data Loss Prevention automatically associates the
file-based user data with the existing user records brought in from your Active Directory source.
Symantec Data Loss Prevention uses this Active Directory filter to retrieve user data (line
breaks added for readability):

(&
(objectClass=user)
(objectCategory=person)
(sAMAccountType=805306368)
(!
(|
(&
(sAMAccountType=805306368)
(sAMAccountName=-*)
)
(&
(sAMAccountType=805306368)
(sAMAccountName=_*)
)
)
)
)

Your Active Directory credentials must have permission to access the following user attributes:

FIRST_NAME givenName
 Working with user risk 1427
About user data sources

LAST_NAME sn
EMAIL mail
LOGIN_NAME sAMAccountName
TELEPHONE telephoneNumber
TITLE title
COUNTRY co
DEPARTMENT department
EMPLOYEE_ID employeeId
STREET_ADDRESS streetAddress
LOCALITY_NAME l
POSTAL_CODE postalCode
STATE_OR_PROVINCE st
OBJECT_DISINGUISHED_NAME distinguishedName

Your Active Directory credentials must also have permission to access the RootDSE record.
Symantec Data Loss Prevention reads these attributes from RootDSE:

namingContexts
defaultNamingContext
rootDomainNamingContext
configurationNamingContext
schemaNamingContext
isGlobalCatalogReady
highestCommittedUSN

See “Configuring directory server connections” on page 141.

See “Defining custom attributes for user data” on page 1424.
See “Adding a file-based user data source” on page 1425.
To add an Active Directory user data source
1 In the Enforce Server administration console, go to System > Users > Data Sources.
2 On the Data Source Management page, click Add > AD User Source. The Add AD
User Source dialog box appears.
3 In the Add > AD User Source dialog box, enter the following information:
■ Name: Specify a name for the data source.
■ Directory Connection: Select an existing Active Directory connection.
■ Advanced Options > AD Custom Filter: Specify an optional filter for your Active
Directory user data source, such as a workgroup. For example:
 Working with user risk 1428
About user data sources

(&(region=North America)(!systemAccount=true))

4 Click Submit.

Note: A best practice is that you should refer to directory connection objects with baseDNs in
the user section of your directory tree. For example: ou=Users,dc=corp,dc=company,dc=com.

Importing a user data source

After you have added your user data sources, you can schedule Symantec Data Loss Prevention
to regularly import data from those data sources to ensure that your user data is always up to
date. You can also import a user data source manually.
Records with duplicate logons or email addresses are excluded from user data source imports.
The number of records excluded from the import displays at the end of the import process,
and the duplicate information appears in the logs.
To view details for a user data source import, click the Status link.
To schedule import of a user data source.
1 In the Enforce Server administration console, go to System > Users > Data Sources.
2 On the Data Source Management page, click the Schedule icon for your desired data
source.
3 Choose one of these options for scheduling:
■ Once: Specify a single day and time for user data import.
■ Daily: Specify a time for daily import of the user data source.
■ Weekly: Specify a day and time for weekly import of the user data source.
■ Monthly: Specify a day and time for monthly import of the user data source.

4 Click Submit.
To import a data source manually
1 In the Enforce Server administration console, go to System > Users > Data Sources.
2 On the Data Source Management page, select the data source you want to import.
3 Click Import.
 Working with user risk 1429
About identifying users in web incidents

To view data source import details

1 In the Enforce Server administration console, go to System > Users > Data Sources.
2 On the Data Source Management page, click the Status link for your desired data source.
The Import Details dialog box appears.
3 The Import Details dialog box displays the following information for all imports:
■ Name: The name of the imported data source.
■ Status: Done, Completed with Errors, Failed.
■ Queued at: The time that the data source import was entered in the import queue.
■ Started at: The start time of the data source import.
■ Completed at: The completion time of the data source import.
For successful imports and imports completed with errors, the Import Details dialog box
displays the following additional information:
■ Added records: The number of added user records.
■ Updated records: The number of updated user records.
■ Skipped errored records: The number of records skipped because of errors in the
user data source.
■ Skipped duplicate records: The number of records skipped because of duplicate
user data.
For failed imports, the Import Details dialog box displays the following additional
information:
■ Last successful import: The date and time of the last successful import of the user
data source.
■ Failure reason: The reason for the import failure.

About identifying users in web incidents

The IP address in a Network Prevent for Web incident can be used to determine the user name
associated with that incident. Using the domain controller agent, Symantec Data Loss Prevention
collects Windows Events from the Security event log on the Microsoft Active Directory domain
controller server. These events are stored in the Symantec Data Loss Prevention database,
where a look-up service can resolve the IP address to its associated user name. You don't
need to cross-check incidents with domain controller logs to determine the actual user
responsible for each incident. You can view specific user names associated with incidents
(rather than IP addresses) in the User Risk Summary report. See “Working with the user risk
summary” on page 1432.
 Working with user risk 1430
About identifying users in web incidents

User identification requires an Enforce Server, Network Prevent for Web, domain controller
servers, and an Active Directory domain controller. See the section "Installing the domain
controller Agent" in the Symantec Data Loss Prevention Installation Guide available at the
Symantec Support Center at http://www.symantec.com/doc/DOC9247 for complete instructions
on installing the domain controller Agent. After you install all of the required components, you
can enable User Identification by configuring a mapping schedule on the User Identification
page.

Note: Symantec Data Loss Prevention supports the use of multiple domain controllers.

Enabling user identification and configuring the mapping schedule

The domain controller agent queries Windows Events in the Microsoft Active Directory Security
Event Log of the domain controller. Symantec Data Loss Prevention associates these Windows
Events with user data in your database. The IPv4 address data from the domain controller
may not correspond precisely to a given user. If you have any doubt that the resolved username
is correct, verify that the user was logged in at the time of the incident before taking any incident
response actions.
The user identification lookup job on the Enforce Server checks the database for new events
from the domain controller every day at 4:00 A.M. by default.
Symantec Data Loss Prevention stores the user records received from the domain controller
agent in the Symantec Data Loss Prevention database. User records are purged every 3 days
by default.
To set the Mapping Schedule and enable User Identification
1 Click Configure from the System > Incident Data > User Identification page.
2 Click Once, Daily, Weekly, or Monthly to schedule a mapping job. The default is No
Regular Schedule. Scheduling must be configured to enable mapping.
3 Click Save when you are done.
To set up data retention parameters
1 Go to the System > Incident Data > User Identification > Configure page.
2 The default time for the system to keep user login events is 3 days. If you want to change
this value, enter another value in the User data retention field.
3 Click Save when you are done.
 Working with user risk 1431
Viewing the user list

To specify the domain controller warning schedule

1 Go to the System > Incident Data > User Identification > Configure page.
2 Specify the domain controller warning in days. This is the number of days since the last
connection of a domain controller. The default is 8 days.
3 Click Save when you are done.
If you want to discontinue use of User Identification, you need to stop the mapping job. If you
don't stop the mapping job, it continues to run, even if the domain controllers are in a suspended
state.
To stop scheduled mapping
1 Go to the System > Incident Data > User Identification > Configure page.
2 Check the box next to Stop mapping. Suspending mapping does not stop any jobs that
are in progress.
3 Click Save when you are done.

Checking the status of the domain controllers

After you have set a mapping schedule, you can go to the System > Incident Data > User
Identification page and check the status of your domain controllers. You can sort controllers
by
■ State: Active or Suspended
■ Domain controller name
■ Last connection time
■ Days since last connection
■ Warnings
■ Login timeout
You can suspend an domain controller by clicking the green Active button. You can activate
a suspended domain controller by clicking the red Suspended button.

Viewing the user list

The user list displays all users that you have entered in Symantec Data Loss Prevention. In
the user list, you can view the names, email addresses, and domain and logon information for
each user. You can sort the list first or last name, and you can search the list by name, email
address, domain, or logon. Clicking on an individual user's name takes you to the user detail
view.
 Working with user risk 1432
Viewing user details

See “Viewing user details” on page 1432.

The user list does not display incident data, only user data.
To view the user list
1 In the Enforce Server administration console, go to Incidents > Users > User List.
2 To sort the user list by first or last name, click one of the sort icons in the appropriate
column.
3 To search the user list, enter your search term in the search field at the upper-right corner
of the list. You can search on the user's first and last name, logon, and email address.
Only one search term is handled at a time.

Viewing user details

The user snapshot shows all user information and incidents for a specific user. You reach the
user detail view by clicking a user's name on the user list. You can also export the user snapshot
to a CSV file.
See “Viewing the user list” on page 1431.
To view user details
1 In the Enforce Server administration console, go to Incidents > Users > User List.
2 Click the name of the user for whom you want to view details.
3 On the User page, you can view a list of incidents, as well as user information, standard
attributes, and custom attributes. For users identified by IP address, there is also data
about the last activity time.
4 To export the user snapshot to a CSV file, click Export.

Working with the user risk summary

The user risk summary displays all users who have incidents associated with them. You can
sort and filter the user risk summary to gain insight into the user risk in your organization. For
example, you can view incidents that are associated with specific policies, or with custom
attributes that you have entered, such as job function or employment status. If you want to
return to a particular view of the user risk summary, you can save the URL and bookmark it
in your web browser. You can also export data from the user risk summary to a CSV file.
To view the user risk summary
1 In the Enforce Server administration console, go to Incidents > Users > User Risk
Summary.
2 To sort the list, click one of the sort icons in one of the columns.
 Working with user risk 1433
Working with the user risk summary

3 To filter the list, select your filter values using the options above the user risk summary
list:

Filter Default value Description

Policies All Select a policy or policies by expanding the policy group

and checking the appropriate box or boxes.

Attributes None (0) Enter up to two custom attributes to filter the list. Select the
attribute from the drop-down list, then specify an include
or exclude condition and enter your desired values. To add
a second attribute filter, click Add Attribute Filter.

Status All Filter the list by incident status.

Date Last 7 Days Filter the list by date or date range.

Type All Filter the list by incident type, such as Email/SMTP,

Printer/Fax, or HTTP.

Include All You can filter the list by incident severity. You must select
at least one severity level.

You can also include or exclude user names identified by

IP address.

4 After you have selected your filter values, click Apply.

5 To save a particular filter configuration, click Get Link and copy the provided URL to your
web browser bookmarks.
6 To export data from the user risk summary to a CSV file, click Export. You can export
the current page or all pages in the user risk summary.
 Chapter 52
Implementing lookup
plug-ins
This chapter includes the following topics:

■ About lookup plug-ins

■ Implementing and testing lookup plug-ins

■ Configuring the CSV Lookup Plug-In

■ Configuring LDAP Lookup Plug-Ins

■ Configuring Script Lookup Plug-Ins

■ Configuring migrated Custom (Legacy) Lookup Plug-Ins

About lookup plug-ins

A lookup plug-in lets you connect the Enforce Server to an external system to retrieve
supplemental data related to an incident. The data is stored as attributes. Lookup plug-ins let
you add additional context to incidents to facilitate remediation workflow. For example, consider
an email message that triggers an incident. A lookup plug-in can be used to retrieve and display
the name and the email address of the sender's manager from a directory server based on
the email sender's address.
Lookup plug-ins use incident attributes and custom attributes in coordination with each other.
The system generates incident attributes when a policy rule is violated. You define custom
attributes for custom incident data. Continuing the example, on detection of the incident, the
system generates the incident attribute "sender-email" and populates it with the email address
of the sender. The lookup plug-in uses this key-value pair to look up the values for custom
attributes "Manager Name" and "Manager Email" from an LDAP server. The plug-in populates
the custom attributes and displays them in the Incident Snapshot.
 Implementing lookup plug-ins 1435
About lookup plug-ins

See “About custom attributes” on page 1416.

See “About using custom attributes” on page 1417.
See “How custom attributes are populated” on page 1418.

Types of lookup plug-ins

Symantec Data Loss Prevention provides several types of lookup plug-ins, including CSV,
LDAP, Script, Data Insight, and Custom (Legacy). The following table describes each type of
lookup plug-in in more detail.
See “About lookup plug-ins” on page 1434.

Table 52-1 Types of lookup plug-ins

Type Description

CSV The CSV Lookup Plug-in lets you retrieve incident data from a comma-separated values (CSV)
file uploaded to the Enforce Server. You can configure one CSV Lookup Plug-in per Enforce Server
instance.

See “About the CSV Lookup Plug-In ” on page 1436.

LDAP The LDAP Lookup Plug-in lets you retrieve incident data from a directory server, such as Microsoft
Active Directory, Oracle Directory Server, or IBM Tivoli. You can configure multiple instances of
the LDAP Lookup Plug-in.

See “About LDAP Lookup Plug-Ins” on page 1436.

Script The Script Lookup Plug-in lets you write a script to retrieve incident data from any external resource.
For example, you can use a Script Lookup Plug-in to retrieve incident data from external resources
such as proxy log files or DNS systems. You can configure multiple instances of the Script Lookup
Plug-in.

See “About Script Lookup Plug-Ins” on page 1436.

Data Insight The Data Insight Lookup Plug-in lets you retrieve incident data from Symantec Data Insight so
that you can locate and manage data at risk. You can configure one Data Insight Lookup Plug-in
per Enforce Server instance.

Custom (Legacy) The Custom (Legacy) Lookup Plug-in lets you use Java code to retrieve incident data from any
external resource.

See “About Custom (Legacy) Lookup Plug-Ins” on page 1437.

Note: As the name indicates, the Custom (Legacy) Lookup Plug-in is reserved for legacy Java
plug-ins. For new custom plug-in development, you must use one of the other types of lookup
plug-ins.
 Implementing lookup plug-ins 1436
About lookup plug-ins

About the CSV Lookup Plug-In

The CSV Lookup Plug-In extracts data from a comma-separated values (CSV) file stored on
the Enforce Server. The plug-in uses data from the CSV file to populate custom attributes for
an incident at the time the incident is generated.
The CSV Lookup Plug-In receives a group of lookup parameters that contain data about an
incident from the Enforce Server. One or more of the lookup parameters in the group is mapped
to column heads in a CSV file. For example, the sender-email lookup parameter might be
mapped to the Email column in the CSV file. The value in the lookup parameter is used as a
key to find a matching value in the corresponding CSV column. When a match is found, the
CSV row that contains the matching value provides the data that is returned to the Enforce
Server. The Enforce Server uses the data in that row to populate the custom attributes for that
incident. For example, if the sender-email lookup parameter contains the value
mary.smith@mycompany.com, the plug-in searches the Email column for a row that contains
mary.smith@mycompany.com. That row is then used to provide the data to populate the custom
attributes for the incident.
The CSV Lookup Plug-In uses an in-memory database to process large files.
See “Configuring the CSV Lookup Plug-In” on page 1453.

About LDAP Lookup Plug-Ins

The LDAP Lookup Plug-In pulls data from a live LDAP system (such as Microsoft Active
Directory, Oracle Directory Server, or IBM Tivoli). It then uses that data to populate custom
attributes for an incident at the time the incident is generated.
The LDAP Lookup Plug-In receives a group of lookup parameters that contain data about an
incident from the Enforce Server. These lookup parameters are then used in LDAP queries to
pull data out of an existing LDAP directory. For example, the value of the sender-email lookup
parameter might be compared to the values in the email attribute of the directory. If the
sender-email lookup parameter contains mary.smith@mycompany.com, a query can be
constructed to search for a record whose email attribute contains mary.smith@mycompany.com.
Data in the record that the search returns is inserted into the custom attributes for the incident.
See “Configuring LDAP Lookup Plug-Ins” on page 1462.

About Script Lookup Plug-Ins

You can write one or more Script Lookup Plug-ins to query data repositories for attribute values.
For example, you can write a script that queries a DNS server for information about a sender
that is involved in an incident. A Script Lookup Plug-In can use the output from such scripts
to populate custom attributes in incident records.
 Implementing lookup plug-ins 1437
About lookup plug-ins

Unlike the CSV or LDAP Lookup Plug-ins, the Script Lookup Plug-In does not use in-line
attribute maps to specify how to look up parameter keys. Instead, you write this functionality
into each script as needed.
To implement a Script Lookup Plug-In , you can use any scripting language that reads standard
input (stdin) and writes standard output (stdout). The examples in the user interface and in
this documentation use Python version 2.6.
See “Configuring advanced plug-in properties” on page 1452.

About the Data Insight lookup plug-in

The Veritas Data Insight lookup plug-in retrieves data from a Veritas Data Insight Management
Server and uses it to populate attributes for a Network Discover incident at the time the incident
is generated. The Data Insight lookup plug-in connects Symantec Data Loss Prevention with
Symantec Data Insight to retrieve attribute values. Data Insight can be used to provide granular
context to incidents, including up-to-date data owner information. The values for incident
attributes are viewed and populated at the Incident Snapshot screen.
The Data Insight lookup plug-in requires a Data Insight license separate from Symantec Data
Loss Prevention licensing. If your system is not licensed for Data Insight, the Data Insight
lookup plug-in is not available. If you are licensed for Data Insight, refer to the Symantec Data
Loss Prevention Data Insight Implementation Guide for details on integrating with Data Insight.

About Custom (Legacy) Lookup Plug-Ins

You can use a Custom (Legacy) Lookup Plug-In to migrate legacy Custom Java Lookup
Plug-Ins to the Enforce Server administration console. Because Custom Java Lookup Plug-Ins
are no longer the preferred way to create new plug-ins, the information presented here is
provided to support organizations using legacy plug-ins but upgrading to Data Loss Prevention
version 12. As an alternative to migrating legacy Custom Java Lookup Plug-Ins, consider
rewriting such plug-ins using a Script Lookup Plug-In or one of the other supported lookup
plug-ins, such as CSV or LDAP.
See “Types of lookup plug-ins” on page 1435.

Note: Custom (Legacy) Lookup Plug-Ins should only be used for migrating legacy lookup
plug-ins implemented using the Java Lookup API. Support for new Custom Java Lookup
Plug-Ins are not supported.

See “Configuring migrated Custom (Legacy) Lookup Plug-Ins” on page 1478.

 Implementing lookup plug-ins 1438
About lookup plug-ins

About lookup parameters

When an incident is created, the Enforce Server generates incident attributes and populates
them with data it captures from the incident. You use one or more incident attributes as lookup
parameter keys to retrieve external data and populate custom attributes with values that have
been retrieved from the external system. You choose which lookup parameters to use for your
lookup plug-ins at the Lookup Parameters screen. At least one lookup parameter must be
present in the external data source for the lookup to be performed.
While some attributes are created for all incident types, others are specific to the incident type.
For example, the incident attribute sender-email is specific to SMTP incidents. Attributes
specific to Endpoint and Discover incidents are prefaced by an identifier, such as
discover-name and endpoint-machine-name. For administrative convenience, lookup
parameters are organized into groups. An incident exposes all of the lookup parameters in
each lookup parameter group that is enabled. On lookup, some of the name-value pairs in
that group may be valueless depending on the type of incident. For example, the attribute
value of the sender-email parameter is null for Discover incidents (sender-email=null).
Lookup plug-ins do not change the system-defined values of lookup parameters. The plug-in
only uses these parameters as keys to perform the lookup and populate custom attributes.
For example, if a lookup plug-in uses the subject lookup parameter, the value of this attribute
is not changed by a value for this attribute in the external data source; the Enforce Server
ignores the value after the lookup is made. There are two exceptions, however:
data-owner-name and data-owner-email. These system-defined incident attributes function
like custom attributes and their values are populated by retrieved values.
When you map the keys to your data source, the plug-in searches the keys in order until it
finds the first matching value. When a matching value is located, the plug-in stops searching
for the keys. The plug-in uses the data in the row that contains the first matching value to
populate the relevant custom attributes. Therefore, key values are not used in combination,
but rather the first value that is found is the key. Because the plug-in stops searching after it
finds the first matching value, the order in which you list the keys in your attribute mapping is
significant. Refer to the individual attribute mapping topics and examples for nuances among
the lookup plug-in attribute mapping syntax.
To perform a lookup, you must map at least one lookup parameter key to a field in your external
data source. Each lookup parameter group that you enable is a separate database query for
the Enforce Server to perform. All database queries are executed for each incident before
lookup. To avoid the performance impact of unnecessary database queries, you should only
enable attribute groups that your lookup plug-ins require.
Because the plug-in stops searching after it finds the first matching lookup parameter key-value
pair, the order in which you list the keys in your attribute map is significant. Refer to the attribute
mapping examples for the specific type of plug-in you are implementing.
See “Selecting lookup parameters” on page 1444.
 Implementing lookup plug-ins 1439
About lookup plug-ins

About plug-in deployment

A lookup plug-in is deployed by enabling it through the user interface. Each lookup plug-in
must be enabled, even if there is only one. If multiple plug-ins are enabled, you chain them
together and specify their order of execution.
The selected lookup parameter keys apply globally to all deployed lookup plug-ins. If plug-ins
are reloaded, all deployed plug-ins are reloaded.
You can only deploy one CSV Lookup Plug-in and one Data Insight Lookup Plug-in per Enforce
Server instance.
See “Enabling lookup plug-ins” on page 1449.

About plug-in chaining

When you create a lookup plug-in, you map the lookup parameter keys and custom attributes
to fields in the external data source. All deployed lookup plug-ins receive a reference to the
same attribute map. This allows plug-ins to be chained together and executed in sequence.
In a lookup plug-in chain, the first plug-in uses the lookup parameters that are passed to it by
the Enforce Server to look up attribute values. The second plug-in uses data that is passed to
it by the first plug-in including the lookup parameters and any variables created by the previous
lookup. This continues in sequence or all plug-ins in the chain.
A plug-in chain is useful when information must be pulled from different sources to populate
custom attributes for an incident. A chain is also useful when there are differences or
dependencies between the “keys” needed to unlock the correct data.
For example, consider the following plug-in chain:
1. A Script Lookup Plug-in performs a DNS lookup using one or more parameters.
2. A CSV Lookup Plug-in uses the result of the script look up to retrieve incident data from a
CSV file that is an extract from an asset management system.
3. An LDAP Lookup Plug-in uses the result of the CSV lookup to obtain data from a corporate
LDAP directory.
See “Chaining lookup plug-ins” on page 1449.
See “Chaining multiple Script Lookup Plug-Ins” on page 1474.

About upgrading lookup plug-ins

Prior to Symantec Data Loss Prevention version 11.6, lookup plug-ins were implemented
manually using property files; there was no user interface for configuring lookup plug-ins. The
lookup plug-in user interface was introduced in version 11.6.
 Implementing lookup plug-ins 1440
Implementing and testing lookup plug-ins

If you are upgrading to version 12.0 or later, existing lookup plug-ins are automatically upgraded
to the new framework and added to the user interface for configuration and deployment. In
addition, the plug-in state will be preserved after the upgrade, that is, if a plug-in was enabled
before the upgrade it should be turned on in the user interface after the upgrade.
If the upgrade of a lookup plug-in does not succeed, the system displays the following error
message:

INFO: IN PROCESS: Errors detected in lookup plugin configuration.

Your lookup plugins may require manual configuration after the upgrade.

In this case, check the plug-in at the System > Lookup Plugins screen and manually configure
it following the instructions provided with this documentation. Refer to the Symantec Data Loss
Prevention Release Notes for known issues related to the upgrade of lookup plug-ins.

Implementing and testing lookup plug-ins

The following table describes the workflow for implementing and testing lookup plug-ins. Linked
sections explain these steps in more detail.

Table 52-2 Implementing and testing lookup plug-ins

Step Description

1 Decide what external data you want to extract and load into incidents as custom attributes.

See “About using custom attributes” on page 1417.

2 Identify the sources from which custom attribute data is to be obtained and the appropriate
lookup plug-in for retrieving this information.

See “Types of lookup plug-ins” on page 1435.

3 Create a custom attribute for each individual piece of external data that you want to include in
incident snapshots and reports.

See “Configuring custom attributes” on page 1418.

4 Determine which lookup parameter groups include the specific lookup parameters you need
to extract the relevant data from the external sources.

See “About lookup parameters” on page 1438.

 Implementing lookup plug-ins 1441
Implementing and testing lookup plug-ins

Table 52-2 Implementing and testing lookup plug-ins (continued)

Step Description

5 Configure the plug-in to extract data from the external data source and populate the custom
attributes.

See “Configuring the CSV Lookup Plug-In” on page 1453.

See “Configuring LDAP Lookup Plug-Ins” on page 1462.

See “Configuring Script Lookup Plug-Ins” on page 1467.

See “Configuring migrated Custom (Legacy) Lookup Plug-Ins” on page 1478.

6 Enable the plug-in on the Enforce Server.

See “Enabling lookup plug-ins” on page 1449.

7 Set the execution order for multiple plug-ins.

See “Chaining lookup plug-ins” on page 1449.

8 Verify privileges. The end user must have Lookup Attribute privileges to use a lookup plug-in
to look up attribute values.

See “Configuring roles” on page 98.

9 Generate an incident. The incident must be of the type that exposes one or more incident
attributes that you have designated as parameter keys.

See “Configuring policies” on page 376.

10 View the incident details. For the incident you generated, go to the Incident Snapshot screen.
In the Attributes section, you should see the custom attributes you created. Note that they are
unpopulated (have no value). If you do not see the custom attributes, verify the privileges and
that the custom attributes were created.

11 If the lookup plug-in is properly implemented, you see the Lookup button available in the
Attributes section of the Incident Snapshot. Once you click Lookup you see that the value
for each custom attribute is populated. After the initial lookup, the connection is maintained and
subsequent incidents will have their custom attributes automatically populated by that lookup
plug-in; the remediator does not need to click Lookup for subsequent incidents. If necessary
you can reload the plug-ins.

See “Troubleshooting lookup plug-ins” on page 1450.

See “Reloading lookup plug-ins” on page 1450.

 Implementing lookup plug-ins 1442
Implementing and testing lookup plug-ins

Managing and configuring lookup plug-ins

The System > Incident Data > Lookup Plugins screen is the home page for creating,
configuring, and managing lookup plug-ins. Lookup plug-ins are used for remediation to retrieve
incident-related data from an external data source and populate incident attributes.
See “About lookup plug-ins” on page 1434.
You create and configure lookup plug-ins at the Lookup Plugins List Page.

Table 52-3 Creating and configuring lookup plug-ins

Action Description

New Plugin Select this option to create a new plug-in.

See “Creating new lookup plug-ins” on page 1443.

Modify Plugin Chain Select this option to enable (deploy) plug-ins and to set the order of lookup for multiple
plug-ins.

See “Enabling lookup plug-ins” on page 1449.

Lookup Parameters Select this option to choose which lookup parameter groups to use as keys to
populate attribute fields from external data sources.

See “Selecting lookup parameters” on page 1444.

Reload Plugins Select this option to refresh the system after making changes to enabled plug-ins
or if the external data is updated. This action automatically performs the enabled
lookups in order and populates the incidents as they are created.
See “Reloading lookup plug-ins” on page 1450.

For each configured lookup plug-in, the system displays the following information at the Lookup
Plugins List Page. You use this information to manage lookup plug-ins.

Table 52-4 Managing lookup plug-ins

Display field Description

Execution Sequence This field displays the order in which the system executes lookup plug-ins.

See “Enabling lookup plug-ins” on page 1449.

Name This field displays the user-defined name of each lookup plug-in.

Click the Name link to edit that plug-in.

See “Creating new lookup plug-ins” on page 1443.

 Implementing lookup plug-ins 1443
Implementing and testing lookup plug-ins

Table 52-4 Managing lookup plug-ins (continued)

Display field Description

Type The field displays the type of lookup plug-in. You can configure one CSV and one
Data Insight Lookup Plug-in per Enforce Server instance. You can configure multiple
instances of the LDAP, Script, and Custom (Legacy) lookup plug-ins.

See “Types of lookup plug-ins” on page 1435.

Description This field displays the user-defined description of each lookup plug-in.

See “Implementing and testing lookup plug-ins” on page 1440.

Status The field displays the state of each lookup plug-in, either On (green) or Off (red).
To edit the state of a plug-in, click Modify Plugin Chain.

See “Enabling lookup plug-ins” on page 1449.

For each configured lookup plug-in, you can perform the following management functions at
the Lookup Plugins List Page.

Table 52-5 Sorting and grouping lookup plug-ins

Action Description

Edit Click the pencil icon in the Actions column to edit the plug-in.

Delete Click the X icon in the Actions column to delete the plug-in. You must confirm or
cancel the action to execute it.

Sort Sort the selected display column in ascending or descending order.

Group Group the plug-ins according to the selected display column. For example, where
you have multiple plug-ins, it may be useful to group them by Type or by Status.

Creating new lookup plug-ins

You must have Server Administration privileges to create and configure lookup plug-ins.
See “Configuring roles” on page 98.
To create new lookup plug-in
1 Navigate to System > Incident Data > Lookup Plugins in the Enforce Server
administration console.
2 Click New Plugin at the Lookup Plugins List Page screen.
 Implementing lookup plug-ins 1444
Implementing and testing lookup plug-ins

3 Select the type of lookup plug-in you want to create and configure it.

CSV

See “Configuring the CSV Lookup Plug-In” on page 1453.

LDAP

See “Configuring LDAP Lookup Plug-Ins” on page 1462.

Script

See “Configuring Script Lookup Plug-Ins” on page 1467.

Data Insight

Custom (Legacy)

See “Configuring migrated Custom (Legacy) Lookup Plug-Ins” on page 1478.

4 Click Save to apply the lookup plug-in configuration.

The system displays a success (green) message if the plug-in was successfully saved or
an error (red) message if the plug-in is misconfigured and could not be saved.
See “Troubleshooting lookup plug-ins” on page 1450.
5 Click Modify Plugin Chain and enable the lookup plug-in and chain multiple plug-ins.
See “Enabling lookup plug-ins” on page 1449.
See “Chaining lookup plug-ins” on page 1449.

Selecting lookup parameters

The System > Lookup Plugins > Edit Lookup Plugin Parameters page lists the Lookup
Parameter Keys that you select to trigger the look up of attribute values. Lookup parameter
keys are organized into attribute groups. Selections made at this screen apply to all lookup
plug-ins deployed on the Enforce Server.
To perform a lookup, you must map at least one lookup parameter key to a field in your external
data source. Each lookup parameter group that you enable is a separate database query for
the Enforce Server to perform. All database queries are executed for each incident before
lookup. To avoid the performance impact of unnecessary database queries, you should only
enable attribute groups that your lookup plug-ins require.
Because the plug-in stops searching after it finds the first matching lookup parameter key-value
pair, the order in which you list the keys in your attribute map is significant. Refer to the attribute
mapping examples for the specific type of plug-in you are implementing for details.
See “About lookup parameters” on page 1438.
 Implementing lookup plug-ins 1445
Implementing and testing lookup plug-ins

To enable one or more lookup parameter keys

1 Navigate to System > Lookup Plugins in the Enforce Server administration console.
2 Click Lookup Parameters at the Lookup Plugins List Page.
3 Select (check) one or more attribute groups at the Edit Lookup Plugin Parameters page.
Click View Properties to view all of the keys for that attribute group.
■ Attachment Table 52-6
■ Incident Table 52-7
■ Message Table 52-8
■ Policy Table 52-9
■ Recipient Table 52-10
■ Sender Table 52-11
■ Server Table 52-12
■ Monitor Table 52-13
■ Status Table 52-14
■ ACL Table 52-15

4 Save the configuration.

Verify the success message indicating that all enabled plug-ins were reloaded.

Table 52-6 Attachment lookup parameters

Lookup parameter key Description and comments

attachment-nameX Name of the attached file, where X is the unique index to distinguish between
multiple attachments, for example: attachment-name1, attachment-size1;
attachment-name2, attachment-size2; etc.

attachment-sizeX Original size of the attached file, where X is the unique index to distinguish
between multiple attachments. See above example.

Table 52-7 Incident lookup parameters

Lookup parameter key Description

date-detected Date and time when the incident was detected, for example:
date-detected=Tue May 15 15:08:23 PDT 2012.

incident-id The incident ID assigned by Enforce Server. The same ID can be seen in the
incident report. For example: incident-id=35.
 Implementing lookup plug-ins 1446
Implementing and testing lookup plug-ins

Table 52-7 Incident lookup parameters (continued)

Lookup parameter key Description

protocol The name of the network protocol that was used to transfer the violating message,
such as SMTP and HTTP. For example: protocol=Email/SMTP.

data-owner-name The person responsible for remediating the incident. This attribute is not populated
by the system. Instead, it is set manually in the Incident Details section of the
Incident Snapshot screen, or automatically using a lookup plug-in.

Reports based on this attribute can automatically be sent to the data owner for
remediation.

data-owner-email The email address of the person responsible for remediating the incident. This
attribute is not populated by the system. Instead, it is set manually in the Incident
Details section of the Incident Snapshot screen, or automatically using a lookup
plug-in.

Table 52-8 Message lookup parameters

Lookup parameter key Description

date-sent Date and time when the message was sent if it is an email. For example:
date-sent=Mon Aug 15 11:46:55 PDT 2011.

subject Subject of the message if it is an email incident.

file-create-date Date that the file was created in its current location, whether it was originally
created there, or copied from another location. Retrieved from the operating
system.

file-access-date Date that the file was examined.

file-created-by User who placed the file on the endpoint.

file-modified-by Fully-qualified user credential for the computer where the violating copy action
took place.

file-owner The name of the user or the computer where the violating file is located.

discover-content-root-path Root of path of the file which caused a Discover incident.

discover-location Full path of the file that caused a Discover incident.

discover-name The name of the violating file.

discover-extraction-date Date a subfile was extracted from an encapsulated file during Discover scanning.

discover-server The name of repository to be scanned.

 Implementing lookup plug-ins 1447
Implementing and testing lookup plug-ins

Table 52-8 Message lookup parameters (continued)

Lookup parameter key Description

discover-notes-database Specific attribute for Discover scan of Lotus Notes repository.

discover-notes-url Specific attribute for Discover scan of Lotus Notes repository.

endpoint-volume-name The name of the local drive where an endpoint incident occurred.

endpoint-dos-volume-name The Windows name of the local drive where an endpoint incident occurred.

endpoint-application-name Name of application most recently used to open (or create) the violating file.

endpoint-application-path Path of the application that was used to create or open the violating file.

endpoint-file-name The name of the violating file.

endpoint-file-path Location the file was copied to.

Table 52-9 Policy lookup parameter

Lookup parameter key Description and comments

policy-name The name of the policy that was violated, for example: policy-name=Keyword
Policy.

Table 52-10 Recipient lookup parameters

Lookup parameter key Description

recipient-emailX The email address of the recipient, where X is the unique index to distinguish
between multiple recipients; for example: recipient-email1,
recipient-ip1, recipient-url1; recipient-email2, recipient-ip2,
recipient-url2; etc.

recipient-ipX The IP address of the recipient, where X is the unique index to distinguish
between multiple recipients. See above example.

recipient-urlX The URL of the recipient, where X is the unique index to distinguish between
multiple recipients. See above example.

Table 52-11 Sender lookup parameters

Lookup parameter key Description

sender-email The email address of the sender for Network Prevent for Email (SMTP) incidents.

sender-ip The IP address of the sender for Endpoint and Network incidents on protocols
other than SMTP.
 Implementing lookup plug-ins 1448
Implementing and testing lookup plug-ins

Table 52-11 Sender lookup parameters (continued)

Lookup parameter key Description

sender-port The port of the sender for Network incidents on protocols other than SMTP.

endpoint-user-name The user who was logged on to the endpoint when the violation occurred.

endpoint-machine-name Name of the endpoint where the violating file resides.

Table 52-12 Server lookup parameters

Lookup parameter key Description and comments

server-name The name of the detection server that reported the incident. This name is
user-defined and entered when the detection server is deployed. For example:
server-name=My Network Monitor.

Table 52-13 Monitor lookup parameters

Lookup parameter key Description

monitor-name The name of the detection server that reported the incident. This name is
user-defined and entered when the detection server is deployed. For example:
server-name=My Network Monitor.

monitor-host The IP address of the detection server that reported the incident. For example:
monitor-host=127.0.0.1

monitor-id The system-defined numeric identifier of the detection server. For example:
monitor-id=1.

Table 52-14 Status lookup parameter

Lookup parameter key Description and comments

incident-status Current status of the incident. For example:

incident-status=incident.status.New.

Table 52-15 ACL lookup parameters

Lookup parameter key Description

acl-principalX A string that indicates the user or group to whom the ACL applies.

acl-typeX A string that indicates whether the ACL applies to the file or to the share.

acl-grant-or-denyX A string that indicates whether the ACL grants or denies the permission.
 Implementing lookup plug-ins 1449
Implementing and testing lookup plug-ins

Table 52-15 ACL lookup parameters (continued)

Lookup parameter key Description

acl-permissionX A string that indicates whether the ACL denotes read or write access.

Enabling lookup plug-ins

To enable a lookup plug-in you have to change its status from Off, which is the initial status
of a plug-in after it is configured, to On. The System > Incident Data > Lookup Plugins >
Modify Plugin Chain is where you enable lookup plug-ins.
See “About plug-in deployment” on page 1439.
To enable a lookup plug-in
1 Navigate to System > Incident Data > Lookup Plugins in the Enforce Server
administration console.
2 Click Modify Plugin Chain at the Lookup Plugins List Page.
3 In the Dedicated Actions field, select (check) the On option.
4 Click Save to apply the configuration.
If the plug-in cannot be loaded the system will report an error and the plug-in state will
remain Off. In this case, check the latest Tomcat log file for the error.
See “Troubleshooting lookup plug-ins” on page 1450.

Chaining lookup plug-ins

The System > Incident Data > Lookup Plugins > Modify Lookup Plugin Execution Chain
is where you enable lookup plug-ins and specify the execution order when multiple lookup
plug-ins are deployed.
See “Enabling lookup plug-ins” on page 1449.
If you enable multiple lookup plug-ins you must specify their order of execution. When plug-ins
are chained together, input from a previous plug-in is used as attributes by subsequent lookup
plug-ins.
See “About plug-in deployment” on page 1439.
To chain multiple lookup plug-ins
1 Navigate to System > Incident Data > Lookup Plugins in the Enforce Server
administration console.
2 Click Modify Plugin Chain at the Lookup Plugins List Page.
 Implementing lookup plug-ins 1450
Implementing and testing lookup plug-ins

3 In the Execution Sequence field, select the execution order from the drop-down menu.
4 Click Save to apply the chaining configuration.

Reloading lookup plug-ins

If you have changed the configuration of a lookup plug-in, or the external data has changed,
you need to reload the lookup plug-ins. Reloading plug-ins refreshes the system and
automatically performs the enabled lookups in order and populates the incident attributes as
incidents are detected.
In addition to reloading plug-ins if changes are made, you may need to reload lookup plug-ins
if any of the following are true:
■ A plug-in was problematic and the system unloaded it, but now the problem is fixed.
■ The network was down or disconnected for some reason, but it is functioning properly now.
■ A plug-in stores data in a cache, and you want to update the cache manually.
To reload lookup plug-ins
1 Navigate to System > Incident Data > Lookup Plugins in the Enforce Server
administration console.
2 Click Reload Plugins to reload all enabled plug-ins.

Note: Administrators can also reload lookup plug-ins from the Custom Attributes tab of
the System > Incident Data > Attributes screen.

Troubleshooting lookup plug-ins

Symantec Data Loss Prevention provides logging and error messages specific to lookup
plug-ins. The most common errors involve the failure of a plug-in to load due to one or more
misconfigurations. If a lookup plug-in fails to load, the exception is logged as a warning at the
system events screen and in the Tomcat log. In addition, the attribute map and plug-in execution
chain is logged in the Tomcat log.
To troubleshoot lookup plug-in errors
1 Navigate to the System > Servers and Detectors > Overview screen and look for any
warnings in the Recent Error and Warning Events table at the bottom of the page.
2 On the Enforce Server host, open the log file
\SymantecDLP\protect\Enforce\logs\tomcat\localhost.<date>.log.

3 Troubleshoot errors that appear in the Tomcat localhost log file.

Table 52-16
 Implementing lookup plug-ins 1451
Implementing and testing lookup plug-ins

4 Configure detailed logging for lookup plug-ins if the plug-in fails but errors are not logged.
See “Configuring detailed logging for lookup plug-ins” on page 1451.
5 Refer to the troubleshooting topics for specific plug-ins.
See “Testing and troubleshooting the CSV Lookup Plug-In ” on page 1459.
See “Testing and troubleshooting LDAP Lookup Plug-ins” on page 1465.
See “Script Lookup Plug-In tutorial” on page 1474.

Table 52-16 Troubleshooting lookup plug-ins

Problem Solution

Lookup plug-in fails to load If the plug-in failed to load, search for a message in the log file similar to the following:

SEVERE
[com.vontu.enforce.workflow.attributes.AttributeLookupLoader]
Error loading plugin [<Plugin_Name>]

Note the "Cause" section that follows this type of error message. Any such entries
will explain why the plug-in failed to load.

Attributes are not populated by If the plug-in loads but attributes are not populated, look in the log for the attribute
the lookup map. Verify that values are being populated, including for the lookup parameters that
you enabled. To do this, search for a lookup parameter key that you have enabled,
such as sender-email.

Configuring detailed logging for lookup plug-ins

The system provides detailed logging configuration for lookup plug-ins. You can configure the
logging levels for lookup plug-ins in the System > Logs > Configuration tab. Configuring the
logs for lookup plug-ins provides more detailed log messages in the Tomcat localhost log.
See “Troubleshooting lookup plug-ins” on page 1450.
To configure and collect the logs for lookup plug-ins
1 Navigate to the System > Servers and Detectors > Logs screen.
2 Select the Configuration tab.
3 For the Enforce Server, select the Custom Attribute Lookup Logging entry from the
Diagnostic Logging Setting drop-down menu.
4 Click Configure Logs.
5 In the Collection tab, select the following Debug and Trace Logs for the Enforce Server.
6 Click Collect Logs.
 Implementing lookup plug-ins 1452
Implementing and testing lookup plug-ins

7 At the bottom of the page, click Download to download the logs. Use the Refresh button
to refresh the page. The logs are packaged in a ZIP file.
8 Open the ZIP file or save it to the file system and extract it.
9 Navigate to directory \SymantecDLPLogs.zip\Enforce\logs\tomcat.
10 Open the file localhost.<date>.log using a text editor. Open the file with the most
recent date.
11 Search for the name of the lookup plug-in. You should see several messages.
12 If necessary, verify the lookup plug-in logging properties in file
\Protect\config\ManagerLogging.properties.

com.vontu.logging.ServletLogHandler.level=FINEST
com.vontu.enforce.workflow.attributes.CustomAttributeLookup.level=FINEST
com.vontu.lookup.level=FINEST

Configuring advanced plug-in properties

The file SymantecDLP\protect\config\Plugins.properties contains several advanced
properties for configuring lookup plug-ins. Generally these properties do not need to be modified
unless necessary according to the following descriptions.

Table 52-17 Advanced properties for lookup plug-ins

Property Default Description

AttributeLookup. data-owner-name, The Attribute Lookup Output Parameters property is a

data-owner-email comma-separated list that specifies which parameters can be
output.parameters
modified by lookup plug-ins. Generally, the values for lookup
parameter keys are set by the system when an incident is created.
Because these parameters are used to look up custom attribute
values, they are not modified by the looked up values if they are
different from the system-defined values

However, this property lets you modify the output of the Data
Owner Name and Data Owner Email attributes based on
retrieved values. These parameters are specified in lookup plug-in
configurations and scripts using the same syntax as custom
attributes. Both attributes are enabled by selecting the Incident
attribute group.

You can disable this feature by removing one or both of the

entries. If removed, the output for either parameter is not changed
by a looked up value.
 Implementing lookup plug-ins 1453
Configuring the CSV Lookup Plug-In

Table 52-17 Advanced properties for lookup plug-ins (continued)

Property Default Description

AttributeLookup.timeout 60000 To avoid a system freeze due to unanticipated lookup problems,

the Enforce Server limits the amount of time given to each lookup
plug-in. This timeout is configured in the
com.vontu.api.incident.attributes.AttributeLookup.timeout
property in the Plug-ins.properties file.

If a lookup exceeds the 60-second default timeout, the incident

attribute framework unloads the associated plug-in. If there is a
runaway lookup the Enforce Server cannot execute that particular
lookup for any subsequent incidents. If the plug-in times out
frequently, you can extend the timeout by modifying the period
(in milliseconds).
Note: Note that increasing this value may result in slower incident
processing times because of slow attribute lookups.

AttributeLookup.auto true The automatic lookup property specifies whether the lookup
should be triggered automatically when a new incident is detected.
This property automatically populates incident attributes using
the deployed lookup plug-ins after the initial lookup is executed.

You can disable auto-lookup by changing the property value to

false. If this property is disabled, remediators must click Lookup
for every incident.

After setting the AttributeLookup.auto property to false,

make sure you restart the Vontu Incident Persister service. If you
do not restart the service the custom attributes will continue to
be automatically populated.

AttributeLookup.reload false The automatic plug-in reload property specifies whether all
plug-ins should be automatically reloaded each day at 3:00 A.M.
Change to true to enable.

Configuring the CSV Lookup Plug-In

You can only configure one CSV Lookup Plug-In per Enforce Server instance.
See “About the CSV Lookup Plug-In ” on page 1436.
 Implementing lookup plug-ins 1454
Configuring the CSV Lookup Plug-In

Table 52-18 Configuring the CSV Lookup Plug-In

Step Action Description

1 Create custom attributes. Define the custom attributes for the information you want to look up.
See “Setting the values of custom attributes manually” on page 1420.

2 Create the CSV data source file. The CSV file that contains the data to be used to populate custom
attributes for incident remediation.

See “Requirements for creating the CSV file” on page 1455.

3 Create a new CSV plug-in. See “Creating new lookup plug-ins” on page 1443.

4 Name and describe the plug-in. The name string limited to 100 characters. It is recommended that you
enter a description for the lookup plug-in.

5 Specify the file path. Provide the path to the CSV file. The CSV file must be local to the Enforce
Server.

See “Specifying the CSV file path” on page 1456.

6 Choose the File Delimiter. Specify the delimiter that is used in the CSV file. The pipe delimiter [|] is
recommended.

See “Choosing the CSV file delimiter” on page 1456.

7 Choose the File Encoding. For example: UTF-8

See “Selecting the CSV file character set” on page 1456.

8 Map the attributes. Map the system and the custom attributes to the CSV file column heads
and define the keys to use to extract custom attribute data. Keys map to
column heads, not custom attributes.

The syntax is as follows:

attr.attribute_name=column_head

keys=column_head_first:column_head_next:column_head_3rd

See “Mapping attributes and parameter keys to CSV fields” on page 1457.

9 Save the plug-in. Verify that the correct save message for the plug-in is displayed.

9 Select the Lookup Parameter Define the keys which are used to extract custom attribute data.
Keys.
See “Selecting lookup parameters” on page 1444.

10 Enable the lookup plug-in. The CSV Lookup Plug-In must be enabled on the Enforce Server.

See “Enabling lookup plug-ins” on page 1449.

11 Troubleshoot the plug-in. See “Testing and troubleshooting the CSV Lookup Plug-In ” on page 1459.
 Implementing lookup plug-ins 1455
Configuring the CSV Lookup Plug-In

Table 52-18 Configuring the CSV Lookup Plug-In (continued)

Step Action Description

11 Test the lookup plug-in.

Requirements for creating the CSV file

The CSV Lookup Plug-In requires a CSV file that is stored on the Enforce Server.
When creating a CSV file, keep in mind the following requirements:
■ The first data row of the CSV file must contain column headers.
■ Column header fields cannot be blank.
■ Make sure that there are no white spaces at the end of the column header fields.
■ Make sure that all rows have the same number of columns.
■ Each row of the file must be on a single, non-breaking line.
■ One or more columns in the file are used as key-fields for data lookups. You specify in the
attribute mapping which column heads are to be used as key fields. You also specify the
key field search order. Common key fields typically include email address,
Domain\UserName (for Endpoint incidents), and user name (for Storage incidents).
■ The data values in the key field columns must be unique. If multiple columns are used as
key fields (for example, EMP_EMAIL and USER_NAME), the combination of values in each row
must be unique.
■ Fields in data rows (other than the column header row) can be empty, but at least one key
field in each row should contain data.
■ The same type of delimiter must be used for all values in the column header and data rows.
■ If the CSV file is read-only, make sure that the CSV file has a new line at the end of the
file. The system will attempt to add a new line to the file on execution of the plug-in, but if
the file is read-only the system cannot do this and the plug-in will not load.
■ For Discover scan incidents, the file-owner lookup parameter does not include a domain.
To use file-owner as the key, the CSV file column that corresponds to file-owner should
be in the format owner. The format DOMAIN\owner does not result in a successful lookup.
This restriction only applies to Discover incidents, other kinds of incidents can include a
domain.
For example, the column-header row and a data-row of a pipe-delimited CSV file might
look like:

email|first_name|last_name|domain_user_name|user_name|department|manager|manager_email
jsmith@acme.com|John|Smith|CORP\jsmith1|jsmith1|Accounting|Mei Wong|mwong@acme.com
 Implementing lookup plug-ins 1456
Configuring the CSV Lookup Plug-In

■ If more than 10% of the rows in the CSV file violate any of these requirements, the Plugin
does not load.
■ For accuracy in the lookup, the CSV file needs to be kept up to date.
See “About the CSV Lookup Plug-In ” on page 1436.

Specifying the CSV file path

To configure the CSV Lookup Plug-In you must specify the CSV File Path property for the
location of the CSV file. The CSV file must be stored locally on the Enforce Server.
You can enter either an absolute file path or a relative file path. For example:
■ ../../../../symantecDLP_csv_lookup_file/senders2.csv

■ C:/SymantecDLP_csv_lookup_file/senders2.csv

On Windows you can use either forward or backward slashes. For example:
C:/SymantecDLP/Protect/plugins/employees.csv or
C:\SymantecDLP\Protect\plugins\employees.csv. On Linux you can only use forward
slashes.
The system validates the file path when you save the configuration. If the system cannot locate
the file it reports and error and does not let you save the configuration. Make sure that the
CSV file is not open and is stored locally to the Enforce Server.

Choosing the CSV file delimiter

Use the Delimiter property to specify the CSV file delimiter.
The following delimiters are supported:
■ Comma
■ Pipe
■ Tab
■ Semicolon
The recommended practice is to use the pipe character (“|”) as the delimiter. Use of the comma
delimiter is discouraged because commas are often included in data fields as part of the data.
For example, a street address might contain a comma.

Selecting the CSV file character set

You must specify the character set for the CSV file. The default is UTF-8.
All supported character sets are listed in the drop-down menu.
 Implementing lookup plug-ins 1457
Configuring the CSV Lookup Plug-In

Mapping attributes and parameter keys to CSV fields

To configure the CSV Lookup Plug-In , you enter the execution code in the Attribute Mapping
field. This code maps the lookup parameter keys and custom attributes to column headers in
the CSV file. One or more attribute=column pairs is used to map the incident attributes to the
column heads. The keys property in the attribute map identifies which columns to use for the
lookup.
Here is an example CSV file attribute mapping:

attr.Store-ID=store-id
attr.Store\ Address=store_address
attr.incident-id=incident-id-key
attr.sender-email=sender-email-key
keys=sender-email-key:incident-id-key

With this example in mind, adhere to the following syntactical rules when mapping the attributes
to CSV file data.

Table 52-19 Attribute mapping syntax for CSV files

Example and syntax Description

Attributes map to column header names in

attr.Store-ID=store-id attribute-column pairs.

attr.attribute_name=column_head Here, Store-ID is a custom attribute and store-id

is a column header name in the CSV file.

Spaces are allowed before and after the = sign

attr.Store\ Address=store_address (except for the LDAP Lookup Plugin).

attr.attribute\ name=column\ head Blank spaces in attribute and column names must
be preceded by a backslash.

Here, the custom attribute is named Store

Address.

Each attribute-column pair is entered on a

attr.Store-ID=store-id separate line.
attr.Store\ Address=store_address

attr.attribute_name=column_head

attr.attribute_name=column_head
 Implementing lookup plug-ins 1458
Configuring the CSV Lookup Plug-In

Table 52-19 Attribute mapping syntax for CSV files (continued)

Example and syntax Description

All syntax is case sensitive.

attr.Store\ Address=STORE_ADDRESS
The identifier attr. must be lower case.

Incident attributes must match the

system-definition string precisely.

System attributes are mapped to column header

attr.incident-id=incident-id-key names. The column name does not have to match
attr.sender-email=sender-email-key the system attribute, nor does it require the word
"key".
attr.attribute_name=column_head

Keys map the column name headers to the

keys=sender-email-key:incident-id-key
keys=<column_name_1st>:column_name_2nd
incident attribute keys you want to use to look up
the attribute values. The keys map to the column
header names, not to the incident attribute names.
The order of appearance determines priority.
Once the first incident is located in the CSV file,
the other attributes are populated.

CSV attribute mapping example

Consider another mapping example for the CSV Lookup Plug-In .

attr.sender-email = Email
attr.endpoint-user-name = Username
attr.file-owner = File-owner
attr.sender-ip = IP

attr.First\ Name = FIRST_NAME

attr.Last\ Name = LAST_NAME
attr.Business\ Unit = Org
attr.Manager\ Email = Mgr_email
attr.Employee\ ID = EMPLOYEE_NUMBER
attr.Phone\ Number = Phone
attr.Manager\ Last\ Name = Mgr_lastname
attr.Manager\ First\ Name = Mgr_firstname
attr.Employee\ Email = Emp_email

keys = Email:Username:File-owner:IP

Note the following about this example:

 Implementing lookup plug-ins 1459
Configuring the CSV Lookup Plug-In

■ The first four lines map lookup parameters to column headers.

■ The remaining nine lines map custom attributes to column headers.
■ A backslash is prepended before each instance of a white-space character in a attribute
or column name. In this example, attr.Employee\ Email = Emp_email maps the
Employee Email custom attribute to the emp_email column head.
■ The keys property identifies and sequences the keys that are used to extract custom
attribute data. Each key is separated with a colon. The order in which you list the keys
determines the search sequence. In this example (keys =
Email:Username:File-owner:IP), the plug-in first searches the Email column for a value
that matches the lookup parameter value of the sender-email which has been passed to
the plug-in. If no matching value is found, the plug-in then searches the Username column
for a value that matches the endpoint-user-name lookup parameter. If no matching value
is found in that column, it then goes on to search the next key (File-owner), and so on.
■ The plug-in stops searching after it finds the first matching parameter key-value pair. As a
result, the order in which you list the keys column heads is significant.

Testing and troubleshooting the CSV Lookup Plug-In

If the plug-in does not load, or if the plug-in loads but fails to populate the custom attributes
with looked up values, troubleshoot as follows:
To test and troubleshoot the CSV Lookup Plug-In
1 Verify that the CSV file conforms to the requirements. If more than 10% of the rows in the
CSV file violate any of the CSV file requirements, the lookup plug-in does not load.
See “Requirements for creating the CSV file” on page 1455.
2 Verify that the delimiter you selected is the one used in the CSV file. Note that the system
defaults to comma, whereas the recommendation is pipe.
See “Choosing the CSV file delimiter” on page 1456.
3 Check the attribute mapping. There is no system-provided validation for the attribute map.
Make sure that your attribute map adheres to the syntax.
Common syntactical errors include:
■ Every entry in the attribute mapping field is case sensitive.
■ Spaces in attribute and column names must be identified by a backslash.
■ For every attribute=column pair, the data to the right of the equals sign (=) must be a
column head name.
■ Keys are column header names, not incident attributes.
 Implementing lookup plug-ins 1460
Configuring the CSV Lookup Plug-In

4 If the plug-in fails to load, or the plug-in fails to return looked up values, check the file
\SymantecDLP\Protect\logs\tomcat\localhost.<latest-date>.log.

■ Check that the database and table are created and that the CSV file is loaded into the
table. To verify, look for lines similar to the following:

INFO [com.vontu.lookup.csv.CsvLookup]
creating database
create table using SQL
importing data from file into table LOOKUP having columns

Note: To process large files, the CSV Lookup Plug-In uses an in-memory database
(Apache Derby). Only one instance of Derby can be running per Enforce Server. If a
previous instance is running, the CSV Lookup Plug-In does not load. If the database
and table are not created, restart the Vontu Manager service and reload the plug-in.

5 If the plug-in fails to return looked up values, check the file

\SymantecDLP\Protect\logs\tomcat\localhost.<latest-date>.log.

Look for a warning message indicating that "SQL query did not return any results." In this
case, make sure that the attribute mapping matches the CSV column heads and reload
the plug-in if changes were made.
See “Troubleshooting lookup plug-ins” on page 1450.

CSV Lookup Plug-In tutorial

This tutorial provides instructions for implementing a simple CSV Lookup Plug-In . The purpose
of this tutorial is to introduce you to the lookup plug-in feature from a hands-on approach. If
you have experience generating incidents, creating custom attributes, and implementing lookup
plug-ins this tutorial may be too basic.
See “About the CSV Lookup Plug-In ” on page 1436.
To implement a simple CSV Lookup Plug-In
1 Create the following custom attributes at System > Attributes > Custom Attributes:
■ Manager
■ Deparment
 Implementing lookup plug-ins 1461
Configuring the CSV Lookup Plug-In

■ Email Address

2 Create a pipe delimited CSV file containing the following data.

SENDER|MGR|DEPT|EMAIL
emp@company.com|Merle Manager|Engineering|rmanager@company.com

3 Save the CSV file to the same volume drive where the Enforce Server is installed.
For example: C:\SymantecDLP\Protect\plugins\lookup\csv_lookup_file.csv.
4 Create a basic keyword policy.
See “Configuring policies” on page 376.
5 Generate an email incident.
To trigger the lookup for this example, the incident should be an SMTP incident with the
sender of the email being the address emp@company.com. Change the value of sender in
the CSV to match the actual value of the email sender.
6 Create a new CSV Lookup Plug-In at System > Incident Data > Lookup Plugins > New
Plugin.
7 Configure the lookup plug-in as follows:
■ Name: CSV Lookp Plug-in
■ Description: Look up manager of email sender from CSV file.
■ CSV File Path: C:\SymantecDLP\Protect\plugins\lookup\csv_lookup_file.csv
■ Delimiter: Pipe [|]
■ File Encoding: UTF-8
■ Attribute Mapping
Map the system-defined attributes, custom attributes, and lookup parameter keys on
separate lines as follows:

attr.sender-email=SENDER
attr.Manager=MGR
attr.Department=DEPT
attr.Email\ Address=EMAIL
keys=SENDER

attr.sender-email = SENDER This is a lookup parameter key from the Sender group. It is mapped to
the corresponding column header in the CSV file.
 Implementing lookup plug-ins 1462
Configuring LDAP Lookup Plug-Ins

attr.Manager = MGR This is a custom attribute defined in Step 1. It is mapped to the

corresponding column header in the CSV file.

attr.Department = DEPT This is a custom attribute defined in Step 1. It is mapped to the

corresponding column header in the CSV file.

attr.Email\ Address = EMAIL This is a space delimited custom attribute defines in Step 1. It is mapped
to the corresponding column head in the CSV file.

keys = SENDER This line declares one key to perform the lookup. The lookup ceases
once the first key is located, and the attribute values are populated.

8 Save the plug-in configuration.

9 Select System > Lookup Plugins > Lookup Parameters and select the following lookup
parameter key group:

Sender This group contains the sender-email key.

10 Select System > Lookup Plugins > Modify Plugin Chain and enable the plug-in.
11 Open the Incident Snapshot for the incident generated in the Step 4.
12 Verify that the unpopulated custom attributes you created in Step 1 appear in the Attributes
pane to the right of the screen.
If they do not, complete Step 1.
13 Verify that the "Lookup" button appears in the Attributes pane above the custom attributes.
If it does not, verify that the Lookup Attributes privilege is granted to the user.
Click Reload Plugin after making any changes.
14 Click the Lookup button.
The custom attributes should be populated with values looked up and retrieved from the
CSV file.
15 Troubleshoot the plug-in as necessary.
See “Testing and troubleshooting the CSV Lookup Plug-In ” on page 1459.

Configuring LDAP Lookup Plug-Ins

To configure one or more LDAP Lookup Plug-ins, complete these tasks.
 Implementing lookup plug-ins 1463
Configuring LDAP Lookup Plug-Ins

Table 52-20 Configuring LDAP Lookup Plug-ins

Step Action Description

1 Create custom attributes. See “Configuring custom attributes” on page 1418.

2 Configure a connection to A functioning connection to an LDAP server must be available.

the LDAP server.
See “Requirements for LDAP server connections” on page 1463.

The connection to the LDAP server can be configured from the link in the LDAP
Lookup Plug-In .

See “Configuring directory server connections” on page 141.

3 Create a new LDAP See “Creating new lookup plug-ins” on page 1443.
Lookup Plug-In .

4 Map the attributes. Map the attributes to the corresponding LDAP directory fields. The syntax is
as follows:

attr.CustomAttributeName = search_base:
(search_filter=$variable$):
ldapAttribute

See “Mapping attributes to LDAP data” on page 1464.

See “Attribute mapping examples for LDAP” on page 1465.

5 Save and enable the The LDAP Lookup Plug-In must be enabled on the Enforce Server.
plug-in.
See “Enabling lookup plug-ins” on page 1449.

6 Test and troubleshoot the See “Troubleshooting lookup plug-ins” on page 1450.
LDAP Lookup Plug-In .

Requirements for LDAP server connections

The following conditions must be met for Symantec Data Loss Prevention to establish a
connection with an LDAP directory:
■ The LDAP directory must be running on a host that is accessible to the Enforce Server.
■ There must be an LDAP account that the Symantec Data Loss Prevention can use. This
account must have read-only access. You must know the user name and password of the
account.
■ You must know the Fully Qualified Domain Name (FQN) of the LDAP server (the IP address
cannot be used).
■ You must know the port on the LDAP server which the Enforce Server uses to communicate
with the LDAP server. The default is 389.
 Implementing lookup plug-ins 1464
Configuring LDAP Lookup Plug-Ins

You can use an LDAP lookup tool such as Softerra LDAP Browser to confirm that you have
the correct credentials to connect to the LDAP server. Also confirm that you have the right
fields defined to populate your custom attributes.
See “About LDAP Lookup Plug-Ins” on page 1436.

Mapping attributes to LDAP data

You map system and custom attributes to LDAP data in the Attribute Mapping field. Each
mapping is entered on a separate line. The order in which these mapping entries appear does
not matter.
The attribute mapping syntax for LDAP Lookup Plug-ins is as follows:

attr.CustomAttributeName = search_base:
(search_filter=$variable$):
ldapAttribute

The following table describes this syntax in more detail.

Table 52-21 LDAP mapping syntax details

Element Description

CustomAttributeName
The name of the custom attribute as it is defined in the Enforce Server.
Note: If the name of the attribute contains white-space characters, you must
precede each instance of the white space with a backslash. A white-space
character is a space or a tab. For example, you need to enter the Business
Unit custom attribute as: attr.Business\ Unit

See “Configuring custom attributes” on page 1418.

search_base Identifies the LDAP directory.

search_filter The name of the LDAP attribute (field) that corresponds to the lookup parameter
(or other variable) passed to the plug-in from the Enforce Server.

variable The name of the lookup parameter that contains the value to be used as a key to
locate the correct data in the LDAP directory.

In cases where multiple plug-ins are chained together, the parameter might be a
variable that is passed to the LDAP Lookup Plug-In by a previous plug-in.

ldapAttribute The LDAP attribute whose data value is returned to the Enforce Server. This value
is used to populate the custom attribute that is specified in the first element of the
entry.

See “About LDAP Lookup Plug-Ins” on page 1436.

 Implementing lookup plug-ins 1465
Configuring LDAP Lookup Plug-Ins

Attribute mapping examples for LDAP

The following mappings provide additional attribute mapping examples for LDAP Lookup
Plug-ins.
The following example attribute mapping searches the hr.corp LDAP directory for a record
with an attribute for mail whose value matches the value of the sender-email lookup
parameter. It returns to the Enforce Server the value of the givenName attribute for that record.

attr.First\ Name = dc=corp,dc=hr:(mail=$sender-email$):givenName

In the following attribute mapping example, a separate line is entered for each custom attribute
that is to be populated. In addition, note the use of the TempDeptCode temporary variable. The
department code is needed to obtain the department name from the LDAP hierarchy. But only
the department name needs to be stored as a custom attribute. The TempDeptCode variable
is created for this purpose.

attr.First\ Name = cn=users:(mail=$sender-email$):firstName

attr.Last\ Name = cn=users:(mail=$sender-email$):lastName
attr.TempDeptCode = cn=users:(mail=$sender-email$):deptCode
attr.Department = cn=departments:(deptCode=$TempDeptCode$):name
attr.Manager = cn=users:(mail=$sender-email$):manager

Testing and troubleshooting LDAP Lookup Plug-ins

Complete these steps to troubleshoot LDAP Lookup Plug-In implementations.
See “About LDAP Lookup Plug-Ins” on page 1436.
To troubleshoot an LDAP Lookup plug-in
1 If the plug-in does not save correctly, verify the configuration.
Before using the LDAP Lookup Plug-In you should test the connection to the LDAP server.
You can use a lookup tool such as the Softerra LDAP Browser to help confirm that you
have the correct fields defined.
See “Configuring directory server connections” on page 141.
2 Make sure that the plug-in is enabled.
3 Make sure that you created the Custom Attribute definitions.
In particular, check the attribute mapping. The attribute names must be identical.
4 If you made changes, or edited the lookup parameter keys, reload the plug-in.
See “Reloading lookup plug-ins” on page 1450.
 Implementing lookup plug-ins 1466
Configuring LDAP Lookup Plug-Ins

5 Select Incidents > All Incidents for the detection server you are using to detect the
incident.
6 Select (check) several incidents and select Lookup Attributes from the Incident Actions
drop-down menu. (This action looks up attribute values for all incidents for that form of
detection.
7 Check the Incident Snapshot screen for an incident. Verify that the Lookup Custom
Attributes are filled with entries retrieved from the LDAP lookup.
8 If the correct values are not populated, or there is no value in a custom attribute you have
defined, make sure that there are no connection errors are recorded in the Incident History
tab.
9 Check the Tomcat log file.
See “Troubleshooting lookup plug-ins” on page 1450.

LDAP Lookup Plug-In tutorial

This tutorial provides steps for implementing a simple LDAP Lookup Plug-In .
To implement an LDAP Lookup Plug-In
1 Create the following custom attributes at System > Attributes > Custom Attributes:
LDAP givenName
LDAP telephoneNumber
2 Create a directory connection for the Active Directory server at System > Settings >
Directory Connections.
For example:
■ Hostname: enforce.dlp.company.com
■ Port: 389
■ Base DN: dc=enforce,dc=dlp,dc=com
■ Encryption: None
■ Authentication: Authenticated
■ username: userName
■ password: password

3 Test the connection. The system indicates if the connection is successful.

4 Create a new LDAP plug-in at System > Lookup Plugins > New Plugin > LDAP.
Name: LDAP Lookup Plug-in
Description: Description for the LDAP Plug-in.
 Implementing lookup plug-ins 1467
Configuring Script Lookup Plug-Ins

5 Select the directory connection created in Step 2.

6 Map the attributes to LDAP metadata.

attr.LDAP\ givenName = cn=users:(|(givenName=$endpoint-user-name$)(mail=$sender-email$)

(streetAddress=$discoverserver$)):givenName
attr.LDAP\ telephoneNumber = cn=users:(|(givenName=$endpoint-user-name$)(mail=$sender-email$)
(streetAddress=$discoverserver$)):telephoneNumber

7 Save the plug-in. Verify that the correct save message for the plug-in is displayed.
8 Enable the following keys at the System > Lookup Plugins > Lookup Parameters page.
■ Incident
■ Message
■ Sender

9 Create an incident that generates one of the lookup parameters. For example, an email
incident exposes the sender-email attribute. There must be some corresponding information
in the Active Directory server.
10 Open the Incident Snapshot for the incident.
11 Click the Lookup button and verify the custom attributes created in the Step 1 are
populated in the right panel.

Configuring Script Lookup Plug-Ins

Complete these steps to implement one or more Script Lookup Plug-Ins to look up external
information.
See “Writing scripts for Script Lookup Plug-Ins” on page 1468.

Table 52-22 Configuring a Script Lookup Plug-In

Step Action Description

1 Create custom See “Configuring custom attributes” on page 1418.

attributes.

2 Create the script. See “Writing scripts for Script Lookup Plug-Ins” on page 1468.

3 Define the Lookup Select the keys to use to extract custom attribute data.
Parameter Keys.
See “Selecting lookup parameters” on page 1444.
 Implementing lookup plug-ins 1468
Configuring Script Lookup Plug-Ins

Table 52-22 Configuring a Script Lookup Plug-In (continued)

Step Action Description

4 Create a new Script See “Creating new lookup plug-ins” on page 1443.
Plugin.

5 Enter the Script This value is the local path to the script engine executable on the Enforce Server
Command. host.

See “Specifying the Script Command” on page 1469.

6 Specify the Arguments. This value is the path to the Python script file to use for attribute lookup and any
command line arguments. Begin the script path with the -u argument to improve
lookup performance.

See “Specifying the Arguments” on page 1470.

7 Enable the stdin and Enable both options to help prevent script injection attacks.
stout options.
See “Enabling the stdin and stdout options” on page 1470.

8 Optionally, enable You can specify the incident types by protocol for passing attribute values to look
protocol filtering. up scripts.

See “Enabling incident protocol filtering for scripts” on page 1471.

9 Optionally, enable and You can encrypt and pass credentials required by the script to connect to external
encrypt credentials. systems.

See “Enabling and encrypting script credentials” on page 1472.

9 Save the plugin. Verify that the correct save message for the plugin is displayed.

See “Creating new lookup plug-ins” on page 1443.

10 Enable the lookup You can chain scripts together and chain scripts with other lookup plugins.
plugin.

11 Test the lookup plugin. Test the lookup plugin.

See “Troubleshooting lookup plug-ins” on page 1450.

Writing scripts for Script Lookup Plug-Ins

If you are using the Script Lookup Plug-In , you must write a script to extract data and populate
the custom attributes of each incident. The Script Lookup Plug-In passes attributes to scripts
as key-value pairs. In return, scripts must output a set of key-value pairs to standard out
(stdout). The plugin uses these key-value pairs to populate custom attributes.
 Implementing lookup plug-ins 1469
Configuring Script Lookup Plug-Ins

When writing scripts for use with the Script Lookup Plug-In , adhere to the following syntax
requirements and calling conventions, including how a script plugin passes arguments to
scripts and the required format for script output.

Table 52-23 Script plugin calling conventions

Convention Syntax Description

Input attribute_name=attribute_value The Script Lookup Plug-In passes attributes to scripts as

command-line parameters in the form key=value.

Output stdout To work with the plugin and populate attributes, scripts
must output a set of key-value pairs to standard out
(stdout).

Newline characters must separate output key-value pairs.

For example:

host-name=mycomputer.company.corp
username=DOMAIN\bsmith

exit code 0 Scripts must exit with an exit code of ‘0.’ If scripts exit with
any other code, the Enforce Server assumes that an error
has occurred in script execution and terminates the
attribute lookup.

error handling stderr to a file Scripts cannot print out error or debug information. Redirect
stderr to a file. In Python this would be:

fsock = open("C:\error.log", "a") sys.stderr = fsock

See “Example script” on page 1476.

Specifying the Script Command

The Script Command field specifies the path to the script engine for executing the script.
These instructions are specific to Python.
To specify the script command
1 Download and install version 2.6 of Python on the Enforce Server host, if you have not
already done so.
2 Enter the local path to the python.exe executable file.
For example:
■ Windows: c:\python26\python.exe
 Implementing lookup plug-ins 1470
Configuring Script Lookup Plug-Ins

■ Linux: /usr/local/bin/python

3 Enter the Arguments.

See “Specifying the Arguments” on page 1470.

Specifying the Arguments

The Arugments field specifies the path to the script and any additional command line
arguments. These instructions are specific to Python.
To specify the Arguments
1 After writing a script, copy it to the Enforce Server host, or to a file share that is accessible
by the Enforce Server.
2 Make sure that permissions are set correctly on the directory and the script file.
Both the directory and file must be readable and executable by the protect user.
3 Enter the -u argument in the Argument field.
This command forces stdin, stdout, and stderr to be totally unbuffered, which improves
lookup performance.
4 Enter the fully qualified path to the script file.
For example:
■ Windows: -u,c:\python26\scripts\ip-lookup.py
■ Linux: -u,/opt/python26/scripts/ip-lookup.py

Note: The system does not validate the file location.

5 Save the plugin configuration.

Enabling the stdin and stdout options

When you configure a Script Lookup Plug-In you can choose to Enable stdin and Enable
stdout. If these options are enabled, the system checks the script input and output for unsafe
characters such as command delimiters and logical operators that could be exploited by a
UNIX or Windows shell.
Because you are running the script on the host where the Enforcer Server is installed, you
should enable both options, unless you are certain that your script is safe. If enabled, the logs
will indicate invalid and unescaped characters.
See Table 52-24 on page 1471.
 Implementing lookup plug-ins 1471
Configuring Script Lookup Plug-Ins

Table 52-24 Invalid characters for attribute names

Invalid character Description

Empty string Empty strings are not allowed.

@ Attributes containing these characters will be ignored during processing if the stdin and
stdout options are enabled.
.

$ Attributes containing the $ and % characters are allowed if these characters are properly
escaped by a backslash.
%

Enabling incident protocol filtering for scripts

Optionally, you can specify the incident types (by protocol) for passing attribute values to look
up scripts. If you do not enable protocol filtering, your Script Lookup Plug-In will apply to all
incidents.
For example, you can limit the passing of attribute values to those incidents that are detected
over HTTP. When you filter by protocol, Enforce Server still captures the incidents that are
detected over other protocols. But it does not use the Script Lookup Plug-In to populate those
incidents with attribute values.
 Implementing lookup plug-ins 1472
Configuring Script Lookup Plug-Ins

To enable protocol filtering

1 Navigate to the System > Lookup Plugins > Edit Script Lookup Plugin screen in the
Enforce Server administration console.
See “Configuring Script Lookup Plug-Ins” on page 1467.
2 At the Script Lookup Plugin screen, select (check) the Enable protocol filtering option.
This action displays all the protocols that are available for filtering. Note that protocols are
detection server-specific.

Note: Network protocols are configured at the System > Settings > Protocols screen.
Endpoint protocols are configured at the System > Agents > Agent Configuration screen.
Discover protocols are configured at the Policies > Discover Scanning > Discover
Targets. And, once an incident is generated, the protocol value for the incident is displayed
at the top of the Incident Snapshot screen.

3 Specify the protocols you want to include in the lookup.

If you enable protocol filtering, you must select at least one protocol on which to filter.
4 Save the plug-in configuration.

Enabling and encrypting script credentials

If your script is connecting to an external system that requires credentials, you can enable
credentials for your script. If you enable credentials through the user interface option, you must
encrypt them. Symantec Data Loss Prevention provides the Credential Utility, which lets you
encrypt credentials and use them to authenticate to an external data source.
When the Enforce Server invokes the Script Lookup Plug-In , the plug-in decrypts any
credentials at runtime and passes them to the script as attributes. The credentials are then
available for use within the script. The Credential Utility uses the same platform encryption
keys that are used to protect user accounts and incident information within the Symantec Data
Loss Prevention system.
See Table 52-25 on page 1473.
If you choose to use credentials in clear text, you must hard code them into your script. In this
case, the Enforce Server passes the values you exported to the clear-text credential file. These
values are passed in the following format: key=value.
 Implementing lookup plug-ins 1473
Configuring Script Lookup Plug-Ins

Table 52-25 Enabling and encrypting credentials

Step Action Description

1 Create a text file that contains the The format of this file is key=value, where key is the name
credentials that are needed by the script of the credential.
to access the appropriate external
For example:
systems.
username=msantos password=esperanza9

2 Save this credential file to the file system The file needs to be saved to the Enforce Server temporarily.
local to the Enforce Server.
For example: C:\temp\MyCredentials.txt.

3 On the Enforce Server, open a shell or This directory on the Enforce Server contains the Credential
command prompt and change directories Generator Utility.
to
\SymantecDLP_home\Protect\bin.

4 Issue a command to generate an The command syntax is as follows:

encrypted credential file.
CredentialGenerator.bat
in-cleartext-filepath out-encrypted-filepath

For example on Windows you would issue the following:

CredentialGenerator.bat C:\temp\MyCredentials.txt
C:\temp\MyCredentialsEncrypted.txt

You can open this file in a text editor to verify that it is

encrypted.

5 Select Enable Credentials. At the System > Lookup Plugins > Edit Script Lookup
Plugin page, select (check) the Enable Credentials option.

6 Enter the Credentials File Path. Enter the fully qualified path to the encrypted credentials file.
For example:

C:\temp\MyCredentialsEncrypted.txt.

7 Save the plug-in. You can now use the encrypted credentials to authenticate
to an external system.

8 Secure the clear-text credentials file. If you want to save the clear-text credentials file, move it to
a secure location. It can be useful to save the file if you plan
to update and re-encrypt it later. If you do not want to save
the file, delete it now.

9 Reload the lookup plug-in. See “Managing and configuring lookup plug-ins” on page 1442.
 Implementing lookup plug-ins 1474
Configuring Script Lookup Plug-Ins

Chaining multiple Script Lookup Plug-Ins

All lookup plug-ins receive a reference to the same attribute map. This reference enables you
to chain lookup plug-ins. Whether plug-in chaining is necessary to populate your custom
attributes varies according to circumstances. Consider the following example scenarios.
Getting the right key for Network email incidents is usually straightforward. The email address
of the message sender is automatically captured as the sender-email lookup parameter. That
lookup parameter can be used as a key to unlock the information about the sender that is
stored in an external source. In this instance, it is not necessary to chain multiple plug-ins.
For Web or FTP incidents, a plug-in chain might be necessary. The lookup parameter that is
captured for these kinds of incidents is the IP addresses of the originating hosts. But IP
addresses usually are not static identifiers like email addresses. Therefore, you may need to
do successive lookups to get to a static identifier that can be used as an information key.
You can write a script to pass the sender-ip lookup parameter to a DNS server to get the
host name. You can then write another script to pass that host name to an asset management
system. From the asset management system you can obtain the user name or email of the
person using that computer. That user name or email can then be used as the “key” to unlock
the rest of the data. This plug-in chain would have three links:
1. The Script Lookup Plug-In that uses the IP address to return the host name.
2. The Script Lookup Plug-In that uses the host name to return the user name or email.
3. The CSV Lookup Plug-In that uses the user name or email to return the rest of the custom
attribute data.
In this example, you must create a new Host_Name temporary variable to store the host name
information. This temporary variable and its value are then available to the second script and
subsequent plugins.

Script Lookup Plug-In tutorial

Complete the following tutorial to implement a Script Lookup Plug-In . This tutorial assumes
basic hands-on familiarity with implementing lookup plugins. To obtain this familiarity, complete
the "CSV Lookup Plug-In tutorial."
See “CSV Lookup Plug-In tutorial” on page 1460.
 Implementing lookup plug-ins 1475
Configuring Script Lookup Plug-Ins

To implement a Script Lookup Plug-In

1 Download and install Python 2.6 on the system where the Enforce Server is installed.
For example: C:\python26.
2 Copy the "Example script" provided in this chapter to a text file and save it to a directory
on the Enforce Server host as Script-Plug-In.py.
For example: C:\python26\scripts\Script-Plug-In.py.
See “Example script” on page 1476.
3 Open this script in a Python IDE such as the Wing IDE (available at
http://www.wingware.com/).
4 Review the comments in this script and run it.
■ Comment out line 18.
■ Run the script. It returns "Script-attribute=script value".
■ Uncomment line 18 so it is not processed.

5 Create the following custom attribute: Script-attribute.

6 Select New Plugin > Script to create a new Script Lookup Plug-In .
See “Creating new lookup plug-ins” on page 1443.
7 Configure the Script Lookup Plug-In.
Use the following parameters:
■ Script Command: C:\python26\python.exe
■ Arguments: -u,C:\python26\scripts\Script-Plugin.py

8 Save the plugin and ensure that the plugin loads successfully as indicated by the system
message.
9 Enable the following lookup parameters: Incident, Message, and Sender.
10 Generate an incident that passes the date-sent attribute.
11 Go to the Incident Snapshot for the new incident and click Lookup.
12 Verify that the Script-attribute custom attribute is populated with the value of script
value.
 Implementing lookup plug-ins 1476
Configuring Script Lookup Plug-Ins

13 If the custom attribute is not populated, check the log file

C:\SymantecDLP\Protect\logs\tomcat\localhost.<latest_date>.log.

If Script-attribute=null check the script. Review the comments in the provided script
and ensure that there is no space between the attribute=value pair.
See “Troubleshooting lookup plug-ins” on page 1450.
14 Explore enabling optional properties for the Script Lookup Plug-In , including stdin/stdout,
protocol filtering, and credentials.
See “Enabling the stdin and stdout options” on page 1470.
See “Enabling incident protocol filtering for scripts” on page 1471.
See “Chaining multiple Script Lookup Plug-Ins” on page 1474.

Example script
The following script is provided as an example for the Script Lookup Plug-In . It is written in
Python 2.6. The purpose of this script is to provide a basic working example for writing scripts
in Python that can be used for Script Lookup Plugins.
This script contains the date-sent lookup parameter key and returns the "script value" for the
custom attribute Script-attribute.
See “Script Lookup Plug-In tutorial” on page 1474.

Note: Because Python is strict about indentation requirements, if you copy/paste this example
script you will likely need to reformat it so that it appears exactly as displayed here.
 Implementing lookup plug-ins 1477
Configuring Script Lookup Plug-Ins

__name__="__main__"

import sys, os, traceback

import commands

# Switch this to 0 when in production mode.

debugMode = 1

def main(args):

try:

attributeMap = parseInput(args)

# This is the lookup parameter key.

# Comment-out this line for testing the script standalone.
dateSent = attributeMap["date-sent"]

# "Script-attribute" is the custom attribute.

# "script value" is the return value.
# You cannot have a space between the custom attribute and the
# attribute value. For example, "Script-attribute = script value"
# Does not work for Script Lookup Plugins.
print "Script-attribute=script value"
return

except:
error()
print "something went wrong!"
return "something went wrong!"

def parseInput(args):

# Input data is a list of key value pairs seperated by carraige return

# Create a python dictionary to create the attribute map
attributeMap = {}
delimiter = "="
for item in args:
if delimiter in item:
tuple = item.split(delimiter)
attributeMap[tuple[0]] = tuple[1]
return attributeMap

def error():
# "SCRIPT PROCESSING ERROR"
if(debugMode):
 Implementing lookup plug-ins 1478
Configuring migrated Custom (Legacy) Lookup Plug-Ins

#print "Script Processing Error"

traceback.print_exc(file=sys.stdout)
return ""

#-----------------------------------------------------------------
# DOS-style shells (for DOS, NT, OS/2):
#-----------------------------------------------------------------
def getstatusoutput(cmd):
""" Return (status, output) of executing cmd in a
shell."""

pipe = os.popen(cmd + ' 2>&1', 'r')

text = pipe.read()
sts = pipe.close()
if sts is None: sts = 0
if text[-1:] == '\n': text = text[:-1]
return sts, text

#-----------------------------------------------------------------
# Entry Point
#-----------------------------------------------------------------

if __name__ == "__main__":

if(len(sys.argv) == 0):
error()
else:
main(sys.argv)

Configuring migrated Custom (Legacy) Lookup

Plug-Ins
These steps presume that you have existing Custom Java Lookup Plug-Ins deployed to a
pre-12.0 version of Symantec Data Loss Prevention and that you have upgraded the system
to Symantec Data Loss Prevention version 12.0 or later. In this case a Custom Java Lookup
Plug-In will be migrated to a Custom (Legacy) Lookup Plug-In and will appear in the user
interface for verification and testing.
See “About Custom (Legacy) Lookup Plug-Ins” on page 1437.
 Implementing lookup plug-ins 1479
Configuring migrated Custom (Legacy) Lookup Plug-Ins

Table 52-26 Implementing Custom (Legacy) Lookup Plugins

Step Action Description

1 Create custom attributes. Create the custom attributes that your Custom (Legacy)
Lookup Plugin will retrieve the values for.

See “About using custom attributes” on page 1417.

2 Edit the Custom (Legacy) Plugin. Successful upgrade should import the Custom (Legacy)
Lookup Plugin to the user interface where you can enable
it.

You can update the name and description if necessary.

See “Creating new lookup plug-ins” on page 1443.

3 Verify the Plugin Class. After upgrade, the class name should be populated from
the Plugins.properties file.

4 Verify the Required JARs. After upgrade, the JAR files previously copied to the Enforce
Server should appear in this field.

5 Enable the plug-in. Turn the plug-in On.

See “Enabling lookup plug-ins” on page 1449.

6 Enable parameter lookup keys. Select the keys to trigger attribute lookup.

See “Selecting lookup parameters” on page 1444.

7 Create a policy and generate an incident of For example, create a keyword policy and generate an
the type expected by the plug-in. SMTP network incident that passes the sender-name
attribute.

8 Verify that the custom attributes are updated. Check the Incident Snapshot for the populated attributes.

See “Troubleshooting lookup plug-ins” on page 1450.

 Section 7
Monitoring and preventing
data loss in the network

■ Chapter 53. Implementing Network Monitor

■ Chapter 54. Implementing Network Prevent for Email

■ Chapter 55. Implementing Network Prevent for Web

 Chapter 53
Implementing Network
Monitor
This chapter includes the following topics:

■ Implementing Network Monitor

■ About IPv6 support for Network Monitor

■ Choosing a network packet capture method

■ About packet capture software installation and configuration

■ Configuring the Network Monitor Server

■ Enabling GET processing with Network Monitor

■ Creating a policy for Network Monitor

■ Testing Network Monitor

Implementing Network Monitor

Network Monitor captures and analyzes traffic on your network, detecting confidential data,
and significant traffic metadata over protocols you specify. For example, SMTP, FTP, HTTP,
and various IM protocols. You can configure a Network Monitor Server to monitor custom
protocols and to use a variety of filters (per protocol) to filter out low-risk traffic.
To monitor network traffic, a Network Monitor Server requires:
■ A network Switch Port Analyzer (SPAN) or network tap to acquire traffic on the target
network.
■ A card on the Network Monitor Server host to capture the network traffic that is acquired
from the SPAN or tap. Either a network interface card (NIC) or high-speed packet capture
 Implementing Network Monitor 1482
Implementing Network Monitor

adapter (Endace or Napatech) can be used. (Note that in addition to this traffic-capturing
card, a separate NIC is required for communication between the Network Monitor Server
and the Enforce Server. WinPcap is required for this purpose.)
■ Packet capture software. When you use a NIC for packet capture, packet capture software
must be installed on the Network Monitor Server host. When you use a high-speed packet
capture adapter card (Endace or Napatech), the card must use the correct driver.
See “Choosing a network packet capture method” on page 1484.

Figure 53-1 A basic Network Monitor setup

To implement packet capture and set up a Network Monitor, perform the following high-level
tasks:
1 Install and set up the network tap or SPAN that captures network traffic.
2 Choose a method of capturing network traffic.
See “Choosing a network packet capture method” on page 1484.
3 Install the necessary NIC or high-speed packet capture adapter (Endace or Napatech)
on the Network Monitor as described by the card documentation. Also use the appropriate
Symantec Data Loss Prevention Installation Guide (Windows or Linux). This NIC or
high-speed packet capture adapter (Endace or Napatech) must operate in promiscuous
mode so that all inbound and outbound traffic is relayed through this port.
See the Symantec Data Loss Prevention System Requirements and Compatibility Guide
for information about supported NICs and high-speed packet capture adapters.
4 On a Windows platform, install WinPcap if it is not already installed.
See “Installing WinPcap on a Windows platform” on page 1485.
5 If necessary, update the driver for the high-speed packet capture adapter.
See “Updating the Endace card driver” on page 1486.
 Implementing Network Monitor 1483
About IPv6 support for Network Monitor

6 Disable checksum offloading for the NIC that is used to monitor network traffic. For Linux
platforms, use the following commands to disable checksum offloading for both receiving
and transmitted data on the eth0 interface:

ethtool -K eth0 tx off

ethtool -K eth0 rx off

To see the current status of checksum offloading, use the ethtool -k eth0 command.

Note: Certain checksum algorithms work by modifying network packets and adding empty
checksums. Empty checksums can cause network capture drivers to drop the packets,
in which case they are not evaluated by Network Monitor.

7 Use a protocol analyzer such as Wireshark to validate traffic on the tap or SPAN that
feeds into your NIC or high-speed packet capture adapter (Endace or Napatech).
8 Configure the Network Monitor Server.
See “Configuring the Network Monitor Server” on page 1492.
9 Create and deploy a test policy for Network Monitor.
See “Creating a policy for Network Monitor” on page 1494.
10 Test the system by generating an incident against your test policy.
See “Testing Network Monitor” on page 1495.

About IPv6 support for Network Monitor

Symantec Data Loss Prevention supports monitoring of pure IPv4 networks, dual-stack (IPv4
and IPv6) networks, or pure IPv6 networks. The Enforce Server administration console supports
input and reporting of both IPv4 and IPv6 addresses for Network Monitor. Support for monitoring
IPv6 networks is limited to implementations of Network Monitor and does not include support
for other Symantec Data Loss Prevention products.
Here is an overview of specific support for IPv6 in Symantec Data Loss Prevention:
■ Installation of a Network Monitor Server that is capable of monitoring IPv6 networks or
dual-stack networks is the same as installation of a Network Monitor Server that monitors
an IPv4 network.
■ The hardware and operating system requirements are the same as for IPv4 Network Monitor.
See the Symantec Data Loss Prevention System Requirements Guide for more information
on third-party hardware and software compatibility.
■ IP address data types can hold either IPv4 or IPv6 addresses.
 Implementing Network Monitor 1484
Choosing a network packet capture method

■ Network incidents can include IPv6 addresses.

■ Network protocol definitions can include IPv6 addresses.
Symantec Data Loss Prevention IPv6 support is limited to monitoring. The Enforce Server
administration console must still be deployed on an IPv4 network; there is no support for
command and control functionality over IPv6.
This release does not include support for:
■ Deployment of Symantec Data Loss Prevention over IPv6 networks
■ Support of other Symantec Data Loss Prevention servers on IPv6 networks
■ Use of IPv6 system-defined data identifiers
■ Use of IP fragmentation over IPv6
■ Configuring or communicating with detection servers over IPv6
■ Deployment of IPv6 endpoints
■ Deployment of Symantec Encryption Server on IPv6
■ Deployment of the Oracle database on an IPv6 connection
See Configure a protocol in online Help for more information about specific implementation
details of IPv6 support.

Choosing a network packet capture method

You can use three different methods to capture the network traffic that is acquired by a SPAN
or tap:
■ NIC on a Windows platform. Windows platforms using a NIC for packet capture require a
WinPcap library on the Network Monitor Server host. If WinPcap is not already on the
Network Monitor Server host, you must install it. See the Symantec Data Loss Prevention
System Requirements and Compatibility Guide for information about the supported version
of the WinPcap library.
See “Installing WinPcap on a Windows platform” on page 1485.
■ NIC on a Linux platform. Linux platforms using a NIC use native Linux packet capture which
requires PACKET_MMAP support in the kernel. Support for PACKET_MMAP is included
by default in supported Linux kernels.
■ High-speed packet capture adapter on either Windows or Linux platforms. An Endace DAG
network measurement card can be used on Linux 64-bit platforms to provide network packet
capture in high-traffic environments. Alternatively, a Napatech network adapter can be
used to provide network packet capture. See the Symantec Data Loss Prevention System
Requirements and Compatibility Guide for information about supported high-speed packet
capture adapters and drivers.
 Implementing Network Monitor 1485
About packet capture software installation and configuration

Table 53-1 Packet capture alternatives

Packet capture type Platform Software

NIC Windows WinPcap

Linux Native

High-speed packet capture Windows 64-bit Napatech

adapter

Linux 64-bit Endace

Napatech

About packet capture software installation and

configuration
Consider the following requirements when installing and configuring packet capture software:
■ On Windows platforms, packet capture requires the WinPcap software which may need to
be installed if it is not already present.
■ On Linux platforms, PACKET_MMAP performs packet capture. PACKET_MMAP is a standard
Linux component and should not need to be installed or modified. However, you also require
apr-util, apr, expat, and other third-party packages to run a Network Monitor Server on
Linux. See the Symantec Data Loss Prevention System Requirements and Compatibility
Guide for more information.
■ If you use a high-speed packet capture adapter (Endace or Napatech), you will need to
install or update the adpater driver software.
See “Installing WinPcap on a Windows platform” on page 1485.
See “Updating the Endace card driver” on page 1486.
See “Installing and updating the Napatech network adapter and driver software” on page 1486.

Installing WinPcap on a Windows platform

If WinPcap software is not already present on a Windows platform, you must install it. See the
Symantec Data Loss Prevention System Requirements and Compatibility Guide for information
about the supported version of the WinPcap library. Additional details can be found in the
Symantec Data Loss Prevention Installation Guide.
See “About managing Symantec Data Loss Prevention servers” on page 210.
 Implementing Network Monitor 1486
About packet capture software installation and configuration

To install WinPcap on the Network Monitor detection server:

1 Locate the WinPcap software at the following URL: http://www.winpcap.org/
2 Copy the WinPcap files to a local drive.
3 Run the WinPcap executable and follow the installation instructions.
4 Reset the Windows registry settings by running pcapstart.reg and follow the instructions
that are displayed.

Updating the Endace card driver

If you upgrade a Network Monitor Server to the current version, you may need to update the
Endace card driver. See the Symantec Data Loss Prevention System Requirements and
Compatibility Guide for information about supported Endace cards and drivers.
Updating an Endace Driver
1 Install the new driver as described by Endace documentation.
2 Reconfigure the Network Monitor to use the new driver.
See “Configuring the Network Monitor Server” on page 1492.

Installing and updating the Napatech network adapter and driver

software
Install the Napatech high-speed packet capture card and driver following these instructions.
Note the different prerequisites and procedures for Linux and Windows. Refer to the Symantec
Data Loss Prevention System Requirements and Compatibility Guide at
http://www.symantec.com/docs/doc10602.html for information about the supported Napatech
card and driver versions.

Napatech driver prerequisites for Linux

■ Linux kernel development headers
■ GCC version 4.0 or later
■ GNU make
■ You need these libraries to run the tools:
■ glibc version 2.5 or later

■ ncurses version 5.0 or later; only applies to the monitoring tools and profiling tools

■ Superuser privileges are required for installing and compiling the Linux driver and the tools.
 Implementing Network Monitor 1487
About packet capture software installation and configuration

Napatech driver prerequisites for Windows

■ The server must have at least 4 GB of memory.
■ You must have Administrator privileges to install Napatech.
■ Before you install Symantec Data Loss Prevention Network Monitor software, you must
install the supported version of WinPcap from https://www.winpcap.org/install/. See the
Symantec Data Loss Prevention Installation Guide at
http://www.symantec.com/docs/doc9257.html for more details.
■ The NTService, which is an essential part of the Napatech Software Suite, can run as either
a Windows Service or in console (foreground) mode. You should install it as an autostart
service.

Table 53-2 Installing and updating the Napatech network adapter

Step Action Description

1 Download the Go to https://support.napatech.com.

product package
from the Napatech
Support Center.

2 Unpack or extract For Linux:

the product package.
Unpack the product package using -tar
-xf/napatech/ntanl_package_3gd_linux_8.1.0.tar.gz.

For Windows:

Extract the installer from the product package nt_suite_3gd_windows_x.y.z.zip.

3 Install the supported Refer to the Symantec Data Loss Prevention System Requirements and Compatibility
Napatech Guide at http://www.symantec.com/docs/doc10602.html for the latest supported
high-speed packet versions of Napatech.
capture adapter.
 Implementing Network Monitor 1488
About packet capture software installation and configuration

Table 53-2 Installing and updating the Napatech network adapter (continued)

Step Action Description

4 Install the Napatech For Linux:

driver and tools.
1 Install the driver and tools with
./ntanl_package_3gd_linux_8.1.0/package_install_3gd.sh.

2 Do not install the version of libpcap with Napatech extensions.

3 Load the driver using: /opt/napatech3/bin/ntload.sh.

4 Start the Napatech service using /opt/napatech3/bin/ststart.sh.

5 Add lines 3 and 4 to /etc/rc.d/rc.local to automatically start this service

when the system restarts. Some Linux versions require you to set the execution
bit in the rc.local file.

For Windows:
1 Run ntanl_package_3gd_windows_x.y.z.exe to install the software suite.

2 Choose all of the components except NT WinPcap. You have already installed
the correct version of WinPcap as one of the Windows prerequisites.

For more details, see the Napatech Software Installation Guide.

For supported versions of the Napatech drivers, see the Symantec Data Loss
Prevention System Requirements and Compatibility Guide.
 Implementing Network Monitor 1489
About packet capture software installation and configuration

Table 53-2 Installing and updating the Napatech network adapter (continued)

Step Action Description

5 Verify Napatech For Linux

installation.
1 Verify that the Napatech driver was compiled and successfully installed.

The script
./ntanl_package_3gd_linux_8.1.0/package_install_3gd.sh compiles
the driver and installs the service. If you encounter errors running this script,
make sure that you have installed all of the required prerequisites, including
kernel development packages and development tools.

2 Load the driver using: /opt/napatech3/bin/ntload.sh.

3 Start the Napatech service using /opt/napatech3/bin/ntstart.sh.

4 You should get a success message when you load the driver (step 2) and start
the Napatech service (step 3).

If the driver was compiled and installed successfully, but loading the driver and
service generates an error message, go to Napatech support at
https://support.napatech.com.

For Windows
1 Use the Windows Device Manager to validate that the Napatech Accelerator
works properly. Navigate to Napatech Software Suite Class > Device status
on the General tab. You should see Device is working properly.

2 Use Windows Services to validate that Napatech Software Suite 64 bit is

running, and that the Startup type is set to automatic.

3 For troubleshooting, refer to the Napatech Software Installation Guide from the
Napatech software package.

6 Configure the Deploy a Network Monitor detection server and configure the Advanced Server
Network Monitor settings:
detection server.
1 Enable Napatech packet capture by setting the
PacketCapture.IS_NAPATECH_ENABLED flag to true.

2 Update the value to the path to the Napatech driver tools directory by entering
the path in the field for the following entry:
PacketCapture.NAPATECH_TOOLS_PATH.
■ For Linux,
/opt/napatech3/bin
■ For Windows Device Manager,
C:\Program Files\Napatech3\bin

See “Advanced server settings” on page 245.

 Implementing Network Monitor 1490
About packet capture software installation and configuration

Sample Napatech capture configuration file

A Napatech capture configuration file is included with the Data Loss Prevention installer. It is
used to assign capture streams and configure capture filters. This configuration file is located
at the following locations:
On Linux systems at /opt/SymantecDLP/Protect/config/napatech3gd.cfg
On Windows systems at C:\SymantecDLP\Protect\config\napatech3gd.cfg
The following sample configuration file reflects the default settings recommended by Symantec
that provide optimum performance. Edit your file to reflect these default settings.
Streams are not assigned to physical port; the payload is load balanced using the HashMode
algorithm setting. By default, the UDP packets are filtered to reduce unnecessary load on
Symantec Data Loss Prevention.

Table 53-3 Sample napatech3gd.cfg file

# Napatech 3GD NTPL Configuration File #

# This file will be read by PacketCapture and fed to the Napatech Software Interface
upon startup.
# PacketCapture will read all active streams from the Napatech system; delete all
streams before opening new ones.
Delete = All
# Create streams. Edit this to customize stream assignment.
Assign[StreamId = (0..3)] = (Layer4Protocol != UDP)
# The recommended HashMode for splitting traffic for multithreaded processing. This
should always be the last line.
HashMode = Hash2TupleSorted

You can enable multithreading with the PacketCapture.MultithreadingEnabled setting. It

is set to true by default. To disable multithreading, go to the Network Monitor Server
Advanced Settings page and set this value to false. If the napatech3gd.cfg configuration
file is changed, you must restart the Data Loss Prevention PacketCapture Service to load the
new configuration. Please refer to the Napatech documentation for additional capture filter
syntax.

Upgrading Napatech on Symantec Data Loss Prevention Network

Monitor from version 14.x to version 15
Upgrading the Linux system
1 Remove previous installation: rm -rf /opt/napatech/bin.
2 Remove the/opt/napatech/bin/load_driver.sh entry from /etc/rc.d/rc.local.
 Implementing Network Monitor 1491
About packet capture software installation and configuration

3 Compile and install the third-generation drivers following the Linux steps in Table 53-2.
4 Go to the Symantec Data Loss Prevention Upgrade Guide to upgrade the Enforce Server
and the detection servers.
5 Change the Network Monitor Server settings:
■ PacketCapture.NAPATECH_TOOLS_PATH: /opt/napatech3/bin

■ PacketCapture.NUMBER_BUFFER_POOL_PACKETS: 1200000

■ PacketCapture.NUMBER_SMALL_POOL_PACKETS: 1000000

6 Save the changes and recycle the Enforce Server.

7 After recycling the server, select Napatech 3GD Software Interface from the Network
Monitor Configure page.
8 Save the configuration and recycle the Enforce Server again.
Upgrading the Windows system
1 Uninstall the Napatech NT4E device driver from the Windows Device Manager.
2 Install the third-generation driver by following the Windows steps in Table 53-2.
3 Go to the Symantec Data Loss Prevention Upgrade Guide to upgrade the Enforce Server
and Detection servers.
4 Make the following changes to the Network Monitor settings:
■ PacketCapture.NAPATECH_TOOLS_PATH: C:\Program Files\Napatech3\bin

■ PacketCapture.NUMBER_BUFFER_POOL_PACKETS: 1200000

■ PacketCapture.NUMBER_SMALL_POOL_PACKETS: 1000000

5 Save the changes and recycle the Enforce Server.

6 After recycling the server, select Napatech 3GD Software Interface on the Network
Monitor Configure page.
7 Save the configuration and recycle the Enforce Server again.

Note: During the upgrade, unused, preexisting Napatech interfaces are not automatically
deleted from the Enforce Server administration console. You can either ignore the interfaces
or permanently remove them from the Enforce Server administration console. To remove the
interfaces, remove the monitor and add it back. If the server is deleted and added again, the
server settings should be adjusted appropriately as outlined in step 4; otherwise the server
runs with the default settings. Symantec recommends that you make a note of custom server
settings before you delete the old servers.
 Implementing Network Monitor 1492
Configuring the Network Monitor Server

Configuring the Network Monitor Server

You configure the Network Monitor Server by selecting the network interface (NIC, Napatech,
or Endace card) to use for traffic capture. You must also select which protocols to monitor.
To configure a Network Monitor Server
1 In the Enforce Server administration console, go to System > Servers and Detectors >
Overview and click the Network Monitor Server. The Server/Detector Detail screen
appears.
If you do not use a high-speed packet capture adapter (Endace or Napatech) for traffic
capture, skip to step 6.
2 If you use a high-speed packet capture adapter (Endace or Napatech), click Server
Settings.
3 For Endace cards, enter the appropriate values in the following fields:

PacketCapture.ENDACE_BIN_PATH Type the path to the Endace \bin directory.

By default, this directory is located at

endace_home\dag-version\bin. Note that
you cannot use variables (such as
%ENDACE_HOME%) in any of the fields that
are listed here.

PacketCapture.ENDACE_LIB_PATH Type the path to the Endace \lib directory

PacketCapture.ENDACE_XILINX_PATH Type the path to the Endace \xilinx directory.

PacketCapture.IS_ENDACE_ENABLED Change the value to true.

4 For Napatech cards, enter the appropriate values in the following fields:

PacketCapture.IS_NAPATECH_ENABLED Change the value to true.

PacketCapture.NAPATECH_TOOLS_PATH Type the path to the Napatech \tools directory.

5 Stop and restart the Network Monitor Server. Symantec Data Loss Prevention displays
the Endace card in the Network Interfaces field of the Configure Server screen for the
Network Monitor Server.
6 Go to System > Servers and Detectors > Overview and again click on the Network
Monitor Server.
7 On the Server Detail screen, click Configure. You can verify or modify settings in the
general section at top and on the Packet Capture tab, as described in subsequent steps.
 Implementing Network Monitor 1493
Enabling GET processing with Network Monitor

8 Leave the Source Folder Override field blank to accept the default directory for buffering
network streams before the Network Monitor Server processes them. (This setting is the
recommended setting.) To specify a custom buffer directory, type the full path to the
directory.
9 Select one or more Network Interfaces (NICs, Napatech cards, or Endace cards) through
which the Network Monitor Server should capture traffic.
10 In the Protocol section, select one or more protocols to monitor. For example, select the
check boxes for SMTP, HTTP, and FTP. For a protocol to appear in this section, it must
already be configured on the global Protocols screen in the Enforce Server.
See the online Help associated with the Configure Server screen.
Symantec Data Loss Prevention has standard settings for each protocol in the list. To
modify a protocol’s settings, click the Pencil icon next to the appropriate protocol. For
details on modifying protocol settings, see the online Help.
11 Click Save.
12 Stop and restart the Network Monitor Server. Click Recycle next to the Status entry in
the Server Detail screen.

After selecting a network interface and choosing protocols, you may want to create a test policy
to test your deployment.
See “Testing Network Monitor” on page 1495.
See “Enabling GET processing with Network Monitor” on page 1493.
See “Creating a policy for Network Monitor” on page 1494.

Enabling GET processing with Network Monitor

By default, Network Monitor does not process HTTP GET commands. GET processing is
disabled because it involves high traffic volume, and because sensitive data is rarely lost in
GET commands. If you require GET processing and the Network Monitor Server can handle
the increased load, follow this procedure to configure Network Monitor to process GET
commands.

Note: Network Monitoronly inspects GET requests, it does not inspect HTTP GET responses.
 Implementing Network Monitor 1494
Creating a policy for Network Monitor

To enable GET processing

1 Ensure that the L7.processGets advanced server setting on the Network Monitor Server
true (which is the default).
2 Change the PacketCapture.DISCARD_HTTP_GET advanced server setting on the
Network Monitor Server from the default setting of true to false.
3 Reduce the size of the L7.minSizeofGetURL advanced server setting on the Network
Monitor Server from the default of 100. Reduce it to a number of bytes smaller than the
length of the shortest URL from which you want to process GET commands. A minimum
URL size of 10 should cover all cases. Note, however, that reducing the minimum size of
GETs increases the number of requests that have to be processed, which increases the
server's traffic load.

Note: Network Monitoronly inspects HTTP GET requests; it does not inspect HTTP GET
responses.

See “Enabling GET processing for Network Prevent for Web” on page 1516.

Creating a policy for Network Monitor

For Network Monitor, you can create the policies that include any of the standard response
rules. To set up a response rule action, go to Manage > Policies > Response Rules and click
Add Response Rules.
See “Workflow for implementing policies” on page 337.
To create a test policy for Network Monitor
1 In the Enforce Server administration console, create a response rule that includes one of
the actions that applies to Network Monitor. For example, create a response rule that
includes the All: Set Status action.
See “Configuring response rules” on page 1221.
2 Create a policy that incorporates the response rule you configured in the previous step.
For example, create a policy called Test Policy as follows:
■ Include a Content Matches Keyword detection rule that matches on the keyword
test_dlp_secret_keyword.

■ Include an All: Set Status response rule.

■ Associate it with the Default policy group.
See “Adding a new policy or policy template” on page 375.
See “Configuring policies” on page 376.
 Implementing Network Monitor 1495
Testing Network Monitor

Testing Network Monitor

You can test Network Monitor by sending an email that violates your test policy.
To test your system
1 Access an email account that routes messages through the MTA.
2 Send an email that contains confidential data. For example, send an email that contains
the keyword test_dlp_secret_keyword.
3 In the Enforce Server administration console, go to Incidents > Network and click
Incidents - New. Look for the resulting incident. For example, search for an incident entry
that includes the appropriate timestamp and policy name.
4 Click on the relevant incident entry to see the complete incident snapshot.
See “About Symantec Data Loss Prevention reports” on page 1352.
See “Configuring the Network Monitor Server” on page 1492.
See “Creating a policy for Network Monitor” on page 1494.
 Chapter 54
Implementing Network
Prevent for Email
This chapter includes the following topics:

■ Implementing Network Prevent for Email

■ About Mail Transfer Agent (MTA) integration

■ Configuring Network Prevent for Email Server for reflecting or forwarding mode

■ Specifying one or more upstream mail transfer agents (MTAs)

■ Creating a policy for Network Prevent for Email

■ About policy violation data headers

■ Enabling policy violation data headers

■ Testing Network Prevent for Email

Implementing Network Prevent for Email

Network Prevent for Email monitors and analyzes outbound email traffic in-line and (optionally)
blocks, redirects, or modifies email messages as specified in your policies. Network Prevent
for Email integrates with industry-standard mail transfer agents (MTAs) and hosted email
services to let you monitor and stop data loss incidents over SMTP. Policies that are deployed
on the Network Prevent for Email Server direct the Prevent-integrated MTA or hosted mail
server. The Prevent-integrated mail server blocks, reroutes, and alters email messages based
on specific content or other message attributes.
 Implementing Network Prevent for Email 1497
Implementing Network Prevent for Email

Note: Review the Symantec Data Loss Prevention MTA Integration Guide for Network Prevent
for Email to determine your preferred integration architecture before you continue with the
implementation.

Figure 54-1 shows an integration of Network Prevent for Email Server with a next-hop MTA
that you manage in the network. As an alternative, you can integrate Network Prevent for Email
Server with a hosted mail server that resides outside the firewall.

Figure 54-1 A basic Network Prevent for Email setup

First, you need to know the high-level steps that are required for implementing Network Prevent
for Email. You can check the cross-referenced sections for more details.
To implement Network Prevent for Email
1 Choose an integration architecture and configure your Mail Transfer Agent (MTA) to work
with the Network Prevent for Email Server.
See “About Mail Transfer Agent (MTA) integration” on page 1498.
2 Configure the Network Prevent for Email Server to work within your chosen integration
architecture.
See “Configuring Network Prevent for Email Server for reflecting or forwarding mode”
on page 1498.
 Implementing Network Prevent for Email 1498
About Mail Transfer Agent (MTA) integration

3 If you plan to encrypt or quarantine email messages, configure the necessary third-party
encryption server(s) or archiving servers. For details, see your product’s documentation.
4 Create and deploy a policy for Network Prevent for Email.
See “Creating a policy for Network Prevent for Email” on page 1505.
5 Test the system by generating an incident against your test policy.
See “Testing Network Prevent for Email” on page 1508.

About Mail Transfer Agent (MTA) integration

Choose an integration architecture and configure your Mail Transfer Agent (MTA) to work with
the Network Prevent for Email Server.
Review the Symantec Data Loss Prevention MTA Integration Guide for Network Prevent for
Email. Familiarize yourself with the compatible integration architectures.
The Network Prevent for Email Server can operate with your MTA in either reflecting or
forwarding modes:
■ Reflecting mode. In reflecting mode, the Network Prevent for Email Server receives
messages from an MTA. It analyzes them, and then returns them to the same MTA (with
instructions to block the messages or process them downstream). In essence, the server
returns messages to the same IP address from which they arrived.
■ Forwarding mode. In forwarding mode, the Network Prevent for Email Server receives
messages from an upstream MTA. It analyzes them, and then sends them on to a
downstream MTA or hosted email service provider. You can specify a list of IP addresses
or host names for the next-hop mail server in the Network Prevent for Email Server
configuration.
You can also configure a single Network Prevent for Email Server to work with multiple MTAs.
See “Specifying one or more upstream mail transfer agents (MTAs)” on page 1504.

Configuring Network Prevent for Email Server for

reflecting or forwarding mode
Use the following instructions to configure Network Prevent for Email Server to operate either
in reflecting or forwarding mode.
 Implementing Network Prevent for Email 1499
Configuring Network Prevent for Email Server for reflecting or forwarding mode

To configure the Network Prevent for Email Server

1 Log on to the Enforce Server administration console for the Symantec Data Loss Prevention
system you want to configure.
2 Select System > Servers and Detectors > Overview to display the list of configured
servers.
3 Click the name of the Network Prevent for Email Server that you want to configure.
4 Click Configure.
5 Deselect Trial Mode to enable blocking of email messages that are found to violate
Symantec Data Loss Prevention policies.
 Implementing Network Prevent for Email 1500
Configuring Network Prevent for Email Server for reflecting or forwarding mode

6 Configure reflecting mode or forwarding mode by modifying the following fields:

Field Description

Next Hop Configuration Select Reflect to operate Network Prevent for

Email Server in reflecting mode. Select Forward
to operate in forwarding mode.
Note: If you select Forward you must also select
Enable MX Lookup or Disable MX Lookup to
configure the method used to determine the
next-hop MTA.

Enable MX Lookup This option applies only to forwarding mode

configurations.

Select Enable MX Lookup to perform a DNS

query on a domain name to obtain the mail
exchange (MX) records for the server. Network
Prevent for Email Server uses the returned MX
records to select the address of the next hop mail
server.

If you select Enable MX Lookup, also add one

or more domain names in the Enter Domains
text box. For example:

companyname.com

Network Prevent for Email Server performs MX

record queries for the domain names that you
specify.
Note: You must include at least one valid entry
in the Enter Domains text box to successfully
configure forwarding mode behavior.
 Implementing Network Prevent for Email 1501
Configuring Network Prevent for Email Server for reflecting or forwarding mode

Field Description

Disable MX Lookup This field applies only to forwarding mode

configurations.

Select Disable MX Lookup if you want to specify

the exact host name or IP address of one or more
next-hop MTAs. Network Prevent for Email
Server uses the host names or addresses that
you specify and does not perform an MX record
lookup.

If you select Disable MX Lookup, also add one

or more host names or IP addresses for next-hop
MTAs in the Enter Hostnames text box. You can
specify multiple entries by placing each entry on
a separate line. For example:

smtp1.companyname.com
smtp2.companyname.com
smtp3.companyname.com

Network Prevent for Email Server always tries to

proxy to the first MTA that you specify in the list.
If that MTA is not available, Network Prevent for
Email Server tries the next available entry in the
list.
Note: You must include at least one valid entry
in the Enter Hostnames text box to successfully
configure forwarding mode behavior.

7 Click Save.
 Implementing Network Prevent for Email 1502
Configuring Network Prevent for Email Server for reflecting or forwarding mode

8 Click Server Settings to verify or configure these advanced settings:

Field Description

RequestProcessor.ServerSocketPort Ensure that this value matches the number of

the SMTP Listener port to which the upstream
MTA sends email messages. The default is
10025.
Note: Many Linux systems restrict ports below
1024 to root access. Network Prevent for Email
cannot bind to these restricted ports. If the
computer receives mail for inspection on a
restricted port (for example, port 25), reconfigure
the computer to route traffic from the restricted
port to the non-restricted Network Prevent for
Email port (port 10025 by default).

See “Configuring Linux IP tables to reroute traffic

from a restricted port” on page 1503.

RequestProcessor.MTAResubmitPort Ensure that this value matches the number of

the SMTP Listener port on the upstream MTA to
which the Network Prevent for Email Server
returns mail. The default is 10026.

RequestProcessor.AddDefaultHeader By default, Network Prevent for Email Server

uses a header to identify all email messages that
it has processed. The header and value are
specified in the
RequestProcessor.DefaultPassHeader field.

Change the value of this field to false if you do

not want to add a header to each message.

RequestProcessor.AddDefaultPassHeader This field specifies the header and value that

Network Prevent for Email Server adds to each
email message that it processes. The default
header and value is X-CFilter-Loop:
Reflected. Change the value of this field if you
want to add a different header to each processed
message.

If you do not want to add a header to each email

message, set the AddDefaultPassHeader field
to False.
 Implementing Network Prevent for Email 1503
Configuring Network Prevent for Email Server for reflecting or forwarding mode

Note: Always configure both RequestProcessor.ServerSocketPort and

RequestProcessor.MTAResubmitPort, whether you implement reflecting or forwarding
mode. With forwarding mode, RequestProcessor.ServerSocketPort specifies the SMTP
Listener port on the detection server to which the upstream MTA sends email messages.
RequestProcessor.MTAResubmitPort is the SMTP Listener port on the downstream
MTA to which the detection server sends email messages.

9 Click Save.
10 Click Done.
11 If your email delivery system uses TLS communication in forwarding mode, each next-hop
mail server in the proxy chain must support TLS and must authenticate itself to the previous
hop. This means that Network Prevent for Email Server must authenticate itself to the
upstream MTA, and the next-hop MTA must authenticate itself to Network Prevent for
Email Server. Proper authentication requires that each mail server stores the public key
certificate for the next hop mail server in its local keystore file.

See “Specifying one or more upstream mail transfer agents (MTAs)” on page 1504.
See “Creating a policy for Network Prevent for Email” on page 1505.
See “Testing Network Prevent for Email” on page 1508.

Configuring Linux IP tables to reroute traffic from a restricted port

Many Linux systems restrict ports below 1024 to root access. Network Prevent for Email cannot
bind to these restricted ports.
If the computer receives mail for inspection on a restricted port (for example, port 25), use the
iptables command to route that traffic to a non-restricted port, such as the Network Prevent
for Email default port 10025. Then ensure that Network Prevent for Email listens on the
non-restricted port to inspect email.
Use the following instructions to configure a Linux system to route from port 25 to port 10025.
If you use a different restricted port or Network Prevent for Email port, enter the correct values
in the iptables commands.
 Implementing Network Prevent for Email 1504
Specifying one or more upstream mail transfer agents (MTAs)

To configure route traffic from port 25 to port 10025

1 Configure Network Prevent for Email to use the default port 10025 if necessary.
See “Configuring Network Prevent for Email Server for reflecting or forwarding mode”
on page 1498.
2 In a terminal window on the Network Prevent for Email computer, enter the following
commands to reroute traffic from port 25 to port 10025:

iptables -N Vontu-INPUT
iptables -A Vontu-INPUT -s 0/0 -p tcp --dport 25 -j ACCEPT
iptables -I INPUT 1 -s 0/0 -p tcp -j Vontu-INPUT
iptables -t nat -I PREROUTING -p tcp --destination-port 25 -j REDIRECT --to-ports=10025
iptables-save > /etc/sysconfig/iptables

Note: If you only want to test local IP routing between the ports with Telnet, use the
command: iptables -t nat -I OUTPUT -o lo -p tcp --destination-port 25 -j
REDIRECT --to-ports=10025

If later you decide to delete the IP tables entry, use the command:

iptables -t nat -D OUTPUT -o lo -p tcp --destination-port 25 -j REDIRECT --to-ports=10025

Specifying one or more upstream mail transfer agents

(MTAs)
By default, Network Prevent for Email Server can accept connections to the ESMTP service
port from any system on the network. You can restrict Network Prevent for Email Server ESMTP
communication to a designated set of mail transfer agents (MTAs) for security reasons. Create
a “whitelist” of authorized systems. If you whitelist one or more systems, other systems that
are not on the whitelist cannot connect to the Network Prevent for Email Server ESMTP service
port.
Note that an MTA whitelist might be affected by the RequestProcessor.BindAddress setting.
By default, the RequestProcessor.BindAddress setting is 0.0.0.0, and the listener binds to
all available addresses. If RequestProcessor.BindAddress instructs the listener to bind to a
specific IP, a white listed MTA must also be able to reach the listener address.
 Implementing Network Prevent for Email 1505
Creating a policy for Network Prevent for Email

To create a whitelist of systems allowed to communicate with the Network Prevent for Email
Server:
1 Go to System > Servers and Detectors > Overview and click on the wanted Network
Prevent for Email Server.
2 On the Server/Detector Detail screen that appears, click Server Settings.
3 Scroll down to the RequestProcessor.AllowHosts field.
By default, RequestProcessor.AllowHosts is set to any, meaning that all other systems
on the network can communicate with this Network Prevent for Email Server.
4 You can limit the systems that are allowed to connect with this Network Prevent for Email
Server. Delete any and enter the IP addresses or FQDN of the systems you want to
authorize. Separate multiple addresses with commas. For example:
“123.14.251.31,smtp_1.corp.mycompany.com,123.14.223.111.” Separate addresses
only with commas; do not include spaces.
5 Click Save.
Changes to this setting do not take effect until you restart the server.

Creating a policy for Network Prevent for Email

You can create the policies that include any of the standard response rules. For example, Add
Comment, Limit Incident Data Retention, Log to a Syslog Server, Send Email Notification, and
Set Status.
See “Workflow for implementing policies” on page 337.
You can also incorporate the following rules, which are specific to Network Prevent for Email:
■ Network: Block SMTP Message
Blocks the email messages that contain confidential data or significant metadata (as defined
in your policies). You can configure Symantec Data Loss Prevention to bounce the message
or redirect the message to a specified address.
The redirect feature is typically used to reroute messages to the address of a mailbox or
mail list. Administrators and managers use the mailbox or list to review and release
messages. Such mailboxes are outside the Symantec Data Loss Prevention system.
■ Network: Modify SMTP Message
Modifies the email messages that contain confidential data or significant metadata (as
defined in your policies). You can use this action to modify the message subject or add
specific RFC 5322 message headers to trigger further downstream processing. For example,
message encryption, message quarantine, or message archiving.
For details on setting up any response rule action, open the online Help. Go to Manage >
Policies > Response Rules and click Add Response Rule.
 Implementing Network Prevent for Email 1506
About policy violation data headers

For details on using the Network: Modify SMTP Message action to trigger downstream
processes (such as message encryption), see the Symantec Data Loss Prevention MTA
Integration Guide for Network Prevent.
Even if you do not incorporate response rules into your policy, Network Prevent for Email
captures incidents as long as your policies contain detection rules. This feature can be useful
if you want to review the types of incidents Symantec Data Loss Prevention captures and to
then refine your policies.
To create a test policy for Network Prevent for Email
1 In the Enforce Server administration console, create a response rule that includes one of
the actions specific to Network Prevent for Email. For example, create a response rule
that includes the Network: Block SMTP Message action.
See “Configuring response rules” on page 1221.
2 Create a policy that incorporates the response rule you configured in the previous step.
For example, create a policy called Test Policy as follows:
■ Include a Content Matches Keyword detection rule that matches on the keyword
secret.
■ Include a Network: Block SMTP Message response rule.
■ Associate it with the Default policy group.
See “Configuring policies” on page 376.
See “About policy violation data headers” on page 1506.

About policy violation data headers

A message might violate more than one policy. You can add special headers to the outgoing
messages that report the number and severity of policies the message violates. Three different
kinds of violation-data headers are available:
■ Number of violated policies—a header can be added reporting the total number of different
policies that the message violates.
■ Highest severity—a header can be added reporting the single highest severity level among
all policies that the message violates (High, Medium, Low, or Info).
■ Cumulative severity score—a header can be added reporting a total severity score which
is the numeric sum of all policy violations. For this purpose, severity levels are assigned
numeric values: High=4, Medium=3, Low=2, and Info=1. Thus, a message that violates
both a Low (2) and Medium (3) severity policy has a total severity score of 5.
You can use headers to trigger downstream responses that are based on the number of
violations or the severity of violations. For example:
 Implementing Network Prevent for Email 1507
Enabling policy violation data headers

■ Messages that violate a single policy can be routed to one quarantine mailbox. Messages
that violate multiple policies can be routed to a second mailbox. Messages that violate over
a specified number of policies can be routed to a third mailbox.
■ Messages that violate multiple policies can be handled differently according to the severity
level of the most serious violation.
■ Messages that violate multiple policies can be handled differently according to the total
severity score of the message.
See “Enabling policy violation data headers” on page 1507.

Enabling policy violation data headers

Three multiple-policy headers can be used in combination.
To enable policy violation message headers:
1 Go to System > Servers and Detectors > Overview and click on the wanted Network
Prevent for Email Server.
2 On the Server/Detector Detail screen that appears, click Server Settings.
3 Scroll down to one of the three following RequestProcessor settings. By default, the
value for these settings is false.
4 Change the value to true.
5 Click Save.
Changes to these settings do not take effect until you restart the server.
Three RequestProcessor advanced settings enable different kinds of multiple-policy-violation
message headers:
■ RequestProcessor.TagPolicyCount.
When the setting is set to true, Network Prevent adds a header reporting the total number
of policies that the message violates. For example, if the message violates 3 policies a
header reading: “X-DLP-Policy-Count: 3” is added.
■ RequestProcessor.TagHighestSeverity.
When the setting is set to true, Network Prevent adds a header reporting the highest severity
among the violated policies. For example, if a message violates three policies, one with a
severity of “Medium” and two with a severity of “Low” a header reading:
“X-DLP-Max-Severity: MEDIUM” is added.
■ RequestProcessor.TagScore.
When the setting is set to true, Network Prevent adds a header reporting the total cumulative
score of all the violated policies. Scores are calculated using the formula: High=4, Medium=3,
 Implementing Network Prevent for Email 1508
Testing Network Prevent for Email

Low=2, and Info=1. For example, if a message violates three policies, one with a severity
of “medium” and two with a severity of “low” a header reading: “X-DLP-Score: 7” is added.
Setting a value to “true” causes the corresponding header to be automatically added to every
outgoing message that is processed. This occurs even if the message violates only a single
policy.
See “About policy violation data headers” on page 1506.

Testing Network Prevent for Email

You can test Network Prevent for Email by sending an email that violates your test policy.
To test your system
1 Access an email account that routes messages through an MTA that is integrated with
your Network Prevent for Email Server.
2 Send an email that contains confidential data. For example, send an email that contains
the word Secret.
3 In the Enforce Server administration console, go to Incident > Network and click Incidents
- All. Look for the resulting incident. For example, search for an incident entry that includes
the appropriate timestamp and policy name.
4 Click on the relevant incident entry to see the complete incident snapshot.
See “About Symantec Data Loss Prevention reports” on page 1352.
 Chapter 55
Implementing Network
Prevent for Web
This chapter includes the following topics:

■ Implementing Network Prevent for Web

■ Configuring Network Prevent for Web Server

■ About proxy server configuration

■ Specifying one or more proxy servers

■ Enabling GET processing for Network Prevent for Web

■ Creating policies for Network Prevent for Web

■ Testing Network Prevent for Web

■ Troubleshooting information for Network Prevent for Web Server

Implementing Network Prevent for Web

The Network Prevent for Web Server integrates with an HTTP, HTTPS, or FTP proxy server
using ICAP for in-line active Web request management. If it detects confidential data in Web
content, it causes the proxy to reject requests or remove HTML content as specified in your
policies.
 Implementing Network Prevent for Web 1510
Implementing Network Prevent for Web

Figure 55-1 A basic Network Prevent for Web setup

First, you need to know the high-level steps that are required for implementing Network Prevent
for Web. You can check the cross-referenced sections for more details.
To implement Network Prevent for Web
1 Make sure the Network Prevent for Web Server is configured to communicate with your
HTTP proxy server. Optionally, configure the detection server to filter traffic as wanted.
See “Configuring Network Prevent for Web Server” on page 1511.
2 Configure your HTTP proxy server to work with the Network Prevent for Web Server.
See “About proxy server configuration” on page 1514.
3 Create and deploy a policy for Network Prevent for Web.
See “Creating policies for Network Prevent for Web” on page 1517.
4 Test the system by generating an incident against your test policy.
See “Testing Network Prevent for Web” on page 1519.
5 If required, troubleshoot the implementation.
See “Troubleshooting information for Network Prevent for Web Server” on page 1519.
 Implementing Network Prevent for Web 1511
Configuring Network Prevent for Web Server

Configuring Network Prevent for Web Server

You can use a number of configuration options for Network Prevent for Web Server. For
example, you can configure the server to:
■ Ignore small HTTP requests or responses.
■ Ignore requests to, or responses, from a particular host or domain (such as the domain of
a business subsidiary).
■ Ignore user search engine queries.
To modify your Network Prevent for Web server configuration
1 Go to System > Servers and Detectors > Overview and click the Network Prevent for
Web Server.
2 On the Server/Detector Detail screen that appears, click Configure.
You can verify or modify settings on the ICAP tab as described in subsequent steps. The
tab is divided into several sections: Request Filtering, Response Filtering, and
Connection.
3 Verify or change the Trial Mode setting. Trial Mode lets you test prevention without
blocking requests in real time. If you select Trial Mode, Symantec Data Loss Prevention
detects incidents and indicates that it has blocked an HTTP communication, but it does
not block the communication.

4 Verify or modify the filter options for requests from HTTP clients (user agents). The options
in the Request Filtering section are as follows:
Ignore Requests Smaller Than
Ignore Requests without Attachments
Ignore Requests to Hosts or Domains
Ignore Requests from User Agents
Implementing Network Prevent for Web 1512
Configuring Network Prevent for Web Server
Specifies the minimum body size of HTTP
requests to inspect. (The default is 4096 bytes.)
For example, search-strings typed in to search
engines such as Yahoo or Google are usually
short. By adjusting this value, you can exclude
those searches from inspection.
Causes the server to inspect only the requests
that contain attachments. This option can be
useful if you are mainly concerned with requests
intended to post sensitive files.
Causes the server to ignore requests to the hosts
or domains you specify. This option can be useful
if you expect a lot of HTTP traffic between the
domains of your corporate headquarters and
branch offices. You can type one or more host
or domain names (for example,
www.company.com), each on its own line.
Causes the server to ignore requests from user
agents (HTTP clients) you specify. This option
can be useful if your organization uses a program
or language (such as Java) that makes frequent
HTTP requests. You can type one or more user
agent values, each on its own line.
 Implementing Network Prevent for Web 1513
Configuring Network Prevent for Web Server

5 Verify or modify the filter options for responses from Web servers. The options in the
Response Filtering section are as follows:

Ignore Responses Smaller Than Specifies the minimum size of the body of HTTP
responses that are inspected by this server.
(Default is 4096 bytes.)

Inspect Content Type Specifies the MIME content types that Symantec
Data Loss Prevention should monitor in
responses. By default, this field contains
content-type values for Microsoft Office, PDF,
and plain text formats. To add others, type one
MIME content type per line. For example, type
application/word2013 to have Symantec
Data Loss Prevention analyze Microsoft Word
2013 files.

Note that it is generally more efficient to specify

MIME content types at the Web proxy level.

Ignore Responses from Hosts or Domains Causes the server to ignore responses from the
hosts or domains you specify. You can type one
or more host or domain names (for example,
www.company.com), each on its own line.

Ignore Responses to User Agents Causes the server to ignore responses to user
agents (HTTP clients) you specify. You can type
one or more user agent values, each on its own
line.
 Implementing Network Prevent for Web 1514
About proxy server configuration

6 Verify or modify settings for the ICAP connection between the HTTP proxy server and the
Web Prevent Server. The Connection options are as follows:

TCP Port Specifies the TCP port number over which this
server listens for ICAP requests. This number
must match the value that is configured on the
HTTP proxy that sends ICAP requests to this
server. The recommended value is 1344.

Maximum Number of Requests Specifies the maximum number of simultaneous

ICAP request connections from the HTTP proxy
or proxies. The default is 25.

Maximum Number of Responses Specifies the maximum number of simultaneous

ICAP response connections from the HTTP proxy
or proxies. The default is 25.

Connection Backlog Specifies the number of waiting connections

allowed. A waiting connection is a user waiting
for an HTTP response from the browser. The
minimum value is 1. If the HTTP proxy gets too
many requests (or responses), the proxy handles
them according to your proxy configuration. You
can configure the HTTP proxy to block any
requests (or responses) greater than this number.

7 Click Save to exit the Configure Server screen and then click Done to exit the Server
Detail screen.

About proxy server configuration

You must configure at least one HTTP proxy server to forward Web requests or responses to
the Network Prevent for Web Server. The HTTP proxy acts as an ICAP client to the Network
Prevent for Web Server. Symantec Data Loss Prevention supports both the request modification
(REQMOD) and response modification (RESPMOD) modes of ICAP. If you want to analyze
requests as well as responses, use one Network Prevent for Web Server to analyze requests.
Use a second Network Prevent for Web Server to analyze responses.
Note that most proxy servers provide methods of filtering what is forwarded to the Network
Prevent for Web Server in both REQMOD mode and RESPMOD modes. Consult the proxy
server's documentation for details.
See “Specifying one or more proxy servers” on page 1516.
See “Configuring request and response mode services” on page 1515.
 Implementing Network Prevent for Web 1515
About proxy server configuration

Configuring request and response mode services

For details on configuring the proxy server, refer to your proxy server product documentation,
or contact your proxy server administrator.
To configure a proxy server:
1 REQMOD. On your proxy server, create an ICAP REQMOD service that forwards requests
to the Network Prevent for Web Server. If your proxy server supports different protocols,
configure it to handle the wanted protocols.
For REQMOD mode, an ICAP service on the proxy server should look like:

icap://ip_address|FQDN[:port]/reqmod

2 RESPMOD. On your proxy server, create an ICAP RESPMOD service that forwards
responses to the Network Prevent for Web Server. If your proxy server supports different
protocols, configure it to handle the wanted protocols.
For RESPMOD mode, an ICAP service on the proxy server should look like:

icap://ip_address|FQND[:port]/respmod

Where:
■ ip_address|FQDN identifies the Network Prevent for Web Server using either an IP address
or fully qualified domain name.
■ Port is the port number to which Network Prevent for Web Server listens. Specifying the
port number is optional when the default ICAP port (1344) is used.
■ /reqmod is required for correct functionality in REQMOD mode.

■ /respmod is required for correct functionality in RESPMOD mode.

Examples:

icap://10.66.194.45/reqmod
icap://10.66.194.45:1344/reqmod
icap://netmonitor1.company.com/reqmod
icap://10.66.194.45/respmod
icap://10.66.194.45:1344/respmod
icap://netmonitor1.company.com/respmod

Note that the port that is specified in the ICAP service definition on the proxy must match the
port on which Network Prevent for Web Server listens.
See “About proxy server configuration” on page 1514.
 Implementing Network Prevent for Web 1516
Specifying one or more proxy servers

Specifying one or more proxy servers

By default, Network Prevent for Web Server can accept connections to the ICAP service port
from any system on the network. For security reasons, you can limit ICAP connections to only
those systems that you designate (or “whitelist”). Once you whitelist one or more systems,
systems not on the whitelist cannot connect to the Network Prevent for Web Server ICAP
service port.
Note that a proxy server whitelist can be affected by the Icap.BindAddress setting. By default,
the Icap.BindAddress settings is 0.0.0.0, and the listener binds to all available addresses. If
Icap.BindAddress instructs the listener to bind to a specific IP, a white listed proxy must also
be able to reach the listener address.
To create a whitelist of systems allowed to make a connection to the Network Prevent for Web
server ICAP service port:
1 Go to System > Servers and Detectors > Overview and click on the wanted Network
Prevent for Web Server.
2 On the Server/Detector Detail screen that appears, click Server Settings.
3 Scroll down to the Icap.AllowHosts setting.
By default, Icap.AllowHosts is set to any, meaning that all other systems on the network
can communicate with this Network Prevent for Web Server.
4 You can limit the systems that are allowed to connect with this Network Prevent for Web
Server. Delete any and enter the IP addresses or Fully-Qualified Domain Name (FQDN)
of the systems you want to authorize.
Separate multiple addresses with commas. For example:
123.14.251.31,webcache.corp.mycompany.com,123.14.223.111. Use only commas to
separate multiple entries; do not include spaces.
5 Click Save.
Changes to this setting do not take effect until you restart the server.
See “About proxy server configuration” on page 1514.

Enabling GET processing for Network Prevent for Web

By default, Network Prevent for Web does not process HTTP GET commands because of the
high traffic volume. Follow this procedure to enable the server to process GET commands.
 Implementing Network Prevent for Web 1517
Creating policies for Network Prevent for Web

To enable GET processing with Network Prevent for Web

1 Configure the Web proxy server to forward GET requests to the Network Prevent for Web
Server as described in your proxy server documentation.
2 Ensure that the L7.processGets advanced server setting on the Network Prevent for
Web Server must be “true” (which is the default).
3 Reduce the size of the L7.minSizeofGetURL Advanced setting on the Network Prevent
for Web Server. Reduce from the default of 100 to a number of bytes smaller than the
length of the shortest Web site URL from which you want to process GET commands. A
minimum URL size to 10 should cover all cases. Note, however, that reducing the minimum
size of GETs increases the number of requests that have to be processed, which increases
the server traffic load.
4 Adjust the Ignore Requests Smaller Than setting in the ICAP section of the Network
Prevent for Web Server Detail page. Reduce it from the default of 4096 bytes to a lower
value that would enable the request to undergo DLP inspection. Note, however, that
lowering the value increases the server traffic load.
See “Enabling GET processing with Network Monitor” on page 1493.

Creating policies for Network Prevent for Web

You can create the policies that include any of the standard response rules. For example, Add
Comment, Limit Incident Data Retention, Log to a Syslog Server, Send Email Notification, and
Set Status.
See “About Symantec Data Loss Prevention reports” on page 1352.
You can also incorporate the rules that are specific to Network Prevent for Web Server as
follows:
■ Network Prevent: Block HTTP/HTTPS
Blocks posts that contain confidential data (as defined in your policies). This includes Web
postings, Web-based email messages, and files that are uploaded to Web sites or attached
to Web-based email messages.
 Implementing Network Prevent for Web 1518
Creating policies for Network Prevent for Web

Note: Certain applications may not provide an adequate response to the Network Prevent:
Block HTTP/HTTPS response action. This behavior has been observed with the Yahoo!
Mail application when a detection server blocks a file upload. If a user tries to upload an
email attachment and the attachment triggers a Network Prevent: Block HTTP/HTTPS
response action, Yahoo! Mail does not respond or display an error message to indicate
that the file is blocked. Instead, Yahoo! Mail appears to continue uploading the selected
file, but the upload never completes. The user must manually cancel the upload at some
point by pressing Cancel.
Other applications may also exhibit this behavior, depending on how they handle the block
request. In these cases a detection server incident is created and the file upload is blocked
even though the application provides no such indication.

■ Network Prevent: Remove HTTP/HTTPS Content

Removes confidential data from posts that contain confidential data (as defined in your
policies). This includes Web-based email messages and files that are uploaded to Web
sites or attached to Web-based email messages. Note that the Remove HTTP/HTTPS
Content action works only on requests.
■ Network Prevent: Block FTP Request
Blocks FTP transfers that contain confidential data (as defined in your policies).
For details on setting up any response rule action, open the online Help. Go to Manage >
Policies > Response Rules and click Add Response Rule.
Even if you do not incorporate response rules into your policy, Network Prevent for Web
captures incidents as long as your policies contain detection rules. You can set up such policies
to monitor Web and FTP activity on your network before implementing the policies that block
or remove content.
If you have configured your proxy to forward both HTTP/HTTPS requests and responses, your
policies work on both. For example, policies are applied to both an upload to a Web site and
a download from a Web site.
To create a test policy for Network Prevent for Web
1 In the Enforce Server administration console, create a response rule that includes one of
the actions specific to Network Prevent for Web. For example, create a response rule that
includes the Network Prevent: Block HTTP/HTTPS action.
See “Configuring response rules” on page 1221.
2 Create a policy that incorporates the response rule you configured in the previous step.
For example, create a policy called Test Policy as follows:
■ Include a Content Matches Keyword detection rule that matches on the keyword
secret.
 Implementing Network Prevent for Web 1519
Testing Network Prevent for Web

■ Include a Network Prevent: Block HTTP/HTTPS response rule.

■ Associate it with the Default policy group.
See “Configuring policies” on page 376.

Testing Network Prevent for Web

You can test Network Prevent for Web by sending a Web email that violates your test policy.
To test your system
1 Open a browser that accesses the Internet through your HTTP proxy server.
2 In the browser, access a test Web email account and send an email with an attachment
containing confidential data. For example, access an account in Hotmail and send an
email with an attachment containing the word Secret and paragraphs of other text.
3 In the Enforce Server administration console, go to Incidents > Network and click
Incidents - All. Look for the resulting incident. For example, search for an incident entry
that includes the appropriate timestamp and policy name.
4 Click on the relevant incident entry to see the complete incident snapshot.
See “About strategies for using reports” on page 1353.

Troubleshooting information for Network Prevent for

Web Server
The following table describes a common problem when using Network Prevent for Web Server
and suggests a possible solution.

Table 55-1 Troubleshooting

Problem Possible Solution

Incidents appear in Network reports, but Symantec This is expected behavior when the Network
Data Loss Prevention does not perform the action Prevent for Web Server is running in trial mode (the
specified in the relevant response rule. default setting). If you do not want to run in trial
mode, change the setting.

See “Configuring Network Prevent for Web Server”

on page 1511.
 Section 8
Discovering where
confidential data is stored

■ Chapter 56. About Network Discover

■ Chapter 57. Setting up and configuring Network Discover

■ Chapter 58. Network Discover scan target configuration options

■ Chapter 59. Managing Network Discover target scans

■ Chapter 60. Using Server FlexResponse plug-ins to remediate incidents

■ Chapter 61. Setting up scans of Box cloud storage using an on-premises detection server

■ Chapter 62. Setting up scans of file shares

■ Chapter 63. Setting up scans of Lotus Notes databases

■ Chapter 64. Setting up scans of SQL databases

■ Chapter 65. Setting up scans of SharePoint servers

■ Chapter 66. Setting up scans of Exchange servers

■ Chapter 67. About Network Discover scanners

■ Chapter 68. Setting up scanning of file systems

 Discovering where confidential data is stored 1521

■ Chapter 69. Setting up scanning of Web servers

■ Chapter 70. Setting up scanning of Documentum repositories

■ Chapter 71. Setting up scanning of Livelink repositories

■ Chapter 72. Setting up Web Services for custom scan targets

 Chapter 56
About Network Discover
This chapter includes the following topics:

■ About Network Discover/Cloud Storage Discover

■ How Network Discover/Cloud Storage Discover works

About Network Discover/Cloud Storage Discover

Network Discover/Cloud Storage Discover locates exposed confidential data by scanning a
broad range of enterprise data repositories. These data repositories include Box cloud storage,
file servers, databases, Microsoft SharePoint, IBM (Lotus) Notes, Documentum, OpenText
(Livelink), Microsoft Exchange, Web servers, and other data repositories.
Network Discover/Cloud Storage Discover can scan the following data sources:
■ Box cloud storage
See “Setting up scans of Box cloud storage targets using an on-premises detection server”
on page 1595.
■ Network file shares (CIFS, NFS, or DFS)
See “Setting up server scans of file systems” on page 1601.
■ Local file systems on Windows desktops and laptops
Local file systems on Windows, Linux, AIX, and Solaris servers
See “Setting up remote scanning of file systems” on page 1668.
■ IBM (Lotus) Notes Databases
See “Setting up server scans of IBM (Lotus) Notes databases” on page 1622.
■ SQL Databases
See “Setting up server scans of SQL databases” on page 1628.
■ Microsoft SharePoint servers
See “Setting up server scans of SharePoint servers” on page 1636.
 About Network Discover 1523
How Network Discover/Cloud Storage Discover works

■ Microsoft Exchange Servers

See “Setting up server scans of Exchange repositories” on page 1650.
■ Documentum
See “Setting up remote scanning of Documentum repositories” on page 1691.
■ OpenText (Livelink)
See “Setting up remote scanning of OpenText (Livelink) repositories” on page 1699.
■ Web servers (Web sites and Web-based applications)
See “Setting up remote scanning of web servers” on page 1680.
■ Custom
Web services expose a custom integration point. You can write custom code to scan any
repository. The custom code crawls the repository and feeds the content to a Network
Discover/Cloud Storage Discover Server for scanning. Custom applications and repositories
can be scanned with Web services.
See “Setting up Web Services for custom scan targets” on page 1707.
You can use Veritas Data Insight in conjunction with Network Discover to add rich capabilities
to your Symantec Data Loss Prevention deployment. With Veritas Data Insight, you can monitor
file access and automatically identify the data user of a file based on the access history. The
usage information then automatically feeds into the incident detail of files that violate Symantec
Data Loss Prevention policies. This enables you to identify sensitive data along with the
responsible users to enable more efficient remediation and data management.
See the Symantec Data Loss Prevention Data Insight Implementation Guide.
The FlexResponse Platform further extends the capabilities of Network Discover. The
FlexResponse Platform enables the creation of comprehensive custom remediation actions
for the files that are discovered using Symantec Data Loss Prevention Network Discover.
FlexResponse supports Symantec and third-party file security solutions including Enterprise
Digital Rights Management and encryption. FlexResponse is an extension of the Network
Protect product, and the Network Protect product is required for FlexResponse functionality.
During incident remediation, you can use the installed FlexResponse plug-ins to remediate
incidents.
See the Symantec Data Loss Prevention FlexResponse Developers Guide, or contact Symantec
Data Loss Prevention Support for a list of available plug-ins.
See “Using Server FlexResponse custom plug-ins to remediate incidents” on page 1585.

How Network Discover/Cloud Storage Discover works

The Network Discover/Cloud Storage Discover Server locates a wide range of exposed
confidential data. It communicates with the Enforce Server to obtain information about policies
 About Network Discover 1524
How Network Discover/Cloud Storage Discover works

and scan targets. It sends information about exposed confidential data that it finds to the
Enforce Server for reporting and remediation.
Figure 56-1 shows the Network Discover Server securely inside the corporate LAN.
The Network Discover/Cloud Storage Discover Server is connected to the Enforce Server and
each server performs the tasks that are related to locating exposed confidential data.
Multiple Network Discover/Cloud Storage Discover Servers can be set up to spread out the
work.
See “Adding a detection server” on page 234.
See “About grid scanning” on page 1573.
The Network Discover/Cloud Storage Discover Server scans the selected targets, reads the
files or repositories, and detects whether confidential information is present.
The Enforce Server contains the user interface where the following tasks are done:
■ Setting up target scans.
■ Selecting target repositories.
■ Defining filters for the scans.
■ Scheduling scans.
See “Adding a new Network Discover/Cloud Storage Discover target” on page 1529.
The Enforce Server also manages the scans running on the Network Discover/Cloud Storage
Discover Servers and displays the status of the scans in the user interface.
See “Managing Network Discover/Cloud Storage Discover target scans” on page 1553.
After a scan is complete, you can display the reports of the exposed confidential data on the
Enforce Server.
See “About reports for Network Discover” on page 1329.
 About Network Discover 1525
How Network Discover/Cloud Storage Discover works

Figure 56-1 Network Discover

Storage Management Network

Network
Discover Network
Monitor
Network
Protect Enforce
Platform

Endpoint

Network
Endpoint Prevent
Discover

Endpoint Oracle database

Prevent

Secured Corporate LAN DMZ

 Chapter 57
Setting up and configuring
Network Discover
This chapter includes the following topics:

■ Setting up and configuring Network Discover/Cloud Storage Discover

■ Modifying the Network Discover/Cloud Storage Discover Server configuration

■ Adding a new Network Discover/Cloud Storage Discover target

■ Editing an existing Network Discover/Cloud Storage Discover target

Setting up and configuring Network Discover/Cloud

Storage Discover
Setting up a Network Discover/Cloud Storage Discover scan target involves several steps.
Each of these steps is necessary to correctly implement Network Discover/Cloud Storage
Discover target scanning.

Table 57-1 Setting up and Configuring Network Discover

Step Action Details

1 Modify the Network See “Modifying the Network Discover/Cloud Storage Discover
Discover/Cloud Storage Server configuration” on page 1527.
Discover Server
configuration, if needed.
 Setting up and configuring Network Discover 1527
Modifying the Network Discover/Cloud Storage Discover Server configuration

Table 57-1 Setting up and Configuring Network Discover (continued)

Step Action Details

2 Create a policy group. Go to System > Servers and Detectors > Policy Groups.
On the Policy Group List screen that appears, click Add
Policy Group.

See “Creating and modifying policy groups” on page 399.

3 Create a policy. Go to Manage > Policies > Policy List on the Enforce Server.

Select Add a blank policy.

Add a rule to the policy.

See “Configuring policies” on page 376.

4 Before using Network See “About response rules” on page 1199.

Protect for a file share
Discover target, create a
response rule. Using
Network Protect is optional.

5 Create a Network Go to Manage > Discover Scanning > Discover Targets on

Discover/Cloud Storage the Enforce Server.
Discover Target.
Click New Target, and use the pull-down menu to select the
specific target type.

See “Adding a new Network Discover/Cloud Storage Discover

target” on page 1529.

6 Set options for the target. See “Network Discover/Cloud Storage Discover scan target
configuration options” on page 1532.

7 Set up reports. See “About Symantec Data Loss Prevention reports”

on page 1352.

Modifying the Network Discover/Cloud Storage

Discover Server configuration
After you have installed your Network Discover/Cloud Storage Discover Servers and registered
them with the Enforce Server, you can modify the Network Discover/Cloud Storage Discover
Server configuration.
The Network Discover/Cloud Storage Discover Server can be installed on a virtual machine.
For the supported virtual machines types, see the Symantec Data Loss Prevention System
Requirements and Compatibility Guide.
 Setting up and configuring Network Discover 1528
Modifying the Network Discover/Cloud Storage Discover Server configuration

If you have configured incremental scanning, the incremental scan index is automatically
distributed to all Discover Servers, including any new Discover Servers.
See “About incremental scans” on page 1569.
To modify a Network Discover/Cloud Storage Discover Server configuration
1 In the Enforce Server administration console, go to System > Servers and Detectors >
Overview. Then click the server to modify.
The appropriate Server/Detector Detail screen appears and displays general server
information, configuration information, deployed indexes, and recent server events.
2 Click Configure.
The Configure Server screen appears and displays configuration options for the server
type.
3 Modify the server configuration.
The following configuration options are on the General tab:
■ Name
The name of the detection server (used for displays in the Enforce Server administration
console). Changing this setting for an existing detection server affects your filter options
in Symantec Data Loss Prevention reports. Network Discover/Cloud Storage Discover
Servers are detection servers.
■ Host
The detection server host name or IP address on which the detection server listens
for connections to the Enforce Server. You might need to modify this setting when you
replace a Network Discover/Cloud Storage Discover Server host computer.
■ Port
The detection server uses the port number to accept connections from the Enforce
Server. This value must be greater than 1024. It must also match the value of the
listenPort property in the detection server’s Communication.properties file. This
file is located in SymantecDLP\Protect\config. If you change this setting, restart the
detection server after modifying the listenPort value in the
Communication.properties file. You should not need to change this setting after a
successful installation.
See “Server controls” on page 211.
 Setting up and configuring Network Discover 1529
Adding a new Network Discover/Cloud Storage Discover target

4 The configuration for parallel scanning is on the Discover tab. Enter the number of parallel
scans to run on this Network Discover/Cloud Storage Discover Server. The default is 1.
The maximum count can be increased at any time. After it is increased, then any queued
scans that are eligible to run on this Network Discover/Cloud Storage Discover Server
are started.
The count can be decreased only if the Network Discover/Cloud Storage Discover Server
has no running scans. Before you reduce the count, pause or stop all scans on the Network
Discover/Cloud Storage Discover Server.
Parallel scans of server and scanner target types are supported.
See “Configuring parallel scanning of Network Discover/Cloud Storage Discover targets”
on page 1571.
5 When you finish modifying a server configuration, click Save to exit the Configure Server
screen and then click Done to exit the Server Detail screen.
6 To view the active scans on this Network Discover/Cloud Storage Discover Server, go to
Policies > Discover Scanning > Discover Servers.
See “Managing Network Discover/Cloud Storage Discover target scans” on page 1553.

Adding a new Network Discover/Cloud Storage

Discover target
Before adding a Network Discover/Cloud Storage Discover target, you must complete the
Network Discover/Cloud Storage Discover Server setup.
See “Setting up and configuring Network Discover/Cloud Storage Discover” on page 1526.
To add a Network Discover/Cloud Storage Discover target
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click New Target, and use the pull-down menu to select the specific target type.
3 On the General tab, enter the name of this Network Discover/Cloud Storage Discover
target. This name displays for management of scans.
See “Managing Network Discover/Cloud Storage Discover target scans” on page 1553.
4 Enter the remaining required parameters. Enter the policy group. Enter the Network
Discover/Cloud Storage Discover Server.
See “Configuring the required fields for Network Discover targets” on page 1534.
 Setting up and configuring Network Discover 1530
Editing an existing Network Discover/Cloud Storage Discover target

5 Continue the addition of a new target, with the entries specific to that target type.

Box cloud storage See “Setting up scans of Box cloud storage

targets using an on-premises detection server”
on page 1595.

Network file servers and shares (CIFS, NFS, See “Setting up server scans of file systems”
DFS) on page 1601.

IBM (Lotus) Notes databases See “Setting up server scans of IBM (Lotus)
Notes databases” on page 1622.

SQL databases See “Setting up server scans of SQL databases”

on page 1628.

Local file systems on Windows desktops and See “Setting up remote scanning of file systems”
laptops on page 1668.

Local file systems on Windows, Linux, AIX, and

Solaris servers

Microsoft Exchange See “Setting up server scans of Exchange

repositories” on page 1650.

Microsoft SharePoint See “Setting up server scans of SharePoint

servers” on page 1636.

Documentum See “Setting up remote scanning of Documentum

repositories” on page 1691.

OpenText (Livelink) See “Setting up remote scanning of OpenText

(Livelink) repositories” on page 1699.

Web servers (Web sites and Web-based See “Setting up remote scanning of web servers”
applications) on page 1680.

6 Configure optional Network Discover/Cloud Storage Discover target parameters.

See “Network Discover/Cloud Storage Discover scan target configuration options”
on page 1532.

Editing an existing Network Discover/Cloud Storage

Discover target
To set various configuration options, edit the configuration of a Network Discover/Cloud Storage
Discover target.
 Setting up and configuring Network Discover 1531
Editing an existing Network Discover/Cloud Storage Discover target

You can also add a new Network Discover/Cloud Storage Discover target, and set options at
that time.
See “Adding a new Network Discover/Cloud Storage Discover target” on page 1529.
To edit a Network Discover/Cloud Storage Discover target
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click one of the scan targets from the list to open the target for editing.
3 Edit the desired option.
See “Network Discover/Cloud Storage Discover scan target configuration options”
on page 1532.
 Chapter 58
Network Discover scan
target configuration options
This chapter includes the following topics:

■ Network Discover/Cloud Storage Discover scan target configuration options

■ Configuring the required fields for Network Discover targets

■ Scheduling Network Discover/Cloud Storage Discover scans

■ Providing the password authentication for Network Discover scanned content

■ Managing cloud storage authorizations

■ Encrypting passwords in configuration files

■ Setting up Network Discover/Cloud Storage Discover filters to include or exclude items

from the scan

■ Filtering Discover targets by item size

■ Filtering Discover targets by date last accessed or modified

■ Optimizing resources with Network Discover/Cloud Storage Discover scan throttling

■ Creating an inventory of the locations of unprotected sensitive data

Network Discover/Cloud Storage Discover scan target

configuration options
Use the General, Authorization, Scanned Content, Filters, and Advanced tabs to configure
a Network Discover/Cloud Storage Discover scan target.
The General tab is available for all types of targets.
 Network Discover scan target configuration options 1533
Network Discover/Cloud Storage Discover scan target configuration options

The Authorization, Scanned Content, Filters, and Advanced tabs are only available for
some types of targets.
See “Editing an existing Network Discover/Cloud Storage Discover target” on page 1530.
For the additional configuration information that is specific to one type of target, refer to the
section for that target type.
Note that all filters are combined with “and” if a value is provided. Consider all filter values
when adding or modifying scan filters, to avoid unintentionally including or excluding everything
from the scan.
For configuration when adding or editing a target, select from the following options:

Optional tasks Tab in scan target Description of task

Configure required fields. General See “Configuring the required fields

for Network Discover targets”
These required fields should be set when a
on page 1534.
new target is added.

Schedule Network Discover/Cloud Storage General See “Scheduling Network

Discover scans. Discover/Cloud Storage Discover
scans” on page 1535.

Configure incremental scans. General See “Scanning new or modified items

with incremental scans” on page 1569.

Assign detection servers to the scan.
Targeting Select the detection server on which
to run the scan.
For File System scans, you can
choose to run a grid scan using
multiple detection servers

See “About grid scanning”

on page 1573.

Provide authentication for Box cloud storage. Authorization See “Providing Box cloud storage
authorization credentials”
on page 1539.

Provide authentication, and set up Scanned Content See “Providing the password
credentials. authentication for Network Discover
scanned content” on page 1537.

Include, or exclude, repositories from a scan. Filters See “ Setting up Network

Discover/Cloud Storage Discover
filters to include or exclude items
from the scan” on page 1542.
 Network Discover scan target configuration options 1534
Configuring the required fields for Network Discover targets

Optional tasks Tab in scan target Description of task

Filter targets by file size. Filters See “Filtering Discover targets by

item size” on page 1545.

Filter targets by date last accessed or Filters See “Filtering Discover targets by
modified. date last accessed or modified”
on page 1545.

Optimize your resources with scan throttling. Advanced See “Optimizing resources with
Network Discover/Cloud Storage
Discover scan throttling” on page 1548.

Create an inventory of the locations of Advanced See “Creating an inventory of the

unprotected sensitive data. locations of unprotected sensitive
data” on page 1549.

Specify options for automatically tracking Advanced See “Configuring scans of file
remediation status for network file system systems” on page 1614.
incidents.

Move, quarantine, or encrypt files in network Protect See “Configuring Network Protect for
file shares with Network Protect. file shares” on page 1619.

Quarantine or apply a visual tag to Box cloud Protect See “Configuring remediation options
storage content. for Box cloud storage targets”
on page 1599.

Configuring the required fields for Network Discover

targets
For a new target, enter the name of the target, the policy group, and the Discover Server where
the scans can run.
These required fields should be set when a new target is added.
To enter the required fields for a target
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click New Target, and use the pull-down menu to select the specific target type.
3 On the General tab, enter the Name of this Discover target.
Enter a unique name for the target, or edit the existing name, up to 255 characters.
 Network Discover scan target configuration options 1535
Scheduling Network Discover/Cloud Storage Discover scans

4 Select the Policy Group.

If no other policy group has been selected, the Default Policy group is used. To apply a
policy group, select the policy group to use for this target. You can assign multiple policy
groups to a target.
The administrator defines policy groups on the Policy Group List page. If the policy group
you want to use does not appear on the list, contact your Symantec Data Loss Prevention
administrator.
5 On the Targeting tab, select the Discover Server (or multiple Discover Servers) where
you want to allow the scan to run.
If you select more than one server without specifying a grid scan, Symantec Data Loss
Prevention automatically selects one of the servers when the scan starts.
The grid scanning feature for file system scan targets provides an additional option which
enables you to distribute the scanning workload across all of the selected servers, provided
that you select at least two servers.
See “About grid scanning” on page 1573.
Only the detection servers that were configured as Discover Servers appear on the list.
If there is only one Discover Server on your network, the name of that server is
automatically specified. You should configure your Discover Servers before you configure
targets. You must specify at least one server before you can run a scan for this target.
6 On the Scanned Content tab, you must enter the item to be scanned. Refer to the
documentation about each type of target for additional information about this entry.
See “About Network Discover/Cloud Storage Discover” on page 1522.
7 You can configure other options for this target.
See “Network Discover/Cloud Storage Discover scan target configuration options”
on page 1532.

Scheduling Network Discover/Cloud Storage Discover

scans
Network Discover/Cloud Storage Discover scans can be set up to run on a regular schedule,
for example during nights or weekends. Scans can also be set to pause during specified times,
for example when resources are normally busy with other tasks.
For cloud storage, file shares, Lotus Notes, or SQL databases, the scan schedule can be
completely specified with the Scan Schedule parameters.
For the scanner targets (such as SharePoint or Exchange), the scan must also be scheduled
from the computer where the scanner is installed. You must manually manage the scan
 Network Discover scan target configuration options 1536
Scheduling Network Discover/Cloud Storage Discover scans

schedule between the Discover target and the scanner application. The scanners are installed,
configured, and run outside of the Enforce Server and Network Discover/Cloud Storage Discover
Server. For example, the scanner can be scheduled to run automatically using the host’s native
scheduling. You can create a UNIX cron job, or add the scanner to the Windows scheduler.
The scanner should be scheduled to run before the scheduled Network Discover/Cloud Storage
Discover scan, so that the Network Discover/Cloud Storage Discover scan has information to
consume.
If you select a specific time for starting or pausing a scan, the time zone of the Enforce Server
is used.
You can configure other options for this target.
See “Network Discover/Cloud Storage Discover scan target configuration options” on page 1532.
To set up a scan schedule
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click the name of the scan that you want to schedule.
3 Click the General tab.
4 Select the item Submit Scan Job on Schedule.
When you select this check box to set up a schedule for scanning the specified target,
the Schedule drop-down list becomes available. After you select an option from the
Schedule drop-down list, additional fields appear.
5 Select one of the following additional fields:

No Regular Schedule Save the target without a schedule.

Scan Once Run the scan one time, at the specified time and
date.

Scan Daily Scan the target daily, at the specified start time.
Check Until to stop the daily scan after a certain
date.

Scan Weekly Scan the target every week. Check Until to stop
the weekly scan after a certain date.

Scan Monthly Scan the target every month. Check Until to stop
the monthly scan after a certain date.

6 Click Save.
 Network Discover scan target configuration options 1537
Providing the password authentication for Network Discover scanned content

To pause a scan during specified times

1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click the name of the scan that you want to pause during specified times.
3 Click the General tab.
4 Select the item Pause Scan between these times.
5 Select the pause options.
This option automatically pauses scans during the specified time interval. You can override
a target’s pause window by going to the Discover Targets screen and clicking the start
icon for the target entry. The pause window remains intact, and any future scans that run
up against the scan window pause as specified. You can also restart a paused scan by
clicking the continue icon in the target entry.

Note: If the target configuration is modified while it is paused, then the modified
configuration does not apply to items that were already scanned. When a scan is paused
and restarted, the scan is restarted from a checkpoint that is created when the scan is
paused. The modified configuration is used for the items that are scanned from that
checkpoint.

6 Click Save.

Providing the password authentication for Network

Discover scanned content
On the Scanned Content tab, enter the configuration options for authentication.
Avoid special characters in the authentication credentials. Authentication credentials must not
contain any of the following characters, or the scan fails:
■ Pipe character ( | )
■ Ampersand character (&)
■ Quotation marks (single ' or double ")
To provide password authentication for scanned content
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click the name of the scan to provide the password authentication.
3 Click the Scanned Content tab.
 Network Discover scan target configuration options 1538
Managing cloud storage authorizations

4 You can enter authentication information in several ways:

■ Use a stored credential.
If a stored credential is available, select a named credential from the drop-down in
Use Saved Credentials.
■ A global scan credential can be provided for all shares in this target.
Enter the user name and password in Use These Credentials.
■ Separate authentication credentials can be provided for each share in a list.
A separate credential supersedes the global scan credential, if one was provided.
Click Add or Edit to provide credentials for each share in a list.
In the Add box, enter the share and credentials with the following syntax:
path[, [username, password][, [depth][, remediation-username, remediation-password]]]
For omitted items, provide a null entry with consecutive commas.

5 The format of the credentials depends on the type of scan. For the specific format and
examples of credentials for each target type, see the topic for that target type.
See “About Network Discover/Cloud Storage Discover” on page 1522.
6 You can set other options on the Scanned Content tab.
See “Network Discover/Cloud Storage Discover scan target configuration options”
on page 1532.
Remediation credentials can be set on the Protect tab.
See “Configuring Network Protect for file shares” on page 1619.

Managing cloud storage authorizations

Before you can run Discover scans on Boxcloud storage targets, you must authorize Symantec
Data Loss Prevention to access and modify your user content on those targets. You can create
and manage authorizations for Box cloud storage targets on the System > Settings > Cloud
Authorization page.
See “Providing Box cloud storage authorization credentials” on page 1539.
You can take the following actions on the Cloud Authorization page:
 Network Discover scan target configuration options 1539
Managing cloud storage authorizations

Table 58-1 Cloud Authorization page actions

Action Description

Create a new cloud authorization You can create a new cloud authorization for Box cloud storage targets.
See “Providing Box cloud storage authorization credentials”
on page 1539.

You can only have one cloud authorization for Box cloud storage
targets.

Edit an existing cloud authorization To modify an existing cloud authorization, click the edit icon.

See “To modify an existing cloud storage authorization” on page 1539.

Delete a cloud authorization To delete a cloud authorization, click the delete icon.

You cannot delete a cloud authorization that is in use by a Discover

scan target.

Modifying existing cloud storage authorizations

You can modify existing cloud storage authorizations on the System > Settings > Cloud
Authorization > Edit Cloud Storage Authorization page. Use this page to modify most
existing settings, such as the Name, Client ID, Client secret, and so on.
To modify an existing cloud storage authorization
1 In the Enforce Server Administrative Console, go to System > Settings > Cloud
Authorization.
2 Click the edit icon for the cloud storage authorization you want to modify in the Cloud
Storage Authorizations list.
3 Enter your edits on the Edit Cloud Storage Authorization screen.
4 Click Save.

Providing Box cloud storage authorization credentials

Authorizing your Box cloud storage scans requires three actions:
■ Create a Box application in your Box account. This application gives you access to the
appropriate Box API.
■ Create a cloud authorization in the Enforce Server administration console.
■ Authorize your Discover scan target.

Creating a Box application in your Box account

The app.box.com/developers/services page lets you create an application in your Box account.
 Network Discover scan target configuration options 1540
Managing cloud storage authorizations

To create a Box application in your Box account

1 Log on to your Box account as an administrative user.
2 Navigate to app.box.com/developers/services.
3 Click Get Started.
The Create a Box Application page appears.
4 Enter a name for your application, such as "Symantec Data Loss Prevention", then
click Create Application.
The editing page for your application appears.
5 In the General section, ensure that Content API Access Only is selected.
6 In the OAuth2 Parameters section, ensure that Standard Authentication (3-legged
OAuth2.0) is selected.
7 Select the following scopes:
■ Read and write all files and folders
■ Manage enterprise
■ Manage groups
■ Manage enterprise properties
■ Manage retention policies

8 Enter your Enforce Server URI in the redirect_uri field.

9 Click Save Application.
After you have created your Box application, contact Box to enable the following additional
settings:
■ As-User
■ Admin can make calls on behalf of Users
■ Admin or co-admin can make calls for any
■ Can suppress email notifications from API calls

Creating a cloud authorization for Box

After you have created your Box application, create your Box cloud authorization in the Enforce
Server administration console.
 Network Discover scan target configuration options 1541
Encrypting passwords in configuration files

To create a cloud authorization for Box

1 In the Enforce Server administration console, go to System > Settings > Cloud
Authorization.
2 Click New Cloud Storage Authorization > Box.
The Add Cloud Storage Authorization screen appears.
3 In the Cloud Storage Authorization section, enter a Name and Description for the new
authorization.
4 In the Client Configuration section, enter the Client ID for your Box application.
Your Box application client ID is the client_id found on your Box application information
page.
5 Enter the Client secret for your Box application.
The client secret for your Box application is the client_secret found on your Box application
information page.
6 Re-enter the client secret.
7 Click Save.

Authorizing a Box cloud storage scan

After you have created a cloud authorization for Box cloud storage, you can authorize a Box
cloud storage scan.
To authorize Box cloud storage scans
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click the name of the scan to provide the password authentication.
3 Click the Authorization tab.
4 Click Authorize.
The Log in to grant access to Box dialog box appears.
5 Enter the Box authorization credentials for this scan. You must use credentials with Box
administrator or co-administrator privileges for the content you want to scan. You must
also have permissions to download the files you want to scan.

Encrypting passwords in configuration files

Encrypt passwords in the configuration files with the utility EncryptPassword.exe.
 Network Discover scan target configuration options 1542
Setting up Network Discover/Cloud Storage Discover filters to include or exclude items from the scan

To encrypt passwords in configuration files

1 Navigate to the bin directory of the scanner installation on the scanner computer.
See “Scanner installation directory structure” on page 1663.
2 Run the utility EncryptPassword.exe.
This utility encrypts the password that is provided in the scanner configuration files.
3 When the utility requires you to enter a password, enter a password.
4 Click the encrypt option.
5 Place the encrypted password into the Password= setting in the
Vontuscanner_typeScanner.cfg file.

See “Configuration options for web server scanners” on page 1685.

See “Configuration options for Documentum scanners” on page 1695.
See “Configuration options for Livelink scanners” on page 1704.

Setting up Network Discover/Cloud Storage Discover

filters to include or exclude items from the scan
Exclude and include filters reduce the number of items or repositories to scan.
Use the Include Filters field to specify the items that Symantec Data Loss Prevention should
process. If you leave the Include Filters field empty, Symantec Data Loss Prevention performs
matching on all items in the selected target. If you enter any values in the field, Symantec Data
Loss Prevention scans only those items that match your filter.
Use the Exclude Filters field to specify the items that Symantec Data Loss Prevention should
not process. If you leave the Exclude Filters field empty, Symantec Data Loss Prevention
performs matching on all items in the selected target. If you enter any values in the field,
Symantec Data Loss Prevention scans only those items that do not match your filter.
To optimize scanning, you can break up scans using include and exclude filters. For example,
you can exclude binary items. Binary items are less likely to contain policy violations.
See “About Network Discover/Cloud Storage Discover scan optimization” on page 1565.
Note that all filters are combined with “and” if a value is provided. Consider all filter values (for
example size and date) when adding or modifying scan filters. Avoid unintentionally including
everything, or excluding everything from the scan.
See “Network Discover/Cloud Storage Discover scan target configuration options” on page 1532.
 Network Discover scan target configuration options 1543
Setting up Network Discover/Cloud Storage Discover filters to include or exclude items from the scan

To set up include filters or exclude filters:

1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click the name of the scan where you want to add include filters or exclude filters.
3 Click the Filters tab.
4 Enter file names or paths into the include filters and the exclude filters to select a subset
of items that Symantec Data Loss Prevention should process. Delimit entries with a
comma, but no spaces. The path filter is case-sensitive.
When both include filters and exclude filters are present, exclude filters take precedence.
The include filter and exclude filter file names are relative to the file system root. Specify
full paths or subdirectories, as needed. Some wildcards are allowed.
Table 58-2 shows the syntax for the filters.
If the exclude filter entry exceeds the 1024-character limit, you can create an exclude file
with the file names to be excluded.
5 Click Save.
To create an exclude file:
1 Create a directory named excludeFiles in the Symantec Data Loss Prevention
configuration directory, for example\SymantecDLP\Protect\config\excludeFiles\.
For a configuration with multiple Discover servers, a copy of this directory and file must
be present on each Discover server.
2 In this directory create one text file for each set of items to exclude.
For example, you can create one file for each UNIX system to be scanned. Name the files
hostname.txt, where hostname is the name of the system to be scanned, as provided
in the target configuration. The host name in this text file must match exactly the name
that is in the Network Discover/Cloud Storage Discover target.
3 In each file, list the paths (each path on a separate line) that you want to exclude from
the scan.
The paths can be files, directories, symbolic links, or mounted directories. The paths must
each begin with a delimiter of “/” or “\” followed by the share name, directory name, and
file name. For example, a valid path is \excludeshare\excludedir\excludefile.
Table 58-2 shows the syntax for filters.
 Network Discover scan target configuration options 1544
Setting up Network Discover/Cloud Storage Discover filters to include or exclude items from the scan

Table 58-2 Syntax for the include filters and exclude filters

Wildcard Description

* (asterisk) Use this wildcard to match any sequence of

characters, including null.

? (question mark) Use this wildcard to match any one character in the
place where it appears.

, (comma) Represents a logical OR. Delimit entries with a

comma, but do not use any spaces.

The forward slash (/) and backslash (\) characters These characters are equivalent. They usually
represent directory separators, although on Linux
the backslash is a valid character in a file name.

White space at the beginning and end of the pattern White space is ignored at the beginning and end of
the pattern. Do not use spaces before or after the
commas that delimit entries.

Escape characters The matching process does not support escape

characters, so there is no way to match a question
mark, a comma, or an asterisk explicitly. In general,
special characters in filter items are not supported.

Table 58-3 shows the example filters.

Table 58-3 Example filters using wildcards

Example filter Description

*.txt,*.doc This example of an include filter matches only files

or documents with the .txt or .doc extensions,
ignoring everything else.

*.? This example of an include filter matches only files

or documents with a single-character extension.
This example matches files such as hello.1 and
hello.2, but not hello.doc or hello.html.

*/documentation/*,*/specs/* This example of an include filter only matches on

specific subdirectories of a file share or local drive
called documentation and specs.

Syntax and examples for SQL Database scanning are in the SQL Database section.
See “Configuring and running SQL database scans” on page 1629.
Syntax and examples for SharePoint scanning are in the SharePoint section.
 Network Discover scan target configuration options 1545
Filtering Discover targets by item size

See “Configuring and running SharePoint server scans” on page 1640.

Filtering Discover targets by item size

Use size filters to exclude items from the matching process that are based on their size.
Size filters are only available for files on Box cloud storage, file shares, Lotus Notes documents,
SharePoint items, and Exchange items.
You can configure other options for the target.
See “Network Discover/Cloud Storage Discover scan target configuration options” on page 1532.
To exclude items based on item size
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click the name of the scan that you want to filter based on item size.
3 Click the Filters tab.
4 Enter optional values under the item size filters.
Symantec Data Loss Prevention includes only the items that match your specified size
filters. If you leave this field empty, Symantec Data Loss Prevention performs matching
on items of all sizes.
Note that all filters are combined with “and” if a value is provided. Consider all filter values
(for example include, exclude, and date) when adding or modifying scan filters. Avoid
unintentionally including everything, or excluding everything from the scan.
5 To exclude items smaller than a particular size, enter a number in the field next to Ignore
Smaller Than. Then select the appropriate unit of measure (Bytes, KB, or MB) from the
drop-down list next to it.
6 To exclude items larger than a particular size, enter a number in the field next to Ignore
Larger Than. Then select the appropriate unit of measure (Bytes, KB, or MB) from the
drop-down list next to it.
7 Click Save to save all updates to the target.

Filtering Discover targets by date last accessed or

modified
Specify date filters to exclude items from the matching process based on their dates. Only the
items that match the specified date filters are included.
 Network Discover scan target configuration options 1546
Filtering Discover targets by date last accessed or modified

Date Filters are available for files on Box cloud storage, file shares, Lotus Notes documents,
and Microsoft SharePoint and Exchange documents.
Incremental scanning and differential scanning are available for some Network Discover/Cloud
Storage Discover target types.
See “Scanning new or modified items with incremental scans” on page 1569.
See “Scanning new or modified items with differential scans” on page 1571.
You can configure other options for the target.
See “Network Discover/Cloud Storage Discover scan target configuration options” on page 1532.
Note that all filters are combined with “and” if a value is provided. Consider all filter values (for
example include, exclude, and size) when adding or modifying scan filters. Avoid unintentionally
including everything, or excluding everything from the scan.
To exclude items based on the date last accessed or modified
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click the Filters tab.
3 Enter optional values under File Date Filters.
4 Select Only Scan files added or modified since the last full scan for a differential scan.
See “Scanning new or modified items with differential scans” on page 1571.
This option scans only the items that have been added or modified (whichever is newer)
since the last full scan.
If you do not select this option, Symantec Data Loss Prevention uses no date filter. It
performs matching on items of all dates in the specified target.
The first scan has to be a full scan. A full scan occurs if you select this option before
Symantec Data Loss Prevention scans this target for the first time.
When you select this option, you can also select the option Make next scan a full scan.
When you select this option, the date filters for Only scan files added or modified and
for Only scan files last accessed are disabled. The next scan is a full scan (if no previous
full scans have completed). Subsequent scans cover only those items that have been
added or modified since the full scan. After Symantec Data Loss Prevention performs the
full scan, this check box is automatically deselected.
This option is not available for the target for a file system (file share). Use incremental
scanning, instead.
See “About incremental scans” on page 1569.
See “About the difference between incremental scans and differential scans” on page 1568.
 Network Discover scan target configuration options 1547
Filtering Discover targets by date last accessed or modified

5 Select Only scan files added or modified to include files based on the added or modified
date.
Symantec Data Loss Prevention only scans items after the specified After date, before
the specified Before date, or between the dates you specify.
Note that if the After date is later than the Before date, then no items are scanned. If the
Before date and the After date are the same, then no items are scanned. No items are
scanned because the assumed time of the Before parameter is at zero hours, and After
is at 24 hours.
When you select this option, you can also select from the following options:
■ After
To include the items that are created or modified (whichever is newer) after a particular
date, type the date. You can also click the date widget and select a date.
■ Before
To include the items that are created or modified (whichever is older) before a particular
date, type the date. You can also click the date widget and select a date.

6 Select Only scan files last accessed to include files based on the last accessed date.
Symantec Data Loss Prevention only scans items after the specified After date, before
the specified Before date, or between the dates you specify.
The last-accessed feature is only supported for Windows Network Discover Server scanning
of CIFS shares.
Note that if the After date is later than the Before date, then no items are scanned. If the
Before date and After date are the same, then no items are scanned. No items are
scanned because the assumed time of the Before parameter is at zero hours, and After
is at 24 hours.
When you select this option, you can also select from the following options:
■ After
To include the items that are accessed after a particular date, enter the date. You can
also click the date widget and select a date.
■ Before
To include the items that are accessed before a particular date, enter the date. You
can also click the date widget and select a date.
 Network Discover scan target configuration options 1548
Optimizing resources with Network Discover/Cloud Storage Discover scan throttling

Note: The default mount process uses the CIFS client. If the default mount does not work,
the mount task can use theJCIFS client by setting filesystemcrawler.use.jcifs=true
in the properties file Crawler.properties.

7 Click Save to save all updates to the target.

Optimizing resources with Network Discover/Cloud

Storage Discover scan throttling
You can set throttling options on the Advanced tab of the target for the following scan targets:
■ Box cloud storage
■ File shares
■ Endpoint files
■ Lotus Notes documents
■ SQL Databases
For the scanners, throttling must be set by editing the configuration file on the scanner computer.

Note: Use of item throttling significantly reduces the scan rate. Expect the scan rate to reduce
to half the original scan rate or less.

You can also set other options to optimize scans.

See “About Network Discover/Cloud Storage Discover scan optimization” on page 1565.
To set scan throttling for Box cloud storage, file shares, Lotus Notes documents, or SQL
Databases
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click the scan target name to open the target for editing.
 Network Discover scan target configuration options 1549
Creating an inventory of the locations of unprotected sensitive data

3 On the Advanced tab, set the throttling options.

4 Enter the maximum number of files or rows to be processed per minute per detection
server, or the maximum number of bytes to be processed per minute per detection server.
If you select both options, then the scan rate is slower than both options.

Maximum files scanned per minute per detection Specify the maximum number of files, documents
server (in Lotus Notes), or rows (in SQL Databases) to
be processed per minute per server.

Maximum size scanned per minute per detection Specify the maximum number of bytes to be
server processed per minute per server.

Specify the unit of measurement from the

drop-down list. The options are bytes, KB
(kilobytes), or MB (megabytes).

To set item throttling for the scanners

1 Locate the scanner configuration file (scanner-type.cfg) on the computer where the
scanner was installed.
2 In the scanner configuration file, modify the ImportPoliteness parameter and the
BatchSize parameter.

When you set item throttling, the scanner fetches BatchSize items to local storage and
then waits for ImportPoliteness milliseconds between processing each item fetched.
Byte throttling is not supported for any of the scanners.
3 To achieve item throttling from the repository, make the BatchSize parameter a small
value. Then the ImportPoliteness value has more effect. Setting BatchSize=1 achieves
the most throttling in fetching the documents.
For example, if you set BatchSize=25, and ImportPoliteness=5000 (5 seconds), the
scanner downloads the 25 documents. Then it pauses 5 seconds between processing
each document.

Creating an inventory of the locations of unprotected

sensitive data
To audit whether confidential data exists on a target, without scanning all of it, use Inventory
Mode scanning. Inventory Mode is useful when the existence of incidents is important, not the
number of them in each location.
Running a scan in Inventory Mode can also improve the performance of scanning large numbers
of computers or large amounts of data. Setting incident thresholds can improve the performance
 Network Discover scan target configuration options 1550
Creating an inventory of the locations of unprotected sensitive data

of scanning by skipping to the next content root to scan, rather than scanning everything. A
content root is one line (a file share, Domino server, or SQL database) specified on the Scanned
Content tab.
You can set a maximum number of incidents for a scan item. The scan item can be a file share
or a physical computer.
After the incident threshold has been reached, the scanning of this content root is stopped,
and scanning proceeds to the next content root. Because the process is asynchronous, a few
more incidents may be created than specified in the incident threshold.
Inventory Mode scanning is supported for the following cloud and server-based scan targets:
■ Cloud storage
For Box cloud storage targets, you can specify the incident threshold per user.
■ File shares
For file shares, you can also specify whether to count incidents by content root, or by
computer. The content root is one file share on the list that is specified on the Scanned
Content tab. The selection is specified in the field Count Incidents By.
■ Lotus Notes databases
The incident threshold is counted per content root (Domino server from the list on the
Scanned Content tab).
■ SQL databases
The incident threshold is counted per content root (SQL database from the list on the
Scanned Content tab).
Inventory Mode can be set with the incident threshold parameter. You can set it when you add
a new target, or when you edit an existing target.
After you locate the sensitive data, you can set other options to run the complete scans that
target those locations.
See “Network Discover/Cloud Storage Discover scan target configuration options” on page 1532.
To create an inventory of sensitive data
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click the scan target name to open the target for editing.
3 On the Advanced tab, you can optimize scanning with Inventory Mode scanning.
4 Set the Incident Threshold.
Enter the number of incidents to produce before moving on to the next user or content
root (specified on the Scanned Content tab).
5 Set the Count Incidents By option.
 Network Discover scan target configuration options 1551
Creating an inventory of the locations of unprotected sensitive data

For file shares you can also choose the following methods to count the incidents:
■ Content root (the default)
The content root is one file share from the list on the Scanned Content tab.
After the incident threshold is reached, the scan moves to the next file share.
■ Machine
Select this option to count by computer (from the specified shares on a computer).
When the incident threshold is reached, the scan moves to the next content root on
the list to scan. If that content root is on the same physical computer as the previous
item, it is skipped.
Note that the computer name must be literally the same for the content root to be
skipped. For example, \\localhost\myfiles and \\127.0.0.1\myfiles are treated
as different computers, even though they are logically the same.
 Chapter 59
Managing Network Discover
target scans
This chapter includes the following topics:

■ Managing Network Discover/Cloud Storage Discover target scans

■ Managing Network Discover/Cloud Storage Discover targets

■ Managing Network Discover/Cloud Storage Discover scan histories

■ Managing Network Discover/Cloud Storage Discover Servers

■ About Network Discover/Cloud Storage Discover scan optimization

■ About the difference between incremental scans and differential scans

■ About incremental scans

■ Scanning new or modified items with incremental scans

■ About managing incremental scans

■ Scanning new or modified items with differential scans

■ Configuring parallel scanning of Network Discover/Cloud Storage Discover targets

■ About grid scanning

■ Configuring grid scanning

■ Renewing grid communication certificates for Discover detection servers

■ Migrating a Discover scan from a single server to a grid

■ Performance guidelines
 Managing Network Discover target scans 1553
Managing Network Discover/Cloud Storage Discover target scans

■ Troubleshooting grid scans

Managing Network Discover/Cloud Storage Discover

target scans
Management tasks for your Network Discover/Cloud Storage Discover target scans fall into
four broad categories: managing Network Discover/Cloud Storage Discover targets, managing
Network Discover/Cloud Storage Discover scan histories, managing Network Discover/Cloud
Storage Discover servers, and optimizing scans.
See “Managing Network Discover/Cloud Storage Discover targets” on page 1553.
See “Managing Network Discover/Cloud Storage Discover scan histories ” on page 1556.
See “Managing Network Discover/Cloud Storage Discover Servers” on page 1564.
See “About Network Discover/Cloud Storage Discover scan optimization” on page 1565.

Managing Network Discover/Cloud Storage Discover

targets
To manage your Discover scan targets, you can:
■ Start, stop, and pause target scans.
■ Monitor status as target scans run.
■ Select targets to view details about them.
■ Edit or delete targets.
■ Manage multiple targets.
■ Sort and filter targets for easier target management.
■ Specify the number of targets to display.
See “About the Network Discover/Cloud Storage Discover scan target list” on page 1553.
See “Working with Network Discover/Cloud Storage Discover scan targets” on page 1555.
See “Removing Network Discover/Cloud Storage Discover scan targets” on page 1555.

About the Network Discover/Cloud Storage Discover scan target list

You can manage your Network Discover/Cloud Storage Discover scan targets on the Discover
Targets screen. The toolbar above the target list includes a drop-down menu for creating new
 Managing Network Discover target scans 1554
Managing Network Discover/Cloud Storage Discover targets

scan targets; buttons for starting, stopping, and pausing scans; and an icon for filtering the
items in the list. You can apply actions to multiple targets.
You can click most column headers to sort the list by the data in that column.
You can select the number of entries to display in the Discover Target list using the drop-down
menu above the Actions column.
See “Managing Network Discover/Cloud Storage Discover target scans” on page 1553.
Table 59-1 lists the columns for each target scan.

Table 59-1 Discover Targets

Target Description
Information

Target Name Name of the target scan.

Target Type Type of target for the scan (such as File System or SharePoint).

Policy Groups Lists the policy groups to which the target is assigned.

Servers Lists the servers assigned to this target.

Note: If a grid scan is configured for a particular scan target, the list of servers is
prefixed with the word 'Grid'.

See “About grid scanning” on page 1573.

Last Modified Specifies the date and time that the target was last modified.

Scan Status Displays the status of the scan. Click the link in this column to view a filtered scan
history page for this target.

Next Scan Displays the next scheduled scan for the target, if applicable.

Actions Click the Edit Target icon to edit the target definition.

Click the Delete icon to delete the target.

To filter the Discover Target list

1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click Filter. A text field or drop-down list appears in each column header in the Discover
Target list.
3 Apply one of these filters to the list:
■ Target Name: Type the name of the target into the text field.
■ Target Type: Select the target type from the drop-down list.
 Managing Network Discover target scans 1555
Managing Network Discover/Cloud Storage Discover targets

■ Policy Groups: Type the name of the policy group into the text field.
■ Servers: Type the name of the server into the text field.
■ Last Modified: Select a range from the drop-down list.
■ Scan Status: Select a scan status from the drop-down list.
■ Next Scan: Select a range from the drop-down list.

4 To clear a filter, clear the value from the relevant text field or drop-down list, or click Filter.

Working with Network Discover/Cloud Storage Discover scan targets

You can perform the following tasks with your scan targets:
To start, stop, and pause Network Discover/Cloud Storage Discover scans
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Select the scan target or targets you want to start, stop, or pause.
3 Click the Start Scan, Stop Scan, or Pause Scan button on the target list toolbar.
To edit a Network Discover/Cloud Storage Discover scan target
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click the Edit Target button for the target you want to edit.
3 Make your desired changes on the Edit Target page.
See “Network Discover/Cloud Storage Discover scan target configuration options”
on page 1532.

Removing Network Discover/Cloud Storage Discover scan targets

Check the scans that are running or queued before removing a scan target.
See “Managing Network Discover/Cloud Storage Discover target scans” on page 1553.
To remove scan targets, perform these actions:
■ Remove the scan target from the Enforce Server.
■ Uninstall the scanner from the computer where it is installed, if applicable.
To remove a scan target
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click Delete icon for the target you want to remove.
 Managing Network Discover target scans 1556
Managing Network Discover/Cloud Storage Discover scan histories

Managing Network Discover/Cloud Storage Discover

scan histories
To manage your Network Discover/Cloud Storage Discover scan histories, you can:
■ View statistics about running or completed scans.
■ Download scan history information in comma-separated value (CSV) format.
■ View scan details.
■ View incident reports.
■ Delete scan histories.
■ Manage multiple scan histories.
■ Sort and filter scan histories for easier management.
■ Specify the number of scan histories to display.
See “About Discover and Endpoint Discover scan histories” on page 1556.
See “Working with Network Discover/Cloud Storage Discover scan histories” on page 1558.
See “Deleting Network Discover/Cloud Storage Discover scans” on page 1558.
See “About Discover scan details” on page 1559.
See “Working with Network Discover/Cloud Storage Discover scan details” on page 1562.

About Discover and Endpoint Discover scan histories

You can manage your Discover and Endpoint Discover scan histories on the Scan History
screen. To view a scan history list for all Discover targets, in the Enforce Server administrative
console, go to Manage > Discover Scanning > Scan History.
You can click any column header to sort the list alpha-numerically by the data in that column.
You can select the number of entries to display in the Discover Target list using the drop-down
menu above the Actions column.
For more details about a scan, click the link in the Scan Status column to display the Scan
Detail screen.
See “About Discover scan details” on page 1559.
See “Managing Network Discover/Cloud Storage Discover target scans” on page 1553.
Table 59-2 lists the fields that are displayed for each scan.
 Managing Network Discover target scans 1557
Managing Network Discover/Cloud Storage Discover scan histories

Table 59-2 Scan History

Scan Description
History

Target Name of the target scan.

Name

Target Type Type of target for the scan (such as File System or SharePoint).

Scan Date and time the scan started.

Started

Scan Status Current status of the scan: Running, Paused, Completed, Stopped.

Number Of Number of detection servers selected to perform a grid scan.

Servers In
Note: The grid scanning feature currently supports only File System server scan targets.
Grid
For non-grid scans, a value of N/A is displayed in this column.

See “About grid scanning” on page 1573.

Scan Type Scan type: Incremental, Differential, or Full.

Incidents Number of incidents generated by the scan.

Generated

Run Time Elapsed time of the scan in dd:hh:mm:ss format.

Bytes/Items Number of bytes scanned in the target, as well as the number of items scanned.
Scanned

Errors Number of errors during the scan.

Actions Click the View Incidents icon to view an incident summary report for the scan.

See “About incident reports for Network Discover/Cloud Storage Discover” on page 1330.

See “Discover incident reports” on page 1331.

Click the Delete icon to delete the scan. Make sure to first delete differential scans before
you delete the base scan.

See “Deleting Network Discover/Cloud Storage Discover scans” on page 1558.

To filter the Scan History list

1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Scan History.
2 Click Filter. A text field or drop-down list appears in the column header in the Scan History
list.
3 Apply one of these filters to the list:
 Managing Network Discover target scans 1558
Managing Network Discover/Cloud Storage Discover scan histories

■ Target Name: Type the name of the target into the text field.
■ Target Type: Select the target type from the drop-down list.
■ Scan Started: Select a range from the drop-down list.
■ Scan Status: Select a scan status from the drop-down list.
■ Scan Type: Select a scan type from the drop-down list.

4 To clear a filter, clear the value from the relevant text field or drop-down list, or click Filter.
See “Managing Endpoint Discover target scans” on page 1778.

Working with Network Discover/Cloud Storage Discover scan histories

You can perform the following tasks with your scan histories:
To export Network Discover/Cloud Storage Discover scan histories
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Scan History.
2 Select the scan or scans you want to export.
3 Click Export. The File Download dialog box appears.
4 Click Open to view the exported data, or click Save to save the file.
5 To cancel the export operation, click Cancel.
To view incidents for a specific scan
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Scan History.
2 Click the View Incidents icon for the scan you want to view. The Discover Incidents
screen appears.

Deleting Network Discover/Cloud Storage Discover scans

You can delete specific scans from your scan history.
 Managing Network Discover target scans 1559
Managing Network Discover/Cloud Storage Discover scan histories

To delete a scan
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Scan History.
2 Delete any differential scans before you delete the base full scan for that target.
This step is not necessary for incremental scans.
3 Select the scan to be deleted, then click the delete icon in the Actions column.
To delete multiple scans, mark the checkboxes for the scans you want to delete, then
click Delete on the toolbar.

About Discover scan details

You can view detailed information about each Discover scan, including general scan information,
scan statistics, recent errors, and scan activity. You can also download reports in CSV format
for scan statistics, recent errors, and scan activity where available.
To view scan details, go to Manage > Discover Scanning > Scan History. Select the scan,
then click the link in the Status column.
See “Managing Network Discover/Cloud Storage Discover target scans” on page 1553.
See “Managing Endpoint Discover target scans” on page 1778.

Note: Information that displays on the Scan Detail screen is specific to the type of scan that
completed. The following tables list all possible fields that display.

Table 59-3 shows the General section which displays information about the scan.

Table 59-3 General scan detail

General Description
Scan Detail

Target Type The type and icon of the target that was scanned.

Target Name Name of the target.

Status Status of the scan.

If the scan is running, the name of the Network Discover/Cloud Storage Discover Server
where this scan is running is displayed.

Scan Type Scan type, such as incremental or full.

Start Time The date and time the scan began.

End Time The date and time the scan finished.

 Managing Network Discover target scans 1560
Managing Network Discover/Cloud Storage Discover scan histories

Table 59-4 shows the Scan Statistics section, which provides detailed information about the
scan.

Table 59-4 Scan Statistics

Scan Statistics Description

Processed Number of content roots (users, shares, or sites) that have been
scanned. If the scan is still running, this field provides a benchmark
of scan progress.

Run Time Amount of time that the scan took to complete. If the scan is still
(Days:Hours:Minutes:Seconds) running, the amount of time that it has been running. The total does
not include any time during which the scan was paused.

Items Scanned Number of items scanned.

Bytes Scanned Number of bytes scanned.

Items Filtered Number of items filtered.

Bytes Filtered Number of bytes filtered.

Errors Number of errors that occurred during the scan. A list of the errors
is available in the Recent Scan Errors section.

Items Unprocessable Number of items that were not processed during the scan.

Current Incident Count Number of incidents that were detected during the current scan, less
any deleted incidents. You can click this number to see an incident
list for this scan.

The Recent Grid Status section is a listing of the servers that were assigned to the scan
target to perform a grid scan. Grid scans are currently supported only for File System scan
targets.
By default, the Recent Grid Status section is collapsed when you open the Scan Detail
screen.

Table 59-5 Recent Grid Status

Recent Grid Description

Status Details

Grid Leader The name of the detection server that was assigned the role of grid leader during
the scan.

You can click each server name to navigate to the Server / Detector Detail screen
for that server.
 Managing Network Discover target scans 1561
Managing Network Discover/Cloud Storage Discover scan histories

Table 59-5 Recent Grid Status (continued)

Recent Grid Description

Status Details

Participating The names of the detection servers in the grid that performed the scan.
Detection Servers
You can click each server name to navigate to the Server / Detector Detail screen
for that server.

Non-Participating The names of the detection servers in the grid that were unable to perform the scan.
Detection Servers An error message is displayed next to each server name to describe the reason for
its inability to participate in the scan.

You can click each server name to navigate to the Server / Detector Detail screen
for that server.

The Recent Scan Errors section is a listing of the errors that occurred during the scan.
If a scan has many errors, the Scan Detail screen does not display them all. To see a complete
list of errors that occurred during the scan, click Download Full Error Report.
Table 59-6 shows the information in the Recent Scan Errors report, which provides information
about each error.

Table 59-6 Recent Scan Errors

Recent Scan Description

Error Details

Date The date and time of the error during the scan.

Path The directory path to the location of the file with the error during the scan.

Error The error message.

Recent Scan Activity displays the most recent log entries of the notable events that occurred
during the scan.
If a scan has many activity messages, the Scan Detail screen does not display them all. To
see a complete list of scan activity messages, click Download Full Activity Report.
Table 59-7 shows the Recent Scan Activity report, which provides information about each
activity.
 Managing Network Discover target scans 1562
Managing Network Discover/Cloud Storage Discover scan histories

Table 59-7 Recent Scan Activity

Recent Scan Description

Activity
Details

Date/Time The date and time when the logged event occurred.

Level The severity of the event.

Message The message that was logged about the event.

Table 59-8 explains the options on the Scan Detail screen.

Table 59-8 Options on the Scan Detail screen

Scan Detail Description

options

Download Full Download a report with all scan statistics in CSV format.
Statistics Report

Download Full Download a report with all scan errors in CSV format.
Error Report

Download Full Download a report with all scan activity in CSV format.
Activity Report

Working with Network Discover/Cloud Storage Discover scan details

You can perform the following tasks with scan details:
To view scan details
1 In the Enforce Server administration console, click Manage > Discover Scanning > Scan
History.
2 On the Scan History page, click the link in the Scan Status column for the scan for which
you want to view details.
To export scan details to a CSV file
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Scan History.
2 On the Scan History page, click the link in the Scan Status column for the scan for which
you want to view details.
3 On the Scan Details page, click one of the following buttons:
■ Download Full Statistics Report
 Managing Network Discover target scans 1563
Managing Network Discover/Cloud Storage Discover scan histories

■ Download Full Error Report

■ Download Full Activity Report

Troubleshooting grid scans

The Recent Grid Status section of the Scan Details displays an error message when one or
more detection servers were unable to participate in the grid scan. You can view the operational
logs and debug logs for each non-participating detection server to determine the cause of the
issue and the appropriate resolution.
See “Collecting server logs and configuration files” on page 306.

Note: Grid scans are currently supported only on File System server scan targets. See
“Configuring scans of file systems” on page 1614.

Expired grid communication certificate

When you access the operational log file for a detection server, the Grid communication
certificate expired or not yet valid error message indicates that you must renew that detection
server's SSL certificates.

Note: When the grid leader's grid communication certificate expire, the Scan Errors section
of the Scan Details screen also displays the Grid communication certificate expired or
not yet valid error message. You must then renew the grid communication certificate for the
grid leader. See “Renewing grid communication certificates for Discover detection servers”
on page 1577.

Scan timeout error messages

If the Recent Scan Errors section of the Scan Details screen displays the Timed out waiting
for response from the detection servers. Verify the status of the detection servers in
the grid error message, verify that the affected detection servers are running and ensure that
there is connectivity between the detection servers and the grid leader.

Disconnection from Enforce Server

If the Recent Scan Errors section of the Scan Details screen displays the Disconnected
from Enforce error message, verify the status of network connectivity on all of the grid
members.

Running consecutive grid scans on the same scan target

After completing a grid scan, the grid members might remain busy with post-scan tasks for a
small amount of time. If you attempt to initialize another grid scan on the same scan target
during this period, some of the detection servers might not participate in the scan.
 Managing Network Discover target scans 1564
Managing Network Discover/Cloud Storage Discover Servers

If the Recent Grid Status section of the Scan Details screen displays the Running previous
instance of the current scan error message next to the names of one or more detection
servers, pause the grid scan and resume it after ten minutes.

Grid members busy with other scans

When you initialize a grid scan, some of the grid members might still be busy with other scans
and will not participate in the new grid scan.
If the Recent Grid Status section of the Scan Details screen displays the Running scan
ScanTargetName error message next to the names of one or more detection servers, pause
the grid scan and resume it when all of the grid members are available.

Scan time increases at end of scan

Scan times may increase as the scan nears completion. This may be due to grid followers
restarting, encountering detection errors, or timing out on downloads or detection processes.
The grid leader will wait for each grid follower to respond for 30 minutes. If the leader does
not receive a response within 30 minutes, it will mark those requests as failed.

Managing Network Discover/Cloud Storage Discover

Servers
You can view the status and scan details of Network Discover/Cloud Storage Discover scans
for each Discover server.
See “Viewing Network Discover/Cloud Storage Discover server status” on page 1564.

Viewing Network Discover/Cloud Storage Discover server status

The Discover Servers screen lists the detection servers for Network Discover/Cloud Storage
Discover or Endpoint Discover that are configured on your network. This screen shows details
about the scans on each detection server.
To view your Discover servers, in the Enforce Server administration console, go to Manage
> Discover Scanning > Discover Servers.
See “Managing Network Discover/Cloud Storage Discover target scans” on page 1553.
Table 59-9 lists the information for each server.

Table 59-9 Discover Servers

Server Information Description

Server Name The name of the server. In parentheses is the type of detection server, either
Discover or Endpoint.
 Managing Network Discover target scans 1565
About Network Discover/Cloud Storage Discover scan optimization

Table 59-9 Discover Servers (continued)

Server Information Description

Running Scans A list of the scans that are currently running on this server.

Queued Scans A list of the scans that are queued to run on this server.

Scheduled Scans A list of scans that are scheduled to run in the future on this server.

Paused Scans A list of the paused scans on this server.

To view scan details from a Network Discover/Cloud Storage Discover server

1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Servers.
2 On the Discover Servers page, click the name of the scan for which you want to view
details.
See “About Discover scan details” on page 1559.

About Network Discover/Cloud Storage Discover scan

optimization
Network Discover/Cloud Storage Discover target scans can take hours or days to complete,
depending on the type of scan and the amount and format of the data to be scanned, as well
as hardware and network speed. To optimize your scans of large amounts of information for
better performance, follow the suggestions in this section.
To help optimize your Network Discover/Cloud Storage Discover scans, consider using some
of the following methods:
■ Begin by scanning only the file shares or repositories that are the most accessed and most
widely available (for example, guest or public access). Start small, and confirm the accuracy
of your scans before increasing the volume of information in a scan. After you have achieved
satisfactory performance with your initial scans, add scanning for the business units that
handle your confidential data.
■ Install multiple Network Discover/Cloud Storage Discover servers on the network.
■ For File System scans, use grid scanning to assign two or more Network Discover/Cloud
Storage Discover servers to scan very large data repositories.
See “About grid scanning” on page 1573.
■ Break large scans into multiple smaller scans. Create separate scan targets and use filters
to break up the set to scan.
You can break up scans with include, exclude, size, and date filters.
 Managing Network Discover target scans 1566
About Network Discover/Cloud Storage Discover scan optimization

See “Setting up Endpoint Discover filters to include or exclude items from the scan”
on page 1773.
See “Filtering Discover targets by item size” on page 1545.
See “Filtering Discover targets by date last accessed or modified” on page 1545.
■ Scan non-binary files first. Binary files are less likely to contain policy violations.
For example, you can set the Exclude Filter to the following list to scan non-binary files:

*.exe,*.lib,*.bin,*.dll,*.cab,*.dat

*.au,*.avi,*.mid,*.mov,*.mp,*.mp3,*.mp4,*.mpeg,*.wav,*.wma

To scan the rest of the files, use this filter as the Include Filter of a different scan target.
See “Setting up Endpoint Discover filters to include or exclude items from the scan”
on page 1773.
■ For cloud storage targets, you can configure one incremental scan with a narrow scan
window (seven or fewer days) and a one-time full scan for your entire data set. The
incremental scan will find recent sensitive data at risk quickly, while the full scan works
through the bulk of your data. Because cloud repositories can contain terabytes or petabytes
of data, you can expect the full scan to take a number of days to complete.
See “Scanning new or modified items with incremental scans” on page 1569.
See “About the difference between incremental scans and differential scans” on page 1568.
■ For File System and SharePoint targets, you can configure incremental scans to check
only those files that have not yet been scanned.
See “Scanning new or modified items with incremental scans” on page 1569.
See “About the difference between incremental scans and differential scans” on page 1568.
■ Scan new or recently modified items in one scan target, and older ones in a second scan
target.
Use the date filter to break up scans by date values, by files older than, or files newer than.
See “Filtering Discover targets by date last accessed or modified” on page 1545.
■ After the initial scan, run differential scans to check only those items that were added or
modified since the last complete scan.
See “Scanning new or modified items with differential scans” on page 1571.
See “About the difference between incremental scans and differential scans” on page 1568.
■ Scan small files in one scan target and large files in another. Scanning many small files
carries more overhead than fewer large files.
Use the size filter to break up scans by size.
See “Filtering Discover targets by item size” on page 1545.
■ Scan compressed files in a separate scan target.
Use the Include Filter to scan compressed files. For example, use the following list:
 Managing Network Discover target scans 1567
About Network Discover/Cloud Storage Discover scan optimization

*.zip,*.gzip

To scan the rest of the files, use this filter as the Exclude Filter of a different scan target.
See “Setting up Endpoint Discover filters to include or exclude items from the scan”
on page 1773.
■ Scan database or spreadsheet files in a separate scan target.
Use the SQL Database target to scan database files.
See “Configuring and running SQL database scans” on page 1629.
Use the Include filter to scan spreadsheet files:

*.xls

Set up a separate scan target and use the Exclude Filter to scan everything else.
See “Setting up Endpoint Discover filters to include or exclude items from the scan”
on page 1773.
■ Exclude the folders internal to applications. For example, in the scan of a DFS share,
exclude the internal DfsrPrivate folder. In the scan of a share on a NetApp filer, exclude
the .snapshot folder.
See “Excluding internal DFS folders” on page 1613.
See “Configuring scans of file systems” on page 1614.
■ Use Inventory Mode scanning to move to the next scan item after an incident threshold is
reached. Inventory Mode scanning can audit where confidential data is stored without
scanning all of it.
See “Creating an inventory of the locations of unprotected sensitive data” on page 1549.
■ Dedicate as much hardware as possible to the scans. For example, suspend or quit any
other programs that run on the server.
■ Use Scan Pausing to automatically suspend scanning during work hours.
■ Run scans in parallel.
See “Configuring parallel scanning of Network Discover/Cloud Storage Discover targets”
on page 1571.
■ Use throttling to reduce network load.
See “Optimizing resources with Network Discover/Cloud Storage Discover scan throttling”
on page 1548.
■ Update the server hardware.
You can use up to 12 GB of memory, quad CPUs, ultra-fast hard drives, and network cards
to address any bottlenecks in the hardware.
 Managing Network Discover target scans 1568
About the difference between incremental scans and differential scans

About the difference between incremental scans and

differential scans
Incremental and differential scans let you optimize scan performance by scanning only new
or modified items. Incremental scans resume from whatever point they left off, whether or not
the first scan was a full scan. Differential scans only scan items added or modified after the
last full scan: you must run at least one full scan on your scan target before you can use
differential scanning.
See “About incremental scans” on page 1569.
See “Scanning new or modified items with incremental scans” on page 1569.
See “Scanning new or modified items with differential scans” on page 1571.
Table 59-10 compares incremental scans and differential scans.

Table 59-10 Differences between incremental scans and differential scans

Incremental scans Differential scans

Incremental scans are supported Differential scans are supported for the following targets:
for the following targets:
■ Server > IBM (Lotus) Notes
■ Cloud > Box (On-prem ■ Server > Exchange
Detection Server) ■ Endpoint > File System
■ Server > File System
■ Server > SharePoint

Partial scans retain the Differential scans begin with a full scan of the Discover target. This
information about the items that full scan is called the base scan.
have been scanned.
Partial scans cannot be used as a base scan.
If files, shares, or other items are
missed because they are
inaccessible, the next
incremental scan automatically
covers the missed items.

Subsequent runs scan all items
that have not previously been
scanned, including new or
modified items.
Subsequent runs scan all items that have been added or modified
since the date of the most recent full (base) scan completed.
The system considers the start date of the base scan for differential
scanning.

An incremental scan index keeps The most recent complete base scan serves as the comparison for
track of which items have already which items to scan, based on the date of the base scan.
been scanned.
 Managing Network Discover target scans 1569
About incremental scans

About incremental scans

Incremental scans let you optimize scan performance by scanning only new or modified items.
Incremental scans resume from whatever point they left off, whether or not the first scan was
a full scan.
See “About Network Discover/Cloud Storage Discover scan optimization” on page 1565.
Incremental scanning is only supported for some targets types.
See “About the difference between incremental scans and differential scans” on page 1568.
Incremental scans retain the information about the items that have been scanned.
Some files may be skipped during a scan, for example, because they are locked or in use. A
scan may not complete because the data cannot be accessed, such as when a server or
device is offline. These missed files are scanned during subsequent scans of this target.
An incremental scan index keeps track of which items have been scanned previously. This
index is synchronized between multiple Discover Servers.
As of Symantec Data Loss Prevention version 15.0, when you configure an incremental scan
on file system servers, you can select one or more existing scan targets whose incremental
indexes will be re-used in the new scan. Re-using incremental indexes enables you to save
time on indexing scanned items in the new scan target. In addition, this feature enables you
to consolidate and split file system server scan targets, which increases scan target
manageability.
For information about sizing requirements for the incremental scan index, see the Symantec
Data Loss Prevention System Requirements and Compatibility Guide.

Scanning new or modified items with incremental

scans
An incremental scan lets you resume a Network Discover/Cloud Storage Discover scan from
where you left off. An incremental scan only scans the items that have not been scanned
previously.
See “About the difference between incremental scans and differential scans” on page 1568.
To set up an incremental scan
1 Go to Manage > Discover Scanning > Discover Targets.
2 Click the drop-down New Target, and select the Cloud > Box (On-prem Detection
Server), File System, or SharePoint target type, or select one of the cloud storage, file
system, or SharePoint scan targets in the list to edit it.
3 Click the General tab.
 Managing Network Discover target scans 1570
About managing incremental scans

4 Under Scan Type, select Scan only new or modified items (incremental scan). This
option is the default for new targets. (For cloud storage targets, this option is Scan only
items added or modified in the specified window (incremental scan).)
If you have changed the policy or other definitions in an existing scan, you may want to
set up the next scan as a full scan to ensure complete policy coverage. Select the following
option:
If you always want to scan all items in this target, select the following option:
Always scan all items (full scan). (For cloud storage targets, this option is Scan all files
added or modified in the specified window (full scan).)
5 Complete the other steps to set up or modify a Discover target and run the scan.
See “Configuring the required fields for Network Discover targets” on page 1534.
See “Network Discover/Cloud Storage Discover scan target configuration options”
on page 1532.
See “Setting up server scans of file systems” on page 1601.
6 To manage incremental scanning and diagnose issues, refer to the following topic:
See “About managing incremental scans” on page 1570.

About managing incremental scans

Note the following when running incremental scans:
■ If your installation has multiple Discover Servers, the incremental scan index is automatically
synchronized to all the other Discover Servers for that target.
■ When you change the incremental scan setting from Scan only new or modified items
(incremental scan) to Scan all items for the next scan. Subsequent scans will be
incremental, then the incremental scan index for that target is cleared before the scan
starts. Subsequent scans are incremental.

Note: Optionally, when you select the Scan only new or modified items (incremental
scan) option, you can select one or more existing file system server scan targets whose
incremental indexes will be re-used in the new scan. Re-using incremental indexes enables
you to save time on indexing scanned items in the new scan target. This functionality is
available only while you are creating a new scan target, or modifying an existing one before
running a scan on it for the first time.

■ To scan all items, set Always scan all items (full scan) for the Discover detection server
target.
 Managing Network Discover target scans 1571
Scanning new or modified items with differential scans

■ If the setting Always scan all items (full scan) is selected, then any previous index entries
for that target are cleared before the scan starts. The index is not repopulated during the
scan.
If you want to scan all items and then continue incremental scanning, select the option
Scan all items for the next scan. Subsequent scans will be incremental. This is not
an option for cloud storage targets.
■ When a Discover target is deleted, the incremental scan index is not automatically removed.

Scanning new or modified items with differential

scans
To save resources, differential scans only scan the items that have been added or modified
since the last full scan.
For information about how a target that is configured for differential scanning is upgraded
during a version upgrade, see the Symantec Data Loss Prevention Upgrade Guide.
See “About the difference between incremental scans and differential scans” on page 1568.
To set up a differential scan
1 Go to Manage > Discover Scanning > Discover Targets.
2 Click the drop-down New Target, and select the target type, or select one of the scan
targets in the list to edit it.
3 Click the Filters tab.
4 Select the date option for a differential scan.
See “Filtering Discover targets by date last accessed or modified” on page 1545.
5 Run a full scan. The initial scan must be a full scan.
6 After the initial scan has completed, the next scan only scans the items that are added or
modified since the last full scan.

Configuring parallel scanning of Network

Discover/Cloud Storage Discover targets
Multiple scans of different targets can be run simultaneously on the same Network
Discover/Cloud Storage Discover Server.
Parallel scans of server and scanner target types are supported. Parallel scanning of the same
CIFS server or share with different credentials, and from the same Network Discover/Cloud
Storage Discover Server is not supported.
 Managing Network Discover target scans 1572
Configuring parallel scanning of Network Discover/Cloud Storage Discover targets

The scan can be controlled (paused, resumed, or stopped) independent of other scans that
are on the Network Discover/Cloud Storage Discover Server. The state of each scan is
maintained and reported separately.
When a scan is started and multiple Network Discover/Cloud Storage Discover Servers are
selected, one is selected for this scan. The scan is assigned to run on the server with the
fewest number of scans that are running. The server is chosen from the server set specified
in the target.
For File System server scan targets, you can alternatively choose two or more servers to
perform a grid scan. The scan workload is then distributed across the = servers in the grid.
After a scan starts, it continues to run on the same server until the scan completes, is aborted,
or paused. On resumption the scan may be assigned to run on a different server. For grid
scans, the role of the grid leader is assigned to one of the servers in the grid based on server
availability.
Automated load balancing is not supported. If a Network Discover/Cloud Storage Discover
Server completes running all its scans, scans from other servers do not migrate to the unloaded
server. However, a scan can be migrated manually, by pausing and restarting the scan.
To run multiple scanner targets on the same Network Discover/Cloud Storage Discover Server,
separate ports must be configured for each scanner. The default port for a new scanner is a
value not already used by any scan targets.
See “Troubleshooting scanners” on page 1661.
To configure parallel scanning
1 In the Enforce Server administration console, go to System > Servers and Detectors >
Overview.
2 Select a Network Discover/Cloud Storage Discover Server to configure, and click the
server name.
3 Click the Configure option at the top.
4 Then select the Discover tab.
 Managing Network Discover target scans 1573
About grid scanning

5 Set the maximum number of parallel scans to run on this Network Discover/Cloud Storage
Discover Server.
The default value for Maximum Parallel Scans is 1. The maximum count can be increased
at any time. After it is increased, then any queued scans that are eligible to run on the
Network Discover/Cloud Storage Discover Server are started. The count can be decreased
only if the Network Discover/Cloud Storage Discover Server has no running scans. Before
you reduce the count, pause or stop all scans on the Network Discover/Cloud Storage
Discover Server.

Note: If you plan to use the grid scanning feature to distribute the scanning workload
across multiple detection servers, retain the default value (1).

6 Click Save.
7 Click Done.
8 You can view the scans that are actively running, queued, scheduled, or paused on each
Network Discover/Cloud Storage Discover Server. In the Enforce Server administration
console, go to Manage > Discover Scanning > Discover Servers.
See “Managing Network Discover/Cloud Storage Discover target scans” on page 1553.

About grid scanning

You can assign a collection or "grid" of Network Discover/Cloud Storage Discover detection
servers to a single large File System scan target. Grid scanning can significantly improve scan
rates for large data repositories.
When you assign Network Discover/Cloud Storage Discover detection servers to a grid, one
detection server acts as the leader of that grid, and the remaining detection servers are
followers. The grid leader crawls the data repository, adds detection requests to the detection
request queue, and reports scan statistics and status to the Enforce Server. It distributes
detection requests from the detection request queue to the grid followers. The grid followers
then download and perform detection on the requested data, and return any incidents they
generate to the Enforce Server. The grid leader handles load distribution for the grid followers
automatically to ensure optimal resource usage.
 Managing Network Discover target scans 1574
About grid scanning

Figure 59-1 Grid scanning architecture overview

When you assign Network Discover/Cloud Storage Discover detection servers to a grid,
Symantec Data Loss Prevention designates the first alphanumerical detection server as the
grid leader. If that detection server is not available for the scan, Symantec Data Loss Prevention
then designates the next server in the alphanumerical list as grid leader. For example, if your
detection servers are named:
■ detection-server-1A
■ detection-server-2B
■ detection-server-3C
Symantec Data Loss Prevention will first designate detection-server-1A as the grid leader. If
that server is unavailable, Symantec Data Loss Prevention designates detection-server-2B
as the grid leader, and so on. You cannot manually select the grid leader. You also cannot
add or remove servers to or from a grid while a scan is running.
See “Configuring grid scanning” on page 1575.
See “Migrating a Discover scan from a single server to a grid” on page 1579.
See “Performance guidelines” on page 1579.
See “Troubleshooting grid scans” on page 1581.
The grid scanning feature for File System server scan targets uses SSL certificates to
authenticate detection servers. When you set up a new detection server, a keystore and
truststore are generated for the detection server. The keystore and truststore each contain a
 Managing Network Discover target scans 1575
Configuring grid scanning

grid communication certificate that enables the server to communicate with the grid leader
during a grid scan. The certificates have a validity period of five years.
When a detection server's keystore and truststore certificates expire, that detection server will
be unable to participate in a grid scan until the certificates are renewed.
See “Renewing grid communication certificates for Discover detection servers” on page 1577.

Configuring grid scanning

To configure grid scanning, follow these steps:

Table 59-11 Task list for configuring grid scanning

Step Task Description

1 Configure settings for each Discover detection
server in the grid.
Symantec suggests that you configure each
detection server in a grid identically. You can find
useful guidelines and a scalability worksheet at the
following Symantec Support Center article:
http://www.symantec.com/docs/TECH247513.

2 The grid communication port in the The

\Protect\config\ScanManager.properties
file on the Enforce Server is set to 61616 by default.
You can change this port number if desired.
com.vontu.filescan.scanmanager.ScanManager.leader_port
property in the
\Protect\config\ScanManager.properties
file specifies he port used by the grid leader to
communicate with the other grid members. This port
must be open on all the detection servers in the grid.

See “To set the grid communication port”

on page 1576.

3 Confirm the queue size and queue size multiplier
values. The default queue size and queue size
multiplier values are set in the
\Protect\config\Crawler.properties file
on each detection server.
These properties specify the queue size and number
of file handles for each detection server in the grid.
You can tune this parameter to optimize detection
request handling by the grid followers. You can find
the optimal setting for your environment by
increasing these values in your test environment
and observing your results.

This setting is only applicable to the acting grid

leader, but should be set on every detection server
in the grid.

See “To set the queue size and queue size

multiplier” on page 1576.
 Managing Network Discover target scans 1576
Configuring grid scanning

Table 59-11 Task list for configuring grid scanning (continued)

Step Task Description

4 Ensure that the Maximum Parallel Scans value on Each detection server in the grid is dedicated to a
each detection server is 1. single scan, so they should only run a single scan.

See “To set the Maximum Parallels Scans value”

on page 1577.

5 Configure your File System scan target. Configure your File System scan target on the
Manage > Discover Scanning > Discover Targets
page.

See “Configuring scans of file systems” on page 1614.

To set the grid communication port

1 On the Enforce Server, open the \Protect\config\ScanManager.properties file in a
text editor.
2 Set the desired value for the
com.vontu.filescan.scanmanager.ScanManager.leader_port property. The default
port is 61616.
3 Save and close the file.
4 Restart the VontuMonitorController service.
To set the queue size and queue size multiplier
1 On each Network Discover detection server in the grid, open the
\Protect\config\Crawler.properties file in a text editor.

2 Set the desired value for the crawler.grid.queuesize.multiplier property. The default
value is 60.
3 Set the desired value for the crawler.grid.follower.queuesize property. The default
value is 30.
4 Save and close the file.
5 Restart the VontuMonitor service on each detection server.
For more details about detection server settings for grid scans, see
http://www.symantec.com/docs/TECH247513.
 Managing Network Discover target scans 1577
Renewing grid communication certificates for Discover detection servers

To set the Maximum Parallels Scans value

1 Navigate to the System > Servers and Detectors > Overview > Configure Server page
for each detection server in the grid.
2 In the Maximum Parallel Scans field of the Discover section, enter 1.
3 Click Save.

Renewing grid communication certificates for

Discover detection servers
The grid scanning feature uses SSL certificates to authenticate the Discover detection servers
that are part of a grid so that they can communicate with the grid leader. When you set up a
new detection server, a keystore and a truststore are generated for that server. When a server's
grid communication certificate expires, that server will not be able to participate in any grid
scans until the certificate is renewed.
Before you renew a detection server's grid communication certificate, you must identify the
keystore and truststore filles that contain its certificates.
To identify the keystore file for a detection server
1 In the Enforce Server administration console, navigate to System > Servers and Detectors
> Events.
2 In the Filter area, expand the Advanced Filters & Summarization section.
3 Click Add filter, and then do the following:
■ In the first list box, select Server or Detector.
■ In the second list box, select Is Any Of.
■ In the third list box, select the detection server whose grid communication certificate
has expired.

4 Click Add filter again, and then do the following:

■ In the first list box, select Event Code.
■ In the second list box, select Is Any Of.
■ In the third list box, type 2136.

5 Click Apply.
 Managing Network Discover target scans 1578
Renewing grid communication certificates for Discover detection servers

6 When the filter takes effect, open the most recently created record of event 2136.
7 On the Event Detail screen, take note of keystore file name that is displayed in the Detail
field.
For example, monitor11_keystore_v1.jks.
To identify the truststore file for a detection server
1 In the Enforce Server console, navigate to System > Servers and Detectors > Events.
2 In the Filter area, expand the Advanced Filters & Summarization section.
3 Click Add filter, and then do the following:
■ In the first list box, select Server or Detector.
■ In the second list box, select Is Any Of.
■ In the third list box, select the detection server whose grid communication certificate
has expired.

4 Click Add filter again, and then do the following:

■ In the first list box, select Event Code.
■ In the second list box, select Is Any Of.
■ In the third list box, type 2138.

5 Click Apply.
6 When the filter takes effect, open the most recently created record of event 2136.
7 On the Event Detail screen, take note of keystore file name that is displayed in the Detail
field.
For example, monitor11_truststore_v1.jks.
To renew the grid communication certificate for a detection server
1 In the Enforce Server's system navigate to the X:\SymantecDLP\Protect\keystore
directory, where X is the letter of the drive on which the Enforce Server is installed.
2 Delete the identified keystore and truststore files.
3 Restart the detection server.
When the Enforce Server detects the restarted detection server, it generates new keystore
and truststore files which contain new certificates that are valid for another five years.
 Managing Network Discover target scans 1579
Migrating a Discover scan from a single server to a grid

Migrating a Discover scan from a single server to a

grid
You can migrate existing single-server scans to a grid scan. Best practices for such a scan
migration are:
■ Choose the detection servers in closest proximity to the scan targets for the grid scan.
Choosing the most proximate detection servers to the target will maximize performance
for the grid.
■ Merge scan targets from single-server scans to a close-proximity grid scan. If you have
split a target across several singe-server scans, merging such targets to a single
most-proximate grid scan will increase performance.
If you configured incremental indexing for you existing single-server scan targets, you can
merge those incremental indexes into your new grid scan.
See “About incremental scans” on page 1569.

Performance guidelines
The performance for a grid scan depends on several factors:
■ The complexity of your detection policy
■ The specifications of your detection servers
■ The average file size in your data set
■ Network and file I/O latencies
■ Number of concurrent requests allowed on your targeted file system servers
■ The response time of your targeted file system servers
With those considerations in mind, note that grid scanning does not scale linearly. Rather,
performance follows a curve similar to that illustrated in Figure 59-2.
 Managing Network Discover target scans 1580
Performance guidelines

Figure 59-2 Grid scanning performance pattern

Though Symantec cannot provide specific values for the axes of this graph, the curve illustrates
that you will reach a point where adding more detection servers to your grid scan will not
increase the scan rate.
For information about recommended individual server settings for best performance, see the
Symantec Support Center article here: http://www.symantec.com/docs/TECH247513.

Determining the correct number of detection servers for your grid

In a test environment, you can evaluate what the optimal number of detection servers is to
assign to a grid scan. The goal of such testing is to determine the number of servers required
to download and scan all of the detection requests from the grid leader. Once you have assigned
a sufficient number of servers to handle all of the detection requests from the grid leader, your
scan will run at peak performance. Adding more servers to the grid at that point will not increase
your scan rate.
Note that there is a strong correlation between average file size on your targeted file systems
and the optimal number of detection servers in your grid. Smaller average file sizes generally
perform better with fewer detection servers in the grid, while larger average file sizes require
more servers.
You can enable the grid performance log to help you pinpoint the correct number of servers
to maximize your grid-scanning performance. The grid performance log logs performance
values at 15-minute intervals during the entire grid scan.
 Managing Network Discover target scans 1581
Troubleshooting grid scans

To enable and use the grid performance log

1 On your grid leader detection server, open the Protect/config/crawler.properties
file in a text editor.
2 Add the following new line:

crawler.gridperformancelog.enabled=true

3 Save and close the Protect/config/crawler.properties.

4 Recycle the grid leader detection server.
5 Run your grid scan.
6 After the scan is complete, open the grid performance log:
Protect/logs/GridPerformance-TargetName.log.

Locate the CrawlerWaitTime for the grid leader in the last 15 minutes of the scan. To
ensure optimal performance, the crawler wait time should be 0. Adjust the number of grid
followers as needed to optimize your grid. You may need to repeat and log several scans
to achieve this result.

Increased load on file system server targets

Be aware that a grid scan may increase the load on your file system server targets when
compared to a single-server Discover scan. You may need to increase the number of concurrent
requests allowed by your file system servers, as well as improve their response time, to
maximize scan performance.

Troubleshooting grid scans

The Recent Grid Status section of the Scan Details displays an error message when one or
more detection servers were unable to participate in the grid scan. You can view the operational
logs and debug logs for each non-participating detection server to determine the cause of the
issue and the appropriate resolution.
See “Collecting server logs and configuration files” on page 306.

Note: Grid scans are currently supported only on File System server scan targets. See
“Configuring scans of file systems” on page 1614.

Expired grid communication certificate

When you access the operational log file for a detection server, the Grid communication
certificate expired or not yet valid error message indicates that you must renew that detection
server's SSL certificates.
 Managing Network Discover target scans 1582
Troubleshooting grid scans

Note: When the grid leader's grid communication certificate expire, the Scan Errors section
of the Scan Details screen also displays the Grid communication certificate expired or
not yet valid error message. You must then renew the grid communication certificate for the
grid leader. See “Renewing grid communication certificates for Discover detection servers”
on page 1577.

Scan timeout error messages

If the Recent Scan Errors section of the Scan Details screen displays the Timed out waiting
for response from the detection servers. Verify the status of the detection servers in
the grid error message, verify that the affected detection servers are running and ensure that
there is connectivity between the detection servers and the grid leader.

Disconnection from Enforce Server

If the Recent Scan Errors section of the Scan Details screen displays the Disconnected
from Enforce error message, verify the status of network connectivity on all of the grid
members.

Running consecutive grid scans on the same scan target

After completing a grid scan, the grid members might remain busy with post-scan tasks for a
small amount of time. If you attempt to initialize another grid scan on the same scan target
during this period, some of the detection servers might not participate in the scan.
If the Recent Grid Status section of the Scan Details screen displays the Running previous
instance of the current scan error message next to the names of one or more detection
servers, pause the grid scan and resume it after ten minutes.

Grid members busy with other scans

When you initialize a grid scan, some of the grid members might still be busy with other scans
and will not participate in the new grid scan.
If the Recent Grid Status section of the Scan Details screen displays the Running scan
ScanTargetName error message next to the names of one or more detection servers, pause
the grid scan and resume it when all of the grid members are available.

Scan time increases at end of scan

Scan times may increase as the scan nears completion. This may be due to grid followers
restarting, encountering detection errors, or timing out on downloads or detection processes.
The grid leader will wait for each grid follower to respond for 30 minutes. If the leader does
not receive a response within 30 minutes, it will mark those requests as failed.
 Chapter 60
Using Server FlexResponse
plug-ins to remediate
incidents
This chapter includes the following topics:

■ About the Server FlexResponse platform

■ Using Server FlexResponse custom plug-ins to remediate incidents

■ Deploying a Server FlexResponse plug-in

■ Locating incidents for manual remediation

■ Using the action of a Server FlexResponse plug-in to remediate an incident manually

■ Verifying the results of an incident response action

■ Troubleshooting a Server FlexResponse plug-in

About the Server FlexResponse platform

The Server FlexResponse application programming interface (API) provides a flexible platform
for incident remediation. It enables Symantec Data Loss Prevention users to protect data by
automatically or manually invoking custom Server FlexResponse actions.
Symantec provides a set of Server FlexResponse plug-ins that perform various remediations
such as quarantining sensitive data, copying files, and applying digital rights protection or
encryption. Independent developers can also write Server FlexResponse plug-ins to perform
custom incident remediation using this API and the Java programming language. The Server
FlexResponse API enables developers to build a plug-in that can be used to implement incident
responses for use in Automated and Smart Response rules.
 Using Server FlexResponse plug-ins to remediate incidents 1584
About the Server FlexResponse platform

The following are example Network Protect actions that you can implement by developing a
Server FlexResponse plug-in:
■ Change Access Control Lists (ACL) on files. For example, you can remove guest access
to selected files.
■ Apply Digital Rights Management (DRM). For example, you can apply digital rights to
documents so external parties are restricted in their access to sensitive material. These
digital rights can include “do not forward” or “do not print.”
■ Encrypt files.
■ Migrate files to SharePoint. The custom protect action can move files from shares to a
SharePoint repository, and then apply DRM and ACLs.
■ Perform workflow and automation of remediation responses.
■ Use the Symantec Workflow business process automation workflow.
The following steps are involved in building, deploying, and using a Server FlexResponse
plug-in:
■ Developing a plug-in using the Java API. This stage involves designing and coding the
plug-in and remediation action.

■ Configuring plug-in parameters by creating the configuration properties file for your plug-in.
See “Creating a properties file to configure a Server FlexResponse plug-in” on page 1588.
■ Adding your plug-ins to the plug-ins configuration properties file.
See “Adding a Server FlexResponse plug-in to the plug-ins properties file” on page 1586.
■ Deploying your custom plug-in on the Enforce Server.
See “Deploying a Server FlexResponse plug-in” on page 1586.
■ Loading the plug-in, including the plug-in metadata.
■ Creating response rules for incident Smart Response actions.

■ Using the plug-in action to remediate an incident.

See “Using the action of a Server FlexResponse plug-in to remediate an incident manually”
on page 1592.
■ Verifying the results of the Server FlexResponse plug-in action.
See “Verifying the results of an incident response action” on page 1593.

Note: Server FlexResponse plug-ins that were created for Symantec Data Loss Prevention
versions 12.x and 14.x are compatible with Symantec Data Loss Prevention 15.x.

The sections that follow describe how to deploy and configure pre-made FlexResponse plug-ins,
as well as how to use custom plug-in actions in Symantec Data Loss Prevention policies. You
 Using Server FlexResponse plug-ins to remediate incidents 1585
Using Server FlexResponse custom plug-ins to remediate incidents

can obtain some Server FlexResponse plug-ins directly from Symantec. You can also develop
your own custom plug-ins using the Server FlexResponse API. For information about developing
plug-ins using the Java API, See the Symantec Data Loss Prevention Server FlexResponse
Platform Developers Guide.

Using Server FlexResponse custom plug-ins to

remediate incidents
You can use Server FlexResponse plug-in actions to automatically or manually remediate
Network Discover incidents.
To develop a custom remediation action, see the Symantec Data Loss Prevention Server
FlexResponse Platform Developers Guide.
To automatically or manually remediate incidents with a custom Server FlexResponse plug-in,
you must perform the following steps:

Table 60-1
Step Action Description

1 Deploy a Server FlexResponse plug-in to the Each Server FlexResponse plug-in must be deployed to
Enforce Server computer. the Enforce Server computer before you can use the plug-in
actions in Symantec Data Loss Prevention policies.

See “Deploying a Server FlexResponse plug-in”

on page 1586.

2 Create a response rule that uses a custom See “Configuring the Server FlexResponse action”
Server FlexResponse incident response on page 1245.
action.

3 (Optional) Use the Server FlexResponse If you are using a Server FlexResponse plug-in action in a
plug-in to manually remediate incidents. smart response rule, you must manually locate an incident
and execute the FlexResponse action.

See “Locating incidents for manual remediation”

on page 1591.

See “Using the action of a Server FlexResponse plug-in to

remediate an incident manually” on page 1592.

This step is not necessary if you configure an automated

response rule to execute a Server FlexResponse action.
With automated response rules, the creation of an incident
that triggers the automated response rule also executes
the configured FlexResponse action.
 Using Server FlexResponse plug-ins to remediate incidents 1586
Deploying a Server FlexResponse plug-in

Table 60-1 (continued)

Step Action Description

4 Verify the results. See “Verifying the results of an incident response action”
on page 1593.

Deploying a Server FlexResponse plug-in

Enable a plug-in for the Server FlexResponse API.
To deploy a Server FlexResponse plug-in
1 Copy the completed Server FlexResponse plug-in JAR file to the plug-ins directory:

SymantecDLP\Protect\plugins\

2 Configure the plug-in with a properties file.

See “Creating a properties file to configure a Server FlexResponse plug-in” on page 1588.
3 Copy the properties file for each plug-in into the directory where you placed your JAR file:

SymantecDLP\Protect\plugins\

4 In the file SymantecDLP\Protect\config\Plugins.properties, add the plug-in to the

list, and enter the properties for your plug-in.
See “Adding a Server FlexResponse plug-in to the plug-ins properties file” on page 1586.
5 Make sure that the Symantec Data Loss Prevention protect user has read and execute
access to both the plug-in JAR file and the plug-in properties file.
6 To load the plug-in, stop the Vontu Incident Persister and Vontu Manager services, and
then restart them.

Adding a Server FlexResponse plug-in to the plug-ins properties file

Add a Server FlexResponse plug-in to the Plugins.properties file. Also, modify any
parameters that are necessary for the plug-in.

Note: If you have installed the Network Protect ICE license and configured the Enforce Server
to connect to the Symantec ICE Cloud, you can use the SharePoint Encrypt response rule
action which is made available through an encryption Server FlexResponse plug-in that is
installed automatically with Symantec Data Loss Prevention 15. No additional configuration
or customization is required for the encryption plug-in. See “Configuring the Enforce Server
to connect to the Symantec ICE Cloud” on page 204.
 Using Server FlexResponse plug-ins to remediate incidents 1587
Deploying a Server FlexResponse plug-in

Note: The SharePoint Encrypt plug-in only functions if you are connecting to your SharePoint
deployment using the SharePoint solution. If you are scanning SharePoint without using the
SharePoint solution, you cannot use this plug-in.

To add a Server FlexResponse plug-in to the properties file

1 Edit the Plugins.properties file.
General values are in this file for all plug-ins, plus a list of all the plug-ins that are
implemented.
See Table 60-2 on page 1587.
This file is in the following directory:

SymantecDLP\Protect\config

2 Locate the following line in the file, which specifies the JAR files of the plug-ins to construct
at load time:

# Incident Response Action configuration parameters.

com.symantec.dlpx.flexresponse.Plugin.plugins =
plugin1.jar,plugin2.jar

Remove the comment mark from the beginning of the line, if necessary, and replace
plugin1.jar,plugin2.jar with the names of the plug-in JAR files you want to deploy.
Separate multiple JAR files with commas.
3 Edit any additional parameters in this file.
Table 60-2 describes the additional properties for the Server FlexResponse API in the
Plugins.properties file.

4 Stop the Vontu Incident Persister and Vontu Manager services, and then restart them.
This loads the new plug-in and the other parameters in this file.
If you later change the Plugins.properties file, you must restart both the Vontu Incident
Persister and Vontu Manager services to apply the change.
In Table 60-2 plugin-id is a unique identifier of the plugin within this properties file, for example
test1.

Table 60-2 Parameters in the Plugins.properties file

Property name Description

protect.plugins.directory The directory under which all Symantec Data Loss Prevention
plug-ins are installed.
 Using Server FlexResponse plug-ins to remediate incidents 1588
Deploying a Server FlexResponse plug-in

Table 60-2 Parameters in the Plugins.properties file (continued)

Property name Description

com.symantec.dlpx.flexresponse.Plugin.plugins A comma-separated list of JAR files (or JAR titles) to be loaded in

the Server FlexResponse plug-in container.

Each plug-in in this list will correspond to a response rule action in

the Enforce Server administration console.

The container in which your JAR file is deployed includes all of the
public JRE classes provided by the JVM installed with Symantec
Data Loss Prevention. The container also includes all of the
FlexResponse API classes described in this document (classes in
the com.symantec.dlpx package hierarchy). Your FlexResponse
plug-in code may have dependencies on other JAR files that are
not provided by the plug-in container. Place any external JAR files
that you require in the \plugins directory of the Enforce Server
where the FlexResponse plug-in is deployed. Then reference the
JAR in this property.

com.vontu.enforce.incidentresponseaction.
IncidentResponseActionInvocationService.
maximum-incident-batch-size
The maximum number of incidents that can be selected from the
incident list report for one Server FlexResponse Smart Response
rule invocation.
The default is 100.

In this release, the maximum value of this parameter cannot exceed

1000.

com.vontu.enforce.incidentresponseaction. Do not change the value of this parameter. This parameter is

reserved for development and debugging.
IncidentResponseActionInvocationService.
Use the timeout property in the individual plug-in properties file
keep-alive-time
to set the timeout for the execution threads for your plug-in.

com.vontu.enforce.incidentresponseaction. The execution thread timeout for the serial thread executor (global).

IncidentResponseActionInvocationService. See the is-serialized property in the individual plug-in property

file for details.
serial-timeout

Creating a properties file to configure a Server FlexResponse plug-in

Specific information and parameters for each Server FlexResponse plug-in are in the
plug-in-name.properties file.

Each plug-in must have a separate properties file.

An individual plug-in properties file is not necessary if the plug-in satisfies the following
conditions:
 Using Server FlexResponse plug-ins to remediate incidents 1589
Deploying a Server FlexResponse plug-in

■ Does not need custom properties.

■ Provides the display name and the plug-in identifier in the implementation of the plug-in
metadata class.
■ Does not need a stored credential.

Note: If you have installed the Network Protect ICE license and configured the Enforce Server
to connect to the Symantec ICE Cloud, you can use the SharePoint Encrypt response rule
action which is made available through an encryption Server FlexResponse plug-in that is
installed automatically with Symantec Data Loss Prevention 15.0 and later versions. No
additional configuration or customization is required for the encryption plug-in. See “Configuring
the Enforce Server to connect to the Symantec ICE Cloud” on page 204.

To configure a Server FlexResponse plug-in

1 Create a text file that contains the properties for each Server FlexResponse plug-in.
Each JAR file has an optional associated properties file with the same base name as the
JAR file. These files are located in the SymantecDLP\Protect\plugins directory.
For example, if you have a plugin1.jar file, you should create a plugin1.properties
file.

2 In this file, enter the keys and values of all the parameters for the plug-in:

display-name=plugin 1
plugin-identifier=IncidentResponseAction1

To update the properties, you must stop the Vontu Manager and Vontu Incident Persister
services, and then restart them to load in the new values.
See Table 60-3 on page 1590.
3 Make sure that the Symantec Data Loss Prevention protect user has read and execute
access to the plug-in properties file.
Table 60-3 describes the properties in the plug-in-name.properties file.
 Using Server FlexResponse plug-ins to remediate incidents 1590
Deploying a Server FlexResponse plug-in

Table 60-3 Parameters in the custom plug-in properties file

Property name Description

display-name The name of this plug-in.

This name is displayed in the choose a plugin drop-down menu when you select
an All: Server FlexResponse action in a Smart Response rule or an automated
response rule.

A best practice is to define this property in the plug-in properties file.

If you change the value of this name in the properties file after the plug-in is loaded,
you must restart the Vontu Incident Persister and Vontu Manager services to load in
the new name.

Alternatively, this value can be specified in the metadata class.

This value is mandatory and it must be specified in at least one place, either in the
configuration properties file, or the plug-in metadata class.

For international environments, this display name can be in the local language.

plugin-identifier The identifier for this plug-in. This identifier should be unique for all Server
FlexResponse plug-ins on this Enforce Server.

A best practice is to define this property in the plug-in properties file.

Alternatively, this value can be specified in the metadata class.

This value is mandatory and it must be specified in at least one place, either in the
configuration properties file, or the plug-in metadata class.

If any response rule is assigned to this Server FlexResponse plug-in, do not change
this identifier in your properties file.

credential-reference.credential Specifies a reference to a named credential to authenticate access, for example to

an inventory database. The value of this property must refer to a named credential
that was defined on the Enforce Server. The credential-reference in the property
name provides a method to differentiate between multiple credentials in the properties
file.

inventory-credential.credential=
InventoryDB1

custom name These optional custom parameters are required to pass information to your plug-in.
These parameters are passed to each invocation of the plug-in and can optionally
Example:
be made available at the time this plug-in is constructed.
test1.value.1

test1.value.2
 Using Server FlexResponse plug-ins to remediate incidents 1591
Locating incidents for manual remediation

Table 60-3 Parameters in the custom plug-in properties file (continued)

Property name Description

timeout Optional parameter with the timeout in milliseconds for the execution threads for this
plug-in.

The default is 60000 (one minute).

If the timeout value is reached, the user interface shows the Server FlexResponse
plug-in status as failed, and the incident history is updated with a timeout message.

If you change the value of this property in the properties file after the plug-in is loaded,
you must stop the Vontu Incident Persister and Vontu Manager services, and then
restart them.

maximum-thread-count Optional parameter with the number of parallel threads available for execution of this
plug-in. This parameter is ignored if is-serialized is set.

The default is 2.

If you change the value of this property in the properties file after the plug-in is loaded,
you must stop the Vontu Incident Persister and Vontu Manager services, and then
restart them.

is-serialized The value of this parameter can be true or false. Set this optional parameter to true
if this plug-in execution must be serialized (one thread at a time). All serialized plug-ins
share a single execution thread. If this parameter is set, then timeout and
maximum-thread-count are ignored.

The default is false.

If you change the value of this property in the properties file after the plug-in is loaded,
you must stop the Vontu Incident Persister and Vontu Manager services, and then
restart them.

Locating incidents for manual remediation

To manually execute the plug-in action configured in a Smart Response Rule, use the reports
on the Enforce Server to select incidents for remediation.
To locate incidents for manual remediation
1 Log on to the Enforce Server administration console.
2 Click Incidents > Discover.
3 Select an incident (or multiple incidents) for remediation. You can use the standard reports
or report filters to narrow the list of incidents.
4 You can select either a group of incidents, or one incident for remediation:
 Using Server FlexResponse plug-ins to remediate incidents 1592
Using the action of a Server FlexResponse plug-in to remediate an incident manually

■ From the list of incidents, check the box to the left of each incident to select that incident
for remediation. You can select multiple incidents.
■ From the list of incidents, select all incidents on this page by clicking the check box
on the left of the report header.
■ From the list of incidents, select all incidents in the report by clicking the Select All
option on the upper-right side of the report.
■ Click one incident to display the Incident Detail, and select that one incident for
possible remediation.
After you have selected the incidents for remediation, you can manually remediate them.
See “Using the action of a Server FlexResponse plug-in to remediate an incident manually”
on page 1592.

Using the action of a Server FlexResponse plug-in to

remediate an incident manually
After you have selected an incident, or group of incidents to remediate, you can invoke the
action of a Smart Response rule. This action uses your custom Server FlexResponse plug-in
to remediate the incidents manually.
To remediate a single incident
1 Be familiar with the response rules that are available to manually remediate an incident.
Click Manage > Policies > Response Rules.
The Conditions column indicates which rules can be executed manually.
2 Select a single incident, and display the Incident Detail.
See “Locating incidents for manual remediation” on page 1591.
3 In the Incident Detail screen above the incident number, your remediation options display.
These options show the names of your response rules.
4 Click a Server FlexResponse plug-in remediation button to perform the remediation action.
5 View the remediation action. Click OK.
6 Verify that the remediation is complete. Some remediation actions may take a long time,
for example encryption of a large file. To see user interface updates, click the refresh icon
in the upper-right corner of the report. Refresh the page until you see the green success
or red failure icon in the incident details.
See “Verifying the results of an incident response action” on page 1593.
 Using Server FlexResponse plug-ins to remediate incidents 1593
Verifying the results of an incident response action

To remediate a selected group of incidents

1 Select incidents from an incident list report. Check the box at the left of the selected
incidents.
Alternatively, you can select all incidents on a page or on a report.
See “Locating incidents for manual remediation” on page 1591.
2 Incident Actions becomes a drop-down menu.
3 From the Incident Actions drop-down menu, select Run Smart Response and then
select your custom Server FlexResponse.
4 View the remediation action. Click OK.
5 Verify that the remediation is complete. Some remediation actions may take a long time,
particularly if several incidents were selected. To see user interface updates, click the
refresh icon in the upper-right corner of the report. Refresh the page until you see the
green success or red failure icon in the incident details.
See “Verifying the results of an incident response action” on page 1593.

Verifying the results of an incident response action

You can verify that a remediation action has been completed by using the History tab of an
incident.
To verify the results of an incident response action for a single incident
1 Log on to the Enforce Server administration console.
2 Click Incidents > Discover.
Look for the green success or red failure icons in the incident report.
3 For additional information about the results, click one incident to display the Incident
Detail.
4 Click the History tab.
5 View the remediation messages from your plug-in. A message that your plug-in was
invoked, and another message with the success or failure should display. Other messages
may also display, with the status result or remediation result.
 Using Server FlexResponse plug-ins to remediate incidents 1594
Troubleshooting a Server FlexResponse plug-in

To verify the results of an incident response action for a group of incidents

1 Log on to the Enforce Server administration console.
2 Click Incidents > Discover.
3 Use report filters and summaries to display the protect or prevent status of the incidents.
See “Viewing incidents” on page 1363.
Custom reports can also be created to show the protect or prevent status, or the values
of custom attributes.
See “About custom reports and dashboards” on page 1364.

Troubleshooting a Server FlexResponse plug-in

Table 60-4 has troubleshooting issues and suggestions for diagnosing Server FlexResponse
problems.

Table 60-4 Troubleshooting suggestions

Issue Suggestions

During creation of a Smart Response Rule, This issue happens because your plug-in did not load.
the drop-down menu does not display the
At the end of the file Plugins.properties, enter the
action All: Server FlexResponse.
name of your plug-in JAR file on the list of plug-ins. Make
During creation of an automated Response sure that this line is not commented out.
Rule, the drop-down menu does not display
Restart both the Vontu Incident Persister and Vontu
the action All: Server FlexResponse.
Manager services to load your plug-in.
If you have multiple plug-ins, your plug-in
Your plug-in properties file and plug-in code may not
name does not display in the All: Server
match appropriately. Look at the Tomcat log for errors.
FlexResponse drop-down menu.
The log file is localhost.date.log. This log file is in
SymantecDLP\Protect\logs\tomcat.

To verify that your plug-in is loaded, look for Enforce

system event (2122). This event lists all the plug-ins that
are loaded.

Your plug-in does not execute successfully. Check the incident snapshot history for messages from
your plug-in and the plug-in framework.

For Smart Responses, look at the Tomcat log for errors.

This log is in SymantecDLP\Protect\logs\tomcat.
The log file is localhost.date.log.

For automated responses, look at the

VontuIncidentPersister.log debug log file.
 Chapter 61
Setting up scans of Box
cloud storage using an
on-premises detection
server
This chapter includes the following topics:

■ Setting up scans of Box cloud storage targets using an on-premises detection server

■ Configuring scans of Box cloud storage targets

■ Optimizing Box cloud storage scanning

■ Configuring remediation options for Box cloud storage targets

Setting up scans of Box cloud storage targets using

an on-premises detection server
You can scan Box cloud storage targets with Cloud Storage Discover to discover confidential
data. You can scan user files and folders, collaborative folders, and files or folders with shared
links. You can configure automated response rules to quarantine and/or apply visual tags to
confidential files discovered on your Box cloud storage targets.
To set up scanning of Box cloud storage targets, complete the following process:
 Setting up scans of Box cloud storage using an on-premises detection server 1596
Configuring scans of Box cloud storage targets

Table 61-1 Setting up a Box cloud storage scan using an on-premises detection server

Step Action Description

1 Go to Manage > Discover See “Configuring scans of Box cloud storage targets” on page 1596.
Scanning > Discover Targets
to create a new target and to
configure scanning Box cloud
storage.

2 Set any additional scan target See “Network Discover/Cloud Storage Discover scan target
configuration options. configuration options” on page 1532.

3 To apply a visual tag to See “Configuring remediation options for Box cloud storage targets”
confidential files, or to quarantine on page 1599.
confidential files in the cloud or
on-premises, configure Network
Protect.

4 Start the Box cloud storage scan. Select the scan target from the target list, then click the start icon.

Go to Manage > Discover

Scanning > Discover Targets.

5 Verify that the scan is running See “About the Network Discover/Cloud Storage Discover scan
successfully. target list” on page 1553.

Configuring scans of Box cloud storage targets

Before you run a scan, you must set up a target using the following procedure.
To set up a new Box cloud storage target
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click New Target, and use the pull-down menu to select the Box (On-prem Detection
Server) target type.
3 On the General tab, type the Name of this Box target.
Enter a unique name for the target, up to 255 characters.
4 Select the Policy Group.
If no other policy group has been selected, the Default Policy group is used. To apply a
policy group, select the policy group to use for this target. You can assign multiple policy
groups to a target.
You can define policy groups on the Policy Group List page.
 Setting up scans of Box cloud storage using an on-premises detection server 1597
Configuring scans of Box cloud storage targets

5 Specify scheduling options.

Choose Submit Scan Job on Schedule to set up a schedule for scanning the specified
target. Select an option from the schedule drop-down list to display additional fields.
Choose Pause Scan between these times to automatically pause scans during the
specified time interval. You can override the pause window of a scan target by going to
the Discover Targets screen and clicking the start icon for the target entry. The pause
window remains intact, and any future scans that run up against the window can pause
as specified. You can also restart a paused scan by clicking the continue icon for the
target entry.
6 On the Targeting tab, select the Discover Server (or multiple Discover Servers) where
you want to run the scan.
If you select more than one server, Symantec Data Loss Prevention automatically selects
one of the servers when the scan starts.
Only the detection servers that were configured as Discover Servers appear on the list.
If there is only one Discover Server on your network, the name of that server is
automatically specified. You should configure your Discover Servers before you configure
targets. You must specify at least one server before you can run a scan for this target.
7 Under Scan Type, select Scan only new or modified items (incremental scan). This
option is the default for new targets.
■ If you have changed the policy or other definitions in an existing scan, you can set up
the next scan as a full scan. Select the following option:
Scan all items for the next scan. Subsequent scans will be incremental.
■ If you always want to scan all items in this target, select the following option:
Always scan all items (full scan)

8 On the Authorization tab, click Authorize.

The Log in to grant access to Box dialog box appears.
9 Enter the Box authorization credentials for this scan. You must use credentials with Box
administrator or co-administrator privileges for the content you want to scan. You must
also have permissions to download the files you want to scan.
10 Click Grant to grant Symantec Data Loss Prevention access to the Box cloud storage
accounts.
11 Click OK.
12 On the Filters tab, specify filters for Users/Groups, Folder Collaboration, Shared Links,
Include and Exclude File Type, File Size, and File Date.
■ Users/Groups: Select Scan all to scan all users and groups for this target. Select
Scan selected to scan only the specified users and groups. Upload a CSV or text file
(comma- or new-line separated) list for the users and groups you want to scan.
 Setting up scans of Box cloud storage using an on-premises detection server 1598
Optimizing Box cloud storage scanning

■ Folder Collaboration: Select an option for scanning collaborative folders from the
drop-down list in this section:
■ Scan All: Select this option to scan all folders for this target.
■ Scan only private folders: Select this option to scan only private, non-collaborative
folders.
■ Scan only collaborative folders (external or internal): Select this option to scan
all collaborative folders for this target.
■ Scan only external collaborative folders: Select this option to scan only external
collaborative folders for this target.

■ Shared Links: Select Scan only shared links to scan if you only want to scan files
or folders with shared links. You can select from these additional options:
■ Not password protected: Select this option to scan only files and folders with
shared links that are not password protected.
■ With no expiration date: Select this option to scan only files and folders with
shared links that have no expiration date.
■ With download permissions: Select this option to scan only files and folders with
shared links that have download permissions.

■ File Type: Enter the extension for file types you want to include or exclude from your
scan, such as *.dwg or *.csv.
■ File Size Filters: Enter the lower and upper file size limits you want to ignore in your
scan, in bytes, kilobytes, or megabytes.
■ File Date Filters: Enter a date range for the added or modified files and folders you
want to scan.

13 On the Advanced tab, select options to optimize scanning.

See “Optimizing Box cloud storage scanning” on page 1598.
14 On the Protect tab, enable Network Protect remediation options for this target.
See “Configuring remediation options for Box cloud storage targets” on page 1599.

Optimizing Box cloud storage scanning

To optimize scans of your Box cloud storage target, you can configure throttling options or set
an incident threshold for scanning (Inventory Scanning).
 Setting up scans of Box cloud storage using an on-premises detection server 1599
Configuring remediation options for Box cloud storage targets

To throttle a Box cloud storage target scan

1 Go to the Advanced tab of your target definition.
2 In the Maximum number of files per minute field, type the maximum number of files to
be processed per minute.
3 In the Maximum size scanned per minute field, type the maximum amount of data to
be processed per minute. Select bytes, kilobytes (KB), or megabytes (MB) from the
drop-down list.
To set an incident threshold
1 Go to the Advanced tab of your target definition.
2 In the Incident Threshold field enter the maximum number of incidents to be created per
user.

Configuring remediation options for Box cloud storage

targets
You can apply visual tags as metadata to sensitive content stored in your Box cloud storage
target. The visual tag helps your Box cloud storage users search for and self-remediate sensitive
data. For example, you might want the tag to read "This content is considered confidential."
You can also remind them of additional security features of Box, such as adding password
protection to any download links.
You can also quarantine sensitive content stored in your Box cloud storage target. You can
quarantine sensitive content either on Box or on an on-premises file share. You can optionally
choose to leave a marker file in place of the quarantined content.
To remediate Box cloud storage incidents, you must have both a policy and a response rule
configured in the Enforce Server administration console.
To set up remediation for Box cloud storage
1 Create a policy with a response rule. Go to Manage > Policies > Response Rules and
click Add Response Rule.
See “About response rules” on page 1199.
2 Select Automated Response.
3 Click Next.
4 For the Action, select one or both of the following options:
■ Cloud Storage: Add Visual Tag
The system displays the Add Visual Tag field. Enter the text you want to display in
the tag for your users.
 Setting up scans of Box cloud storage using an on-premises detection server 1600
Configuring remediation options for Box cloud storage targets

See “Configuring the Cloud Storage: Add Visual Tag action” on page 1252.
■ Cloud Storage: Quarantine
The system displays the Cloud Storage: Quarantine field. If you want to leave a
marker file in place of the quarantined file, select Leave marker file in place of
remediated file, and enter the text for the marker file in the Marker Text box. You
can also apply a visual tag to the marker file.
See “Configuring the Cloud Storage: Quarantine action” on page 1252.

5 Click Save.
6 Add a new policy, or edit an existing policy.
See “Configuring policies” on page 376.
7 Click the Response tab.
8 In the pull-down menu, select one of the response rules that you previously created.
9 Click Add Response Rule.
The selected response rule specifies the automated response when this policy triggers
an incident.
Several response rules with different conditions can exist for a policy.
10 Create a new Box cloud storage Network Discover target, or edit an existing target.
See “Configuring scans of Box cloud storage targets” on page 1596.
11 Click the Protect tab on the Box target page.
12 Under Allowed Protect Remediation, check Quarantine and/or Enable all tag response
rules when scanning, as appropriate.
13 Under Quarantine Details, select one of the following options:
■ Quarantine in the cloud
Optional: To quarantine the sensitive content in the cloud, enter the Box User and
Quarantine sub-folder in the appropriate fields. The Box User account can be either
the scanning account or a non-administrative user account.
If you select Quarantine in the cloud and leave these fields blank, Symantec Data
Loss Prevention uses the scanning account as the quarantine account.
Specify a sub-folder in your Box quarantine account by entering it in the Quarantine
sub-folder field.
■ Quarantine on-premises
To quarantine the sensitive content on an on-premises file share, enter the path and
user credentials for the file share.

14 Click Save.
 Chapter 62
Setting up scans of file
shares
This chapter includes the following topics:

■ Setting up server scans of file systems

■ Supported file system targets

■ Automatically discovering servers and shares before configuring a file system target

■ Automatically discovering open file shares

■ About automatically tracking incident remediation status

■ Excluding internal DFS folders

■ Configuring scans of Microsoft Outlook Personal Folders (.pst files)

■ Configuring scans of file systems

■ Optimizing file system target scanning

■ Configuring Network Protect for file shares

Setting up server scans of file systems

Network Discover scans network file servers and shared resources ("shares") such as disk
drives or directories to discover confidential data. Network Discover supports CIFS-compliant
file servers, and file shares using CIFS, NFS, DFS, or any other client. Network Discover can
also scan Microsoft Outlook Personal Folders (.pst files) on network file shares.
To set up scanning of file systems, complete the following process:
 Setting up scans of file shares 1602
Supported file system targets

Table 62-1 Setting up a network file system scan

Step Action Description

1 Verify that your network file system is on the list of supported targets. See “Supported file system targets”
on page 1602.

2 Optional: Run a Content Root Enumeration scan to automatically See “Automatically discovering
discover file system content roots within your domain. servers and shares before
configuring a file system target”
on page 1603.

3 Go to Manage > Discover Scanning > Discover Targets to create a See “Configuring scans of file
new target for a file system and to configure scanning of file systems. systems” on page 1614.

4 Set any additional scan target configuration options. See “Network Discover/Cloud
Storage Discover scan target
For scanning of Microsoft Outlook Personal Folders, verify that the option
configuration options” on page 1532.
is set.
See “Configuring scans of Microsoft
Outlook Personal Folders (.pst
files)” on page 1613.

5 To automatically move, quarantine, or encrypt files, configure Network See “Configuring Network Protect
Protect. for file shares” on page 1619.
Note: The encryption functionality is available only after you configure
the Enforce Server to connect to Symantec ICE.

6 Start the file system scan. Select the scan target from the
target list, then click the Start icon.
Go to Manage > Discover Scanning > Discover Targets.

7 Verify that the scan is running successfully. See “About the Network
Discover/Cloud Storage Discover
scan target list” on page 1553.

Supported file system targets

The File System target supports scanning of the following network file systems.
Supported file servers:
■ CIFS Servers only
Supported file shares:
■ CIFS on Windows Server 2008 R2, 2012, 2012 R2, and 2016
■ NFS on Red Hat Enterprise Linux 5.x, 6.x, and 7.x
■ DFS scanning on Windows 2008 R2, 2012, 2012 R2, and 2016.
 Setting up scans of file shares 1603
Automatically discovering servers and shares before configuring a file system target

Note: DFS is not supported with Network Protect.

In addition, the File System target supports scanning of the following file types:
■ Microsoft Outlook Personal Folders (.pst files) created with Outlook 2007, 2010, 2013,
and 2016.
The Network Discover Server scanning this target must be running a Windows operating
system, and Outlook 2007 or later must be installed on that system.
See “Configuring scans of Microsoft Outlook Personal Folders (.pst files)” on page 1613.
■ File systems on UNIX systems, even if they are not exposed as CIFS or NFS shares.
Use the SFTP protocol to provide a method similar to the scans of file shares.
You can also scan the local file system on a Linux Network Discover Server by listing the
path name in the content root. For example, you can enter /home/myfiles.

Automatically discovering servers and shares before

configuring a file system target
Auto-discovery of servers and shares (Content Root Enumeration) enables you to locate
servers and shares within a domain and filter them by IP range or server name. Share discovery
works only for CIFS-compliant file servers, including those with DFS file shares. Content Root
Enumeration scans produce a list of servers and shares that you can use directly in file system
targets for Discover scanning, or export to a CSV file. A Content Root Enumeration scan does
not scan the content of the servers and shares it discovers, but it enables you to find servers
and shares in your domain and configure automated scanning of them.
Content Root Enumeration scans require an LDAP directory server connection. Also, the
Enforce Server must have access to all servers and shares you wish to scan.
See “Configuring directory server connections” on page 141.
See “Configuring scans of file systems” on page 1614.

Working with Content Root Enumeration scans

Follow these procedures to create, start, and stop Content Root Enumeration scans, and to
view discovered content roots.
 Setting up scans of file shares 1604
Automatically discovering servers and shares before configuring a file system target

To create a Content Root Enumeration scan

1 Configure your LDAP directory server connection. Ensure that your directory credentials
have read and list privileges for all computer objects you wish to scan.
See “Configuring directory server connections” on page 141.
2 In the Enforce Server administration console, go to Manage > Discover Scanning >
Content Root Enumeration.
3 Click Add Scan. The Content Root Enumeration Scan Configuration page appears.
4 In the General section, enter a name for your scan in the Name field.
5 Select a directory connection.
6 Specify your Enumerate shares preference:
■ To list servers and file shares, click Yes.
■ To list only servers, click No, only enumerate servers.

7 In the Filters section, select at least one filter for your scan:
■ IP Range: Specify an IP range to scan for content roots.
■ Server Names: Specify one or more server name filters. Use the drop-down menu to
refine your filter.

8 Click Save.
To start or stop a Content Root Enumeration scan
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Content Root Enumeration.
2 Select the scan or scans you want to start or stop.
3 Do one of the following:
■ To start a scan, click Start.
■ To stop a running scan, click Stop.
 Setting up scans of file shares 1605
Automatically discovering servers and shares before configuring a file system target

To view discovered content roots

1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Content Root Enumeration.
2 Click the link in the Content Roots column of your desired scan to see a list of content
roots.
3 To export the list of content roots in .csv format, click Export to CSV in the Content
Roots dialog box.
You can use the exported .csv file to populate a Discover File System target.
See “Configuring scans of file systems” on page 1614.

Configuration options for Content Root Enumeration scans

You can find configuration options for Content Root Enumeration scans in the
Manager.properties file in the configuration directory: \SymantecDLP\Protect\config on
Microsoft Windows platforms, /opt/SymantecDLP/Protect/config on Linux platforms. These
default settings should perform well in most cases.

Table 62-2
Configuration property Default value Description

content_root_enumeration.scanResultThreshold 10000 The maximum

number of content
roots to be
discovered in a
Content Root
Enumeration scan.
If the number of
content roots in the
scan exceeds the
result threshold,
Symantec Data Loss
Prevention displays
an error. This
threshold prevents
your Content Root
Enumeration scans
from returning an
excessive number of
content roots for use
in a Discover File
System target.
 Setting up scans of file shares 1606
Automatically discovering servers and shares before configuring a file system target

Table 62-2 (continued)

Configuration property Default value Description

content_root_enumeration.maximumParallelScanCount 5 The maximum

number of Content
Root Enumeration
scans that Symantec
Data Loss
Prevention can run
in parallel. If the
maximum parallel
scan count is
reached, additional
scans are queued.

content_root_enumeration.scan_log.location Windows: The location of the

\SymantecDLP\Protect\logs Content Root
Enumeration scan
Linux:
detail log files.
/opt/SymantecDLP/Protect/logs

content_root_enumeration.scan_log.limit 5000000 The maximum size,

in bytes, of each
scan detail log file.

content_root_enumeration.scan_log.count 15 The maximum

number of scan
detail log files in use
at any given time.

content_root_enumeration.scan_log.append true The Boolean value

that specifies
whether or not
Symantec Data Loss
Prevention appends
log results to the end
of each scan detail
log file.

content_root_enumeration.scan_log.encoding UTF-8 The character set

Symantec Data Loss
Prevention uses
when writing to the
scan detail log file.
 Setting up scans of file shares 1607
Automatically discovering open file shares

Troubleshooting Content Root Enumeration scans

You can view both scan warnings and log files for Content Root Enumeration scans. These
warnings and logs can be useful for troubleshooting your Content Root Enumeration scans.
Content Root Enumeration scan warnings are non-terminal errors, such as connection timeouts
or DNS issues, that occur during the scan. If such errors occur during a Content Root
Enumeration scan, a link appears in the Alerts column on the Manage > Discover Scanning
> Content Root Enumeration page for that scan. You can view these warnings by following
this procedure:
To view Content Root Enumeration scan warnings
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Content Root Enumeration.
2 Click the link in the Alerts column for the scan warnings you want to view. The Scan
Warnings dialog box appears.
3 To export the list of scan warnings to a .csv file, click Export to CSV in the Scan
Warnings dialog box.
Log files are available in the logs directory: \SymantecDLP\Protect\logs on Microsoft Windows
platforms, /opt/SymantecDLP/Protect/logs on Linux platforms. Content Root Enumeration
logs are named using this format: ContentRootEnumerationScanDetail-scan name0.log.
Content Root Enumeration log files list every discovered content root, as well as all warnings
and errors occurring during the scan.

Automatically discovering open file shares

Symantec Data Loss Prevention can automatically discover open shares on a specified CIFS
server. You specify the UNC path or SMB URL and Symantec Data Loss Prevention
automatically finds and scans open file shares on that server.
See “To set up a new file system target” on page 1614.
You can automatically discover administrative shares corresponding to logical drives such as
C$ or D$.
To discover administrative shares automatically
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Create or select a File System Server target.
3 On the Advanced tab of the Edit File System Target page, select Scan Administrative
Shares.
 Setting up scans of file shares 1608
About automatically tracking incident remediation status

About automatically tracking incident remediation

status
You can configure Network Discover to automatically track the remediation status of file system
target incidents.
During the first Network Discover scan for a given file system target, incident metadata (resource
name, policies violated, and so on) is added to the Discover incident remediation tracking
catalog. If during a subsequent scan an incident stored in the catalog does not appear in the
scan results, Network Discover marks the incident as remediated with one of the following
status indicators:
■ Item modified. The item has been modified and no longer violates a policy. In the case
where both the item and policy have changed, the incident will be remediated as Item
modified. This option is off by default.
■ Policy modified. The policy that the incident violated has changed. In the case where both
the item and policy have changed, the incident will be remediated as Item modified. This
option is off by default.
■ Item no longer exists. The item has been moved, deleted, or renamed. This option is on
by default.
To prevent incidents from being automatically remediated in error, Network Discover will not
mark an incident as remediated if it is excluded from a scan due to:
■ Incremental scanning
■ Date filtering
■ Size filtering
■ Include or Exclude filters
The incident remediation catalog is contained in an Apache Derby database running under
the BoxMonitor process. The master catalog is stored on the Enforce Server, and each
detection server has its own local version of the catalog. The catalogs are synchronized to
ensure that the Enforce Server and all Network Discover detection servers track incident
remediation status correctly.
You can set your incident remediation tracking preferences on the Advanced tab of your file
system target.
See “Configuring scans of file systems” on page 1614.
You can configure options for automated incident remediation tracking, such as the location
of the catalog files, expiration period of temporary files, and so on.
See “Configuration options for Automated Incident Remediation Tracking” on page 1609.
You can view the latest remediation status of an incident in the incident snapshot.
 Setting up scans of file shares 1609
About automatically tracking incident remediation status

See “Discover incident snapshot” on page 1335.

You can also filter and summarize Network Discover reports by incident remediation status.
See “About filters and summary options for reports” on page 1388.

Troubleshooting automated incident remediation tracking

Automated incident remediation tracking does not work if you have enabled incident
thresholding. If you have enabled automated incident remediation tracking for a file system
target but do not see any tracking information, ensure that you have disabled incident
thresholding.
See “Creating an inventory of the locations of unprotected sensitive data” on page 1549.
You can view a log file for the incident remediation catalog on the detection server at this
location: SymantecDLP/Protect/logs/debug/DetectionServerDatabase%g.log, where %g
is an integer starting at 0. Logs for incidents tracked with this feature are sent to the
FileReader%.log and IncidentPersister%.log.

You can set the incident remediation catalog log level in the
SymantecDLP/Protect/config/DetectionServerDatabaseLogging.properties file:

Table 62-3 Remediation tracking database logging options

Log Level Description

FINE The Detection Server database heartbeats are

logged at the FINE level.

INFO Database start and stop messages are logged at

the INFO level.

SEVERE All unexpected database behavior throws an

exception and appears in the log at the SEVERE
level.

Configuration options for Automated Incident Remediation Tracking

You can set the following configuration options for Automated Incident Remediation Tracking
in the SymantecDLP/Protect/config/protect.properties file. If you have a multi-tier
installation, there will be separate files for the Enforce Server and Network Discover Server.
 Setting up scans of file shares 1610
About automatically tracking incident remediation status

Table 62-4
Property Default value Description

com.vontu.discover.detectionserver. 15000 The maximum

remediation.detection. number of files
comm.maxfiles stored in the
Network Discover
Server remediation
tracking catalog
directory before
synchronization
with the master
catalog on the
Enforce Server. If
the number of
catalog files
exceeds this limit,
Network Discover
creates no new
catalog entries until
at least one file is
synchronized.

com.vontu.discover.enforce. 15000 The maximum

remediation.detection. number of files
comm.maxfiles stored in the
Enforce Server
remediation
tracking master
catalog directory
before
synchronization
with the local
catalog on the
Network Discover
Server. If the
number of catalog
files exceeds this
limit, Network
Discover creates no
new master catalog
entries until at least
one file is
synchronized.
 Setting up scans of file shares 1611
About automatically tracking incident remediation status

Table 62-4 (continued)

Property Default value Description

com.vontu.discover.detectionserver. 10000 The frequency, in

remediation.detection. milliseconds, with
catalogfolder.checkperiod which the Network
Discover Server
checks the
remediation
tracking catalog
directory for the
number of catalog
files queued for
synchronization
with the master
catalog on the
Enforce Server.

com.vontu.discover.enforce. 10000 The frequency, in

remediation.detection. milliseconds, with
catalogfolder.checkperiod which the Enforce
Server checks the
remediation
tracking master
catalog directory for
the number of
catalog files queued
for synchronization
with the catalog on
the Network
Discover Server.

com.vontu.discover.detectionserver. 24 The expiration

remediation.detection. period, in hours, of
catalog.tempfile.expirationhours temporary files in
the remediation
tracking catalog
directory.

com.vontu.discover.enforce. 24 The expiration

remediation.detection. period, in hours, of
catalog.tempfile.expirationhours temporary files in
the remediation
tracking master
catalog directory.
 Setting up scans of file shares 1612
About automatically tracking incident remediation status

Table 62-4 (continued)

Property Default value Description

com.vontu.discover.detectionserver. C:/SymantecDLP/Protect/ The directory

remediation.detection. scan/catalog containing the
catalog.folder Network Discover
Server remediation
tracking catalog
files.

com.vontu.discover.enforce. C:/SymantecDLP/Protect/ The directory

remediation.detection. scan/catalog containing the
catalog.folder Enforce Server
remediation
tracking master
catalog files.

com.vontu.discover.detectionserver. 5 The size of the

remediation.detection. threadpool used for
threadpoolsize automated incident
remediation
tracking on the
Network Discover
Server.

com.vontu.discover.enforce. 5 The size of the

remediation.detection. threadpool used for
threadpoolsize automated incident
remediation
tracking on the
Enforce Server.

com.vontu.detectionserver. C:/SymantecDLP/Protect/ The directory

database.home scan/catalog containing the
Network Discover
Server remediation
tracking database.

com.vontu.detectionserver. 1527 The port used by

database.port the Network
Discover Server
remediation
tracking database.

com.vontu.manager.incidents.dir ./incidents The directory

containing offline
incidents on the
Enforce Server.
 Setting up scans of file shares 1613
Excluding internal DFS folders

Excluding internal DFS folders

By default, DFS file share scans include the dynamic internal DFS folders. Because these
folders do not contain your organization's confidential information you can safely exclude them
from your scans.
To exclude DFS internal folders
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click the name of the scan where you want to add the exclude filter for the DFS internal
folders.
3 Click the Scanned Content tab.
4 In the Exclude Filters field, type /DfsrPrivate/*.
5 Click Save.

Configuring scans of Microsoft Outlook Personal

Folders (.pst files)
You can scan Microsoft Outlook Personal Folders (.pst files) on file shares. The scan supports
Microsoft Outlook Personal Folders (.pst files) that were created with Outlook 2007, 2010,
2013, and 2016.
See “Configuring scans of file systems” on page 1614.
The following notes pertain to scanning .pst files:
■ The Network Discover Server scanning this target must be running a 64-bit Windows
operating system, and Outlook 2007, 2010, 2013, or 2016 64-bit clients must be installed
on that system.
■ Outlook must be the default email client on the Network Discover Server scanning this
target.
■ Network Protect is not supported for .pst files, even if the files are on CIFS shares.
■ After the initial base scan, incremental scanning scans the entire .pst file if the last modified
date changes.
■ The date filter and size filter apply to the entire .pst file, not to individual emails or other
items within the file.
■ The .pst files cannot be scanned in parallel. If the scans that run in parallel start scanning
.pst files, then the scans are serialized.
 Setting up scans of file shares 1614
Configuring scans of file systems

To configure scanning of Microsoft Outlook Personal Folders

1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Set up scanning of the file share containing the Microsoft Outlook Personal Folders.
See “Configuring scans of file systems” on page 1614.
3 On the Advanced tab, check the box Scan PST files. (The box is checked by default.)

Configuring scans of file systems

Before you run a scan, you must set up a target using the following procedure.
To set up a new file system target
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click New Target, and use the pull-down menu to select the specific target type.
3 On the General tab, type the Name of this Discover target.
Type a unique name for the target, up to 255 characters.
4 Select the Policy Group.
If no other policy group has been selected, the Default Policy group is used. To apply a
policy group, select the policy group to use for this target. You can assign multiple policy
groups to a target.
You can define policy groups on the Policy Group List page.
5 Under Scan Execution, select Scan only new or modified items (incremental scan).
This option is the default for new targets.
■ If you have changed the policy or other definitions in an existing scan, you can set up
the next scan as a full scan. Select the following option:
Scan all items for the next scan. Subsequent scans will be incremental.
■ If you always want to scan all items in this target, select the following option:
Always scan all items (full scan)

6 Optionally, if you selected the Scan only new or modified items (incremental scan)
option, you can select one or more existing scan targets whose incremental indexes will
be re-used in the new scan. Re-using incremental indexes enables you to save time on
indexing scanned items in the new scan target.
■ To re-use existing incremental indexes, select the desired scan target in the Available
Discover Targets list, and click Add >>. The selected scan target moves to the
 Setting up scans of file shares 1615
Configuring scans of file systems

Selected Discover Targets list and its incremental index becomes available to the
new scan target when the new target is scanned for the first time.
■ To stop re-using an existing incremental index, select the desired scan target in the
Selected Discover Targets list, and click << Remove. The selected scan target moves
back to the Available Discover Targets list and its incremental index is no longer
available to the new scan target.

Note: You can add and remove re-usable incremental indexes only while configuring a
new scan target and before running a scan on this target for the first time.

7 Specify scheduling options.

Choose Submit Scan Job on Schedule to set up a schedule for scanning the specified
target. Select an option from the schedule drop-down list to display additional fields.
Choose Pause Scan between these times to automatically pause scans during the
specified time interval. You can override the pause window of a scan target by going to
the Discover Targets screen and clicking the start icon for the target entry. The pause
window remains intact, and any future scans that run up against the window can pause
as specified. You can also restart a paused scan by clicking the continue icon for the
target entry.
8 On the Targeting tab, under Scan Server and Target Endpoints, select the Discover
Server (or multiple Discover Servers) where you want to run the scan.
Only the detection servers that were configured as Discover Servers appear on the list.
If there is only one Discover Server on your network, the name of that server is
automatically specified. You should configure your Discover Servers before you configure
targets. You must specify at least one server before you can run a scan for this target.
9 For the Scan Mode option, select one of the following options:
■ Select Use single server for scan to run scans using only one server. If you selected
more than one server in the previous step, Symantec Data Loss Prevention
automatically selects one of the servers when the scan starts.
■ Select Use all selected servers for scan in a grid to enable the grid scanning feature
which distributes the scan workload across multiple servers. When you initialize a
scan, one of the servers is assigned the role of the Grid Leader which coordinates the
actions of the other servers.
 Setting up scans of file shares 1616
Configuring scans of file systems

Note: You must select at least two servers for the scan target to be able to run a grid
scan. Symantec recommends that you apply the same hardware and software
configuration to all of the detections servers that you intend to use for grid scans.
Before you run a grid scan for the first time, ensure that the grid communication port
that is configured in the ScanManager.properties file is open on all of the servers in
the grid.

See “Configuring grid scanning” on page 1575.

10 On the Scanned Content tab, select or enter the credentials.

The credentials you provide must have both Read permission and Write Attributes
permission on the scan target. Write Attributes permission is required to update the "last
accessed" date.
You can specify a default user name to use for access to all file systems.
The password must not contain the quotation mark character. If any of your passwords
contain a quotation mark character, those file systems are not mounted for scanning.
If you need to use quotation mark characters in passwords, you can use JCIFS. The
default mount process uses the CIFS client. If the default mount does not work, the mount
task can use the Java-based CIFS client by setting filesystemcrawler.use.jcifs=true
in the properties file Crawler.properties.
11 Under Content Roots, enter the item to be scanned.
Select one of the following methods of entering file systems:
■ Scan Content Roots from an uploaded file
Create and save a plain text file (.txt or .csv) listing the servers you want to scan.
Then click Browse to locate the list and Upload File to import it. Create a file using
an ASCII text editor and type one file server or share per line. Do not include a user
name and password. By default, Symantec Data Loss Prevention interprets these as
Server Message Block (SMB) paths. If you want to specify NFS paths, include nfs in
the paths.

\\server\marketing
nfs:\\share\marketing
//server/engineering/documentation
/home/protect/mnt/server/share/marketing
c:\share\engineering

■ Specify content roots

■ Select Add Content Roots > By Direct Entry to use a line editor to specify the
servers or shares you want to scan. Information that is entered here takes
precedence over the default values and applies only to the path specified.
 Setting up scans of file shares 1617
Configuring scans of file systems

\\server\share
\\server.company.com
smb://server.company.com
\\10.66.23.34

Note: If you chose to enable incremental scanning for this scan target, and if you
selected one or more existing scan targets whose incremental indexed will be
re-used, you can merge existing scan targets by specifying a higher level directory
path. Alternatively, you can specify more a granular directory path to split a larger
existing scan target into multiple smaller scan targets.

■ Select Add Content Roots > From a Content Root Enumeration scan to import
content roots from a Content Root Enumeration scan. Select the scan to import in
the Import Content Root Enumeration scan results dialog box.

If your content root list includes a large number of content roots, you can filter the list to
include only those content roots that are relevant to your Discover Target scan. In the
Content Roots section, click Filters, then enter your filter text. For example, to see only
shares on a server named my_company, enter \\my_company in the Filters text field.
To delete content roots from your target, select the content roots from the list and click
Delete.
12 On the Filters tab, specify include and exclude filters, size filters, and date filters.
■ Use Include Filters and Exclude Filters to specify the files that Symantec Data Loss
Prevention should process or skip. Note that you must specify absolute paths. If the
field is empty, Symantec Data Loss Prevention performs matching on all files in the
file share. If you enter any values for the Include Filters, Symantec Data Loss
Prevention scans only those folders, files, or documents that match your filter. Delimit
entries with a comma, but do not use any spaces. When both Include Filters and
Exclude Filters are present, Exclude Filters take precedence.
See “Setting up Endpoint Discover filters to include or exclude items from the scan”
on page 1773.
When scanning DFS shares, exclude the internal DFS folder.
See “Excluding internal DFS folders” on page 1613.
When scanning shares on a NetApp filer with the Snapshot application, exclude the
.snapshot folder. This folder is usually at the base of the file system or network share;
for example, \\myshare\.snapshot.
■ Specify size filters.
The size filters let you exclude files from the matching process based on their size.
Symantec Data Loss Prevention includes only the files that match your specified size
 Setting up scans of file shares 1618
Optimizing file system target scanning

filters. If you leave these fields empty, Symantec Data Loss Prevention performs
matching on files or documents of all sizes.
■ Specify date filters.
The date filters let you include files from the matching process based on their dates.
Any files that match the specified date filters are scanned.

13 On the Advanced tab, specify your Remediation Detection preferences to automatically

detect incident remediation status:
■ Item Modified: Automatically detect if an incident has been remediated by modifying
the offending file.
■ Policy Modified: Automatically detect if an incident has been remediated by a change
in your policy.
■ Item No Longer Exists: Automatically detect if an incident has been remediated by
deletion or removal.
See “About automatically tracking incident remediation status” on page 1608.
14 On the Advanced tab, select options to optimize scanning.
See “Optimizing file system target scanning” on page 1618.
15 On the Protect tab, specify your remediation preferences for files that contain confidential
information.
See “Configuring Network Protect for file shares” on page 1619.

Optimizing file system target scanning

To optimize scans of your File System scan target, you can configure throttling options, set
an incident threshold for scanning (Inventory Scanning), omit or select Outlook .pst files,
and enable or disable scans of administrative shares.
To throttle a file system target scan
1 Go to the Advanced tab of your target definition.
2 In the Maximum number of files scanned per minute per detection server field, type
the maximum number of files to be processed per minute per detection server.
3 In the Maximum size scanned per minute per detection server field, type the maximum
amount of data to be processed per minute per detection server. Select bytes, kilobytes
(KB), or megabytes (MB) from the drop-down list.
 Setting up scans of file shares 1619
Configuring Network Protect for file shares

To set an incident threshold

1 Go to the Advanced tab of your target definition.
2 In the Incident Threshold field enter the maximum number of incidents to be created
from a single file share (Content Root) or server (Machine).
3 Select Count Incidents By: Content Root or Machine.
A Content Root is one file share on the list from the Scanned Content tab. When the
incident threshold is reached, the scan moves to the next file share.
A Machine is a physical computer. When the incident threshold is reached, the scan
moves to the next item on the list to scan. If that item is on the same physical computer
as the previous item, it is skipped. The physical computer name must be exactly identical
in the list of items to scan for Network Discover to recognize that it is the same computer.
For example, \\localhost\myfiles and \\127.0.0.1\myfiles are treated as different
computers, even though they are logically the same.
If you use autodiscovery to scan open shares on a specified file server, the content root
and machine are the same thing.
To scan administrative shares
1 Go to the Advanced tab of your target definition.
2 In the Administrative Shares Scanning section, select Scan Administrative Shares.
You can also set up scanning of Outlook .pst files.
See “Configuring scans of Microsoft Outlook Personal Folders (.pst files)” on page 1613.

Configuring Network Protect for file shares

Use Network Protect to automatically copy or quarantine to a secure location the confidential
files that are found on public shares. Alternatively, you can encrypt confidential files.
Network Protect is only available for server-based scanning of CIFS shares. Network Protect
is not supported for .pst files.
With Network Protect enabled, a tab appears on the Add File System Target page that
contains the Network Protect remediation options. To use Network Protect, you must have
both a policy and a response rule configured in the Enforce Server administration console.
Also, the scan credentials (user name and password) must be present on the Scanned Content
tab for this target.
 Setting up scans of file shares 1620
Configuring Network Protect for file shares

To set up Network Protect for file shares

1 Create a policy with a response rule. Go to Manage > Policies > Response Rules and
click Add Response Rule.
See “About response rules” on page 1199.
2 Select Automated Response.
3 Click Next.
4 For the Action, select Network Protect: Copy File, Network Protect: Quarantine File,
or Network Protect: Encrypt File.
For the Quarantine File action, you can optionally leave a marker file in place of the file
that was removed by checking the Marker File check box. Type the marker text in the
Marker Text box. The marker file is a text file. The marker text can contain substitution
variables. Click inside the Marker Text box to see a list of insertion variables.
If the original file was of some other file type, the original file is moved to the quarantine
area. The marker file has the original file name plus a .txt extension. The default file
extensions that are retained are listed in the properties file
ProtectRemediation.properties. The retained file extensions include txt, doc, xls,
ppt, java, c, cpp, h, and js. For example, a file that is named myfile.pdf would have a
marker file name of myfile.pdf.txt.
You can create a new subdirectory for the quarantined files from each scan (the default).
You can change the default and append the scan information to the file name (versioning)
in one quarantine directory. Edit the properties file ProtectRemediation.properties to
change the default.

Note: The encryption function is available only if you have installed the Network Protect
ICE license and configured the Enforce Server to connect to the Symantec ICE Cloud.

5 Click Save.
6 Add a new policy, or edit an existing policy.
See “Configuring policies” on page 376.
7 Click the Response tab.
8 In the pull-down menu, select one of the response rules that you previously created.
9 Click Add Response Rule.
This response rule then specifies the automated response when this policy triggers an
incident during the scanning of a file.
Several response rules with different conditions can exist for a policy.
 Setting up scans of file shares 1621
Configuring Network Protect for file shares

10 Create a new file system Network Discover target, or edit an existing target.
See “Configuring scans of file systems” on page 1614.
11 With Network Protect enabled in the license, a Protect tab appears on the File System
target page that contains the Network Protect remediation options.
Under Allowed Protect Remediation, choose whether the file should be copied or
quarantined (moved) or encrypted to protect the information.
This selection must match the Action selection from the response rule.
Also, a response rule with that action (copy, quarantine, or encrypt) should exist within
one of the policies that are selected for this file system target.
12 If you chose to copy or quarantine confidential files, under Copy/Quarantine Share,
specify the share where files are quarantined or copied.
Optionally, you can select a named credential from the credential store in the Use Saved
Credentials drop-down menu.
13 If you chose to copy or quarantine confidential files, under Protect Credential, specify
the write-access credential for the location of the file that was scanned.
To move the files for quarantine during remediation, the Network Discover target definition
must have write access for both the quarantine location and the original file location.
Specify the path (location) where the files are copied or quarantined. Type the write-access
user name and password for that location.
Normally, scanned shares require only read-access credentials (for example, if the Copy
option was selected).
Specify the share write-access credential, if it is different from the read-access credential.
Optionally, you can select a named credential from the credential store in the Use Saved
Credentials drop-down menu.
See “Configuring the Enforce Server to connect to the Symantec ICE Cloud” on page 204.
 Chapter 63
Setting up scans of Lotus
Notes databases
This chapter includes the following topics:

■ Setting up server scans of IBM (Lotus) Notes databases

■ Supported IBM (Lotus) Notes targets

■ Configuring and running IBM (Lotus) Notes scans

■ Configuring IBM (Lotus) Notes DIIOP mode configuration scan options

Setting up server scans of IBM (Lotus) Notes

databases
You can configure scans of IBM (Lotus) Notes repositories. Symantec Data Loss Prevention
supports DIIOP mode scanning only.
See “Configuring and running IBM (Lotus) Notes scans” on page 1623.
To set up scanning of Lotus Notes databases, complete the following process:

Table 63-1 Setting up a Lotus Notes database scan

Step Action Description

1 Verify that your IBM (Lotus) Notes database is on the list of See “Supported IBM (Lotus) Notes targets”
supported targets. on page 1623.

2 Configure the scan for IBM (Lotus) Notes DIIOP mode. See “Configuring IBM (Lotus) Notes DIIOP
mode configuration scan options” on page 1626.
 Setting up scans of Lotus Notes databases 1623
Supported IBM (Lotus) Notes targets

Table 63-1 Setting up a Lotus Notes database scan (continued)

Step Action Description

3 Click Manage > Discover Scanning > Discover Targets to See “Configuring and running IBM (Lotus)
create a Lotus Notes target and to configure scans of Lotus Notes scans” on page 1623.
Notes databases.

4 Set any additional scan options for the IBM (Lotus) Notes target. See “Network Discover/Cloud Storage
Discover scan target configuration options”
on page 1532.

5 Start the IBM (Lotus) Notes database scan. Select the scan target from the list, then click
the Start icon.
Click Manage > Discover Scanning > Discover Targets.

6 Verify that the scan is running successfully. See “Managing Network Discover/Cloud
Storage Discover target scans” on page 1553.

Supported IBM (Lotus) Notes targets

The IBM Notes (formerly known as Lotus Notes) target supports scanning of the following
versions:
■ Lotus Notes 7.0 – 8.0

Note: Lotus Notes versions 7.0 – 8.0 are deprecated in Symantec Data Loss Prevention
15.0

■ Lotus Notes 8.5.x

■ IBM Notes 9.0.x
The files Notes.jar and NCSO.jar are in the Lotus Notes client installation directory. The
manifest version number of these files depend on the Domino server version.
■ Version 7 has a manifest version in the JAR file of 1.4.2
■ Version 8 has a manifest version in the JAR file of 1.5.0
■ Version 9 has a manifest version in the JAR file of 1.6.0

Configuring and running IBM (Lotus) Notes scans

Before you run a scan, you must set up a target.
 Setting up scans of Lotus Notes databases 1624
Configuring and running IBM (Lotus) Notes scans

To set up a new target for the scan of IBM (Lotus) Notes databases
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click New Target, and use the pull-down menu to select the Lotus Notes target type.
3 On the General tab, type the Name of this Discover target.
Type a unique name for the target, up to 255 characters.
4 Select the Policy Group.
If no other policy group has been selected, the Default Policy group is used. To apply a
policy group, select the policy group to use for this target. You can assign multiple policy
groups to a target.
You can define policy groups on the Policy Group List page.
5 Specify scheduling options.
Choose Submit Scan Job on Schedule to set up a schedule for scanning the specified
target. Select an option from the schedule drop-down list to display additional fields.
Choose Pause Scan between these times to automatically pause scans during the
specified time interval. You can override the pause window of a scan target by going to
the Discover Targets screen and clicking the start icon for the target entry. The pause
window remains intact, and any future scans that run up against the window can pause
as specified. You can also restart a paused scan by clicking the continue icon for the
target entry.
6 On the Targeting tab, under Scan Server and Target Endpoints, select the Discover
Server (or multiple Discover Servers) where you want to run the scan.
Only the detection servers that were configured as Discover Servers appear on the list.
If there is only one Discover Server on your network, the name of that server is
automatically specified. You should configure your Discover Servers before you configure
targets. You must specify at least one server before you can run a scan for this target.
7 On the Scanned Content tab, select or enter the credentials.
You can specify a default user name and password to access all Domino servers that are
specified in the target. Credentials can be overridden for a server by editing a single entry
in the list of Domino servers. Credentials for a single entry are possible only if the list is
created with individually entered server names. Credentials for a single entry are not
possible in an uploaded text file that contains the list of servers.
8 On the Scanned Content tab, specify the content root for a Lotus Notes scan as either
one Domino server, or a list of Domino servers.
Specify the databases to scan as follows:
■ Specify Domino Servers
 Setting up scans of Lotus Notes databases 1625
Configuring and running IBM (Lotus) Notes scans

Click Add Content Roots > By Direct Entry to specify the servers you want to scan.
Server credential information that is entered here takes precedence over the default
values and applies only to the server specified.

[hostname,username,password]

For a native mode configuration, you can use the name "local" in the list of Domino
servers. Specifying "local" includes the local databases visible to the client only to be
scanned. For example, instead of the URI enter the following text:

local

■ Use Domino Servers from an uploaded file

Create and save a plain text file (.txt) with the servers you want to scan. The server
credential cannot be specified in this text file. The user name and password from the
Scanned Content tab of the Add Lotus Notes Target page are used .
Example of the first few Domino servers in the list:

dominoserver1.company.com
dominoserver2.company.com
dominoserver3.company.com

Click Upload File to upload your list of Domino servers.

9 On the Filters tab, select path filters.
Use the Include Filters and Exclude Filters fields to specify the Lotus Notes database
names that Symantec Data Loss Prevention should target. The filters match the full path
of the database URI. If the field is empty, Symantec Data Loss Prevention scans all
databases in all specified Domino Servers. Delimit entries with commas. If a database
URI matches both an include and an exclude filter, the exclude filter takes precedence,
and the database is not scanned.
If an include filter does not match the content root database, the database is not scanned.
For example, if you want to match the file
notes://notes.example.com/ABC/2_databases/1.nsf/91A, the include filter *91A* will
not match, as the content root database is not included in the filter. The include filter
*1.nsf* scans the entire content root. The include filter /ABC/2_databases/1.nsf/91A
scans only the specified file. Note that the content root database starts with the / character.
See “Setting up Endpoint Discover filters to include or exclude items from the scan”
on page 1773.
10 On the Filters tab, select Document Size Filters.
You can specify documents to be ignored below and/or above a specified size.
 Setting up scans of Lotus Notes databases 1626
Configuring IBM (Lotus) Notes DIIOP mode configuration scan options

11 On the Filters tab, select a Differential scan (optional).

Select Only Scan files added or modified since the last full scan to have Symantec
Data Loss Prevention scan only the items or the documents that have been added or
modified since the last full scan. The first scan has to be a full (initial base) scan. A full
scan occurs if you select this option before Symantec Data Loss Prevention scans this
target for the first time.
12 On the Filters tab, select Document Date Filters.
Specify the date filters to exclude Lotus Notes documents from the scan based on their
dates. Only the documents that match the specified date filters are included.
13 Select the Advanced tab for options to optimize scanning. On the Advanced tab, you can
configure throttling options or Inventory Mode for scanning.
■ Throttling Options
Enter the maximum number of documents to be processed per minute per detection
server or the maximum number of bytes to be processed per minute per detection
server. For bytes, specify the unit of measurement from the drop-down list. The options
are bytes, KB (kilobytes), or MB (megabytes).
■ Inventory Scanning
Enter the number of incidents to produce before moving on to the next Domino server
that is specified in the Scanned Content tab. To audit whether confidential data exists
on a target, without scanning all of it, set up Inventory Mode for scanning. Setting
incident thresholds can improve the performance of scanning by skipping to the next
server to scan, rather than scanning everything.
See “Creating an inventory of the locations of unprotected sensitive data” on page 1549.

Configuring IBM (Lotus) Notes DIIOP mode

configuration scan options
In the file Crawler.properties, when lotusnotescrawler.use.diiop is set to true, DIIOP
(CORBA) is used to scan a Domino server. The scanner connects directly to the Domino server
with HTTP and DIIOP.
To configure an IBM (Lotus) Notes DIIOP mode configuration for scanning
1 Copy the Lotus Notes Java library files Notes.jar and NCSO.jar to the
SymantecDLP/Protect/plugins directory.

They can be found in the installation directories of an IBM (Lotus) Notes client, and an
IBM (Lotus) Domino server with the Domino Designer installed.
The Notes.jar file is in the following IBM (Lotus) Notes client default installation directories:
■ IBM Notes 8
 Setting up scans of Lotus Notes databases 1627
Configuring IBM (Lotus) Notes DIIOP mode configuration scan options

C:\Program Files\IBM\lotus\notes\jvm\lib\ext\Notes.jar

■ Lotus Notes 7

C:\Program Files\lotus\notes\jvm\lib\ext\Notes.jar

Use the version of the JAR file corresponding to the version of the IBM (Lotus) Notes
client.
See “Supported IBM (Lotus) Notes targets” on page 1623.
The NCSO.jar file is in the following IBM (Lotus) Domino server default installation
directories, when the Domino Designer is installed:
■ IBM Notes 8

C:\Program Files\IBM\lotus\Notes\Data\domino\java\NCSO.jar

■ Lotus Notes 7

C:\Program Files\lotus\notes\data\domino\java\NCSO.jar

2 In the file Crawler.properties, set the following property:

lotusnotescrawler.use.diiop = true

3 Start the HTTP service on the Domino server.

4 Start the DIIOP service on the Domino server.
5 On the Domino server, set the Allow HTTP connections to browse databases setting to
true.
6 When creating targets, enter the credentials of a user who has an Internet password.
 Chapter 64
Setting up scans of SQL
databases
This chapter includes the following topics:

■ Setting up server scans of SQL databases

■ Supported SQL database targets

■ Configuring and running SQL database scans

■ Installing the JDBC driver for SQL database targets

■ SQL database scan configuration properties

Setting up server scans of SQL databases

You can configure scanning of Oracle, SQL Server, or DB2 databases.
See “Configuring and running SQL database scans” on page 1629.
To set up scanning of SQL databases, complete the following process:

Table 64-1 Setting up an SQL database scan

Step Action Description

1 Verify that your SQL database is on the list of supported targets. See “Supported SQL database
targets” on page 1629.

2 Click Manage > Discover Scanning > Discover Targets to See “Configuring and running
create an SQL database target and to configure scans of SQL SQL database scans”
databases. on page 1629.
 Setting up scans of SQL databases 1629
Supported SQL database targets

Table 64-1 Setting up an SQL database scan (continued)

Step Action Description

3 Set any additional scan options for the SQL database target. See “Network Discover/Cloud
Storage Discover scan target
configuration options”
on page 1532.

4 Install the JDBC driver for the SQL database, if needed. See “Installing the JDBC driver
for SQL database targets”
on page 1633.

5 Start the SQL database scan. Select the scan target from the
target list, then click the Start
Click Manage > Discover Scanning > Discover Targets.
icon.

6 Verify that the scan is running successfully. See “Managing Network

Discover/Cloud Storage
Discover target scans”
on page 1553.

Supported SQL database targets

The following SQL Databases were tested with Network Discover Target scans:
■ Oracle 10g, 11g (11.2.x), and 12c (12.1.x) (the vendor_name is oracle)
■ SQL Server 2005, 2014, and 2016 (the vendor_name is sqlserver)
■ DB2 9.1, 9.2, 9.5, and 10.5 (the vendor_name is db2)

Note: DB2 9.1, 9.2, and 9.5 are deprecated in Symantec Data Loss Prevention 15.0.

Contact Symantec Data Loss Prevention support for information about scanning any other
SQL databases.

Configuring and running SQL database scans

You can configure and run scans on SQL databases to identify which databases contain
confidential data, or to locate the inappropriate presence of confidential data.
Scanning of SQL databases occurs for a specific set of column data types. The SQL Database
scan extracts data of the following Java Database Connectivity (JDBC) types: CLOB, BLOB,
BIGINT, CHAR, LONGVARCHAR, VARCHAR, TINYINT, SMALLINT, INTEGER, REAL,
 Setting up scans of SQL databases 1630
Configuring and running SQL database scans

DOUBLE, FLOAT, DECIMAL, NUMERIC, DATE, TIME, and TIMESTAMP. The mapping
between these column types and those of a specific database depends on the implementation
of the JDBC driver for the scan.
To set up a scan for an SQL Database
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click New Target, and use the pull-down menu to select the SQL Database target type.
3 On the General tab, type the Name of this Discover target.
Type a unique name for the target, up to 255 characters.
4 Select the Policy Group.
If no other policy group has been selected, the Default Policy group is used. To apply a
policy group, select the policy group to use for this target. You can assign multiple policy
groups to a target.
5 Specify scheduling options.
Choose Submit Scan Job on Schedule to set up a schedule for scanning the specified
target. Select an option from the Schedule drop-down list to display additional fields.
Choose Pause Scan between these times to automatically pause scans during the
specified time interval. You can override a target’s pause window by going to the Discover
Targets screen and clicking the start icon for the target entry. The pause window remains
intact, and any future scans that run up against the window can pause as specified. You
can also restart a paused scan by clicking the continue icon in the target entry.
6 On the Targeting tab, under Scan Server and Target Endpoints, select the Discover
Server (or multiple Discover Servers) where you want to run the scan.
Only the detection servers that were configured as Discover Servers appear on the list.
If there is only one Discover Server on your network, the name of that server is
automatically specified. You should configure your Discover Servers before you configure
targets. You must specify at least one server before you can run a scan for this target.
7 On the Scanned Content tab, select or enter the credentials.
8 Select one of the following methods for entering the databases:
■ Use database servers from an uploaded file
Create and save a plain text file (.txt) with the servers you want to scan. Click Browse
to locate the list and Upload to import it. The user name and password that is specified
on the Scanned Content tab of the Add SQL Database Target page is used.
Enter the databases using the following syntax. The vendor name can be oracle, db2,
or sqlserver. The data source is the subname of the JDBC connection string for that
driver and database. The documentation for the JDBC driver describes this subname.
You can optionally enter the maximum rows to scan per table in the database.
 Setting up scans of SQL databases 1631
Configuring and running SQL database scans

vendor_name:datasource[, maximum-rows-to-scan]

For example:

oracle:@//oracleserver.company.com:1521/mydatabase
db2://db2server.company.com:50000/mydatabase,300

For some SQL Servers, you must also specify the SQL instance name, as in the
following example:

sqlserver://sqlserver.company.com:1433/mydatabase;
instance=myinstance

■ Specify Database Servers

Click Add Content Roots > By Manual Entry to use a line editor to specify the
databases you want to scan. SQL Database information that is entered here takes
precedence over the default values and applies only to the database specified. You
can optionally enter the maximum rows to scan per table in the database.
Use the following syntax:

vendor-name:datasource[, [username, password]

[, maximum-rows-to-scan]]
 Setting up scans of SQL databases 1632
Configuring and running SQL database scans

9 On the Filters tab, enter the optional Include and Exclude filters.
Use the Include Filters and Exclude Filters to specify SQL databases and the tables that
Symantec Data Loss Prevention should process or skip.
When both Include Filters and Exclude Filters are used, the Exclude Filters take
precedence. Any table that matches the Include Filters is scanned, unless it also matches
the Exclude Filters, in which case it is not scanned.
If the Include Filters field is empty, Symantec Data Loss Prevention performs matching
on all tables. These tables are returned from the table query of the target SQL databases.
If you enter any values in the field, Symantec Data Loss Prevention scans only those
databases and tables that match your filter.
The syntax is a pattern for the database, a vertical bar, and a pattern for the table name.
Multiple patterns can be separated with commas. Standard pattern matching applies. For
example, “?” matches a single character.
Because the table name matching is not case-sensitive for many databases, upper case
conversion occurs. The table name in the pattern and the table name it is matched against
are converted to upper case before the match.
The following example would match the employee table in all databases.

*|employee

The following example would match all tables in all Oracle databases.

oracle:*|*

For SQL Server 2005 and DB2, the default table query returns table names in the format
schema_name.table_name. Include Filters and Exclude Filters for SQL Server and DB2
should match this format.
See the following examples:

sqlserver:*|HRschema.employee
sqlserver:*|*.employee

10 Select the Advanced tab for options to optimize scanning. On the Advanced tab, you
can configure throttling options or Inventory Mode for scanning.
■ Throttling Options
Enter the maximum number of rows to be processed per minute per detection server
or the maximum number of bytes to be processed per minute per detection server. If
you select both options, then the scan rate is slower than both options. The scan rate
is slower than the specified number of rows per minute and the specified number of
bytes per minute. For bytes, specify the unit of measurement from the drop-down list.
The options are bytes, KB (kilobytes), or MB (megabytes).
 Setting up scans of SQL databases 1633
Installing the JDBC driver for SQL database targets

■ Inventory Scanning
Enter the number of incidents to produce before moving on to the next item to scan.
The next item is the next database from the list in the Scanned Content tab. To audit
whether confidential data exists on a target, without scanning all of it, set up Inventory
Mode for scanning. Setting incident thresholds can improve the performance of scanning
by skipping to the next item to scan, rather than scanning everything.
See “Creating an inventory of the locations of unprotected sensitive data” on page 1549.

Installing the JDBC driver for SQL database targets

A JDBC driver must be installed on your Network Discover detection server for each database
type to be scanned.
To install the JDBC driver
1 Obtain the relevant JDBC driver.
■ The Oracle driver is already installed with the Network Discover Server, in the default
SQL drivers directory Protect/lib/jdbc.
The JDBC driver is Oracle JDBC driver version 10.2.0.3.0.
■ For Microsoft SQL Server, the open source driver jTDS, can be obtained from Source
Forge at http://jtds.sourceforge.net/.
The jTDS JDBC driver version 1.2.2 was tested with Network Discover.
■ For DB2, the IBM driver JAR files are in the IBM DB2 distribution, under the java folder.
They can be obtained from IBM at http://www.ibm.com/db2.
The IBM JDBC driver version 1.4.2 was tested with Network Discover.

2 Copy the driver files to the default SQL drivers directory Protect/lib/jdbc.
3 Change the permissions of the JDBC driver files so that the Protect user has at least read
permission.
4 The sqldatabasecrawler.properties file may also need to be modified to specify the
correct JAR names for the selected drivers.
See “SQL database scan configuration properties” on page 1633.

SQL database scan configuration properties

The following configuration properties can be edited in the sqldatabasecrawler.properties
configuration file on the Network Discover Server:
■ driver_class.vendor_name
 Setting up scans of SQL databases 1634
SQL database scan configuration properties

Specifies the class name of the JDBC driver to use. The JAR file for this driver must be
included in the directory that is named in sqldrivers.dir and must be named as
driver_jar.vendor_name.
Example:

driver_class.sqlserver = net.sourceforge.jtds.jdbc.Driver

■ driver_subprotocol.vendor_name
Specifies the subprotocol portion of the JDBC connection string.
Example:

driver_subprotocol.sqlserver = jtds:sqlserver

■ driver_jar.vendor_name
Specifies the list of JAR files that the driver requires. The JAR files are stored in the directory
that is named in sqldrivers.dir.
See “Installing the JDBC driver for SQL database targets” on page 1633.
Examples:

driver_jar.sqlserver = jtds-1.2.2.jar
driver_jar.db2 = db2jcc.jar, db2jcc_license_cu.jar

■ driver_table_query.vendor_name
Specifies the query to execute to return a list of tables to scan. Typically, the query should
return all user tables in the database. Note that the database account that issues this query
needs appropriate rights to be granted to it by the database administrator.
You must use an account to scan that can make the driver_table_query in
sqldatabasecrawler.properties and return results. You can test the scan configuration
by using sqlplus to log on as the scan user, and to run the query. If you get results, you
have the permissions to complete the scan. If you do not get results, then you either have
to change the query, or change the privileges for the scan user.
Example:

driver_table_query.sqlserver = SELECT table_schema

+ '.' + table_name FROM information_schema.tables

■ driver_row_selector.vendor_name
Specifies the format of the query to use to select the rows from the table. This vendor name
varies, depending on the database. Examples are included in the
sqldatabasecrawler.properties configuration file for the most common databases.
The following substitution variables are used in the query:
 Setting up scans of SQL databases 1635
SQL database scan configuration properties

0=TABLENAME
1=COLUMNS
2=ROWNUM

Example:

driver_row_selector.sqlserver = SELECT TOP {2} {1} FROM {0}

■ quote_table_names.vendor_name
Specifies whether table names are quoted before the row selection query is created.
Enabling this feature allows tables with numeric names to be scanned. For example,
Payroll.1 becomes “Payroll”.“1” when the name is quoted.
Example:

quote_table_names.sqlserver=true

■ sqldrivers.dir
Specifies the location of the directory in which the JDBC driver JAR files are placed.
 Chapter 65
Setting up scans of
SharePoint servers
This chapter includes the following topics:

■ Setting up server scans of SharePoint servers

■ About scans of SharePoint servers

■ Supported SharePoint server targets

■ Access privileges for SharePoint scans

■ About Alternate Access Mapping Collections

■ Configuring and running SharePoint server scans

■ Installing the SharePoint solution on the Web Front Ends in a farm

■ Enabling SharePoint scanning without installing the SharePoint solution

■ Setting up SharePoint scans to use Kerberos authentication

■ Troubleshooting SharePoint scans

Setting up server scans of SharePoint servers

To set up scanning of SharePoint servers, complete the following process:

Table 65-1 Setting up a SharePoint server scan

Step Action Description

1 Verify that your SharePoint server is on the list of See “Supported SharePoint server
supported targets. targets” on page 1639.
 Setting up scans of SharePoint servers 1637
About scans of SharePoint servers

Table 65-1 Setting up a SharePoint server scan (continued)

Step Action Description

2 Optional: Verify that you have sufficient permissions to See “Access privileges for
install the SharePoint solution on the Web Front Ends SharePoint scans” on page 1639.
in a Farm.
See “Installing the SharePoint
Also verify that the scan user has the permissions to run solution on the Web Front Ends in a
the scan of the SharePoint server. farm” on page 1644.

See “Configuring and running

SharePoint server scans”
on page 1640.

3 Optional: Install the SharePoint solution on the Web See “Installing the SharePoint
Front Ends in a Farm. solution on the Web Front Ends in a
farm” on page 1644.
Optional: configure your Discover server or servers to
scan SharePoint without using the SharePoint solution. See “Enabling SharePoint scanning
without installing the SharePoint
solution” on page 1646.

4 Click Manage > Discover Scanning > Discover See “Configuring and running
Targets to create a SharePoint target and to configure SharePoint server scans”
scans of SharePoint servers. on page 1640.

5 Set any additional scan options for the SharePoint target. See “Network Discover/Cloud
Storage Discover scan target
configuration options” on page 1532.

6 Start the SharePoint server scan. Click Manage > Discover Scanning
> Discover Targets.

Select the scan target from the target

list, then click the Start icon.

7 Verify that the scan is running successfully. See “Managing Network

Discover/Cloud Storage Discover
target scans” on page 1553.

About scans of SharePoint servers

The Network Discover Server locates a wide range of exposed confidential data on SharePoint
servers. It communicates with the Enforce Server to obtain information about policies and scan
targets. It sends information about the exposed confidential data that it finds to the Enforce
Server for reporting and remediation.
The following types of SharePoint items are scanned:
 Setting up scans of SharePoint servers 1638
About scans of SharePoint servers

■ Wiki pages
■ Blogs
■ Calendar entries
■ Tasks
■ Project tasks
■ Discussion entries
■ Contact lists
■ Announcements
■ Links
■ Surveys
■ Issue tracking
■ Custom lists
■ Documents in the document library

Note: Only the latest version of a document is scanned.

The communication between the Discover Server and the SharePoint Web Front End (WFE)
is SOAP-based.
Communication is secure when the SharePoint Web sites are configured to use SSL.
For HTTPS, validation of the server SSL certificate is not the default. To enable validation of
the server SSL certificate, turn on the advanced setting Discover.ValidateSSLCertificates.
Then import the server SSL certificate to the Discover Server.
See “Advanced server settings” on page 245.
See “Importing SSL certificates to Enforce or Discover servers” on page 238.
If the specified SharePoint site is configured to be on a port that is not the default (80), ensure
that the SharePoint server allows the Discover detection server to communicate on the required
port.
User access to the content is based on the rights for the specified user in SharePoint. Enter
the user credentials to specify this user when you configure a SharePoint scan.
See “Configuring and running SharePoint server scans” on page 1640.
 Setting up scans of SharePoint servers 1639
Supported SharePoint server targets

Supported SharePoint server targets

The following SharePoint server targets are supported:
■ Microsoft Office SharePoint Server 2007 (Deprecated in Symantec Data Loss Prevention
15.0.)
■ Microsoft Office SharePoint Server 2010 (Deprecated in Symantec Data Loss Prevention
15.0.)
■ Microsoft Office SharePoint Server 2010 SP1 (Deprecated in Symantec Data Loss
Prevention 15.0.)
■ Microsoft Office SharePoint Server 2010 SP2
■ Microsoft Office SharePoint Server 2013 (Deprecated in Symantec Data Loss Prevention
15.0.)
■ Microsoft Office SharePoint Server 2013 SP1
■ Microsoft Office SharePoint Server 2016
■ Microsoft Office SharePoint Online 2010 (Dedicated Mode) (Deprecated in Symantec Data
Loss Prevention 15.0 MP1.)
■ Microsoft Office SharePoint Online 2013 (Dedicated Mode) (Deprecated in Symantec Data
Loss Prevention 15.0 MP1.)
■ Microsoft Office SharePoint Online 2016 (Dedicated Mode) (Deprecated in Symantec Data
Loss Prevention 15.0 MP1.)

Access privileges for SharePoint scans

To perform the SharePoint scan, the user accounts should have sufficient rights to access
and browse the SharePoint site content. The user account must also have permission to invoke
Web services and permission to obtain the access control list (ACL).
These rights correspond to the lower-level SharePoint permissions “Browse Directories,” “Use
Remote Interfaces,” and “Enumerate Permissions.” Refer to the Microsoft SharePoint
documentation for more information on SharePoint permissions and permission levels. If the
user account does not have the “Enumerate Permissions” right, then the ACL is not obtained
for the SharePoint content.
The following permission levels in SharePoint already have these permissions defined:
■ Full Control (includes Browse Directories, Use Remote Interfaces, and Enumerate
permissions)
■ Design (includes Browse Directories and Use Remote Interfaces permissions)
■ Contribute (includes Browse Directories and Use Remote Interfaces permissions)
 Setting up scans of SharePoint servers 1640
About Alternate Access Mapping Collections

About Alternate Access Mapping Collections

SharePoint requires all URLs used to access a web application to be defined in Central
Administration as internal or public, and the Symantec SharePoint solution expects the user
to provide one of those defined URLs as a scan target. Use SharePoint's Alternate Access
Mapping Collection to define the web application URLs you use for scanning. For information
about configuring Alternate Access Mapping Collections, see
http://technet.microsoft.com/en-us/library/cc288609%28office.12%29.aspx.

Configuring and running SharePoint server scans

Before you run a scan, you must set up a target using the following procedure.
If you choose to use it, the SharePoint solution must be installed on the Web Front End in a
farm.
See “Installing the SharePoint solution on the Web Front Ends in a farm” on page 1644.
You can scan SharePoint repositories without using the SharePoint solution. Be aware that
SharePoint scans that do not use the SharePoint solution have the following limitations:
■ You cannot use a web application as a content root for the scan. Instead, you must manually
extract site collections to use as content roots.
See “To enumerate site collection URLs” on page 1647.
■ SharePoint incident details do not include any permissions-related information.
■ You cannot use any Server FlexResponse actions to remediate SharePoint incidents.
See “Enabling SharePoint scanning without installing the SharePoint solution” on page 1646.
To set up a new target for the scan of a SharePoint server
1 Click Manage > Discover Scanning > Discover Targets > New Target > Server >
SharePoint.
2 On the General tab, enter the name of this scan target.
3 Select the policy groups that contain the policies for this target scan.
 Setting up scans of SharePoint servers 1641
Configuring and running SharePoint server scans

4 Select Scheduling options.

Choose Submit Scan Job on Schedule to set up a schedule for scanning the specified
target. Select an option from the schedule drop-down list to display additional fields.
Choose Pause Scan between these times to automatically pause scans during the
specified time interval. You can override a target’s pause window by going to the Discover
Targets screen and clicking the start icon for the target entry. The pause window remains
intact, and any future scans that run up against the window can pause as specified. You
can also restart a paused scan by clicking the continue icon for the target entry.
See “Scheduling Network Discover/Cloud Storage Discover scans” on page 1535.
5 On the Targeting tab, select the Discover Servers where this target scan can run.
6 On the Scanned Content tab, enter the credentials for this scan.
You can use one of three authentication modes:
■ Windows (default)

Note: Select this option if you have configured the SharePoint Encrypt Server
FlexResponse action for the assigned policy group.

■ Forms
■ Claims, for Microsoft Active Directory Federation Services (ADFS) only
If you choose Claims authentication, enter the Federation Service Name. The
Federation Service Name is the URL of the ADFS server. You can find the correct
name in the Federation Services Properties section of the ADFS console.
You can specify a default user name for access to all SharePoint sites, except those
specified using the Add editor.
If you specify SharePoint sites with the Add editor, you can specify separate credentials
for each site.
The user accounts should have "Browse Directories" permissions in SharePoint to perform
the scan. To retrieve permissions, the user account needs the "Enumerate Permissions"
SharePoint permission level.
See “Access privileges for SharePoint scans” on page 1639.
7 Specify the SharePoint sites to scan.
For each site, enter a target URL to the SharePoint Web application or site collection or
site to be scanned. All the items in its child sites and sub sites are scanned.
For a Web application, specify for example: http://www.sharepoint.com:2020
 Setting up scans of SharePoint servers 1642
Configuring and running SharePoint server scans

For a site collection, specify for example:

http://www.sharepoint.com:2020/Sites/collection

For a site or sub-site, specify for example:

http://www.sharepoint.com:2020/Sites/mysharepoint/sub/mysite

For the SharePoint site, use the public URL instead of the internal URL.
The Following syntax applies for the URL and credentials on each line.

URL,[username,password]

Select one of the following methods of entering the location for the SharePoint server:
■ Uploaded file
Select Scan Sites From an Uploaded File. Create and save a plain text file (.txt)
listing the servers you want to scan. Create the file using an ASCII text editor and enter
one URL per line. Then click Browse to locate the file with the list. Click Upload Now
to import it.
■ Individual entries
Select Scan Sites. Click Add to use a line editor to specify the servers you want to
scan. Server information that is entered here takes precedence over the default values
and applies only to the path specified.

8 Under Scan Type, select Scan only new or modified items (incremental scan). This
option is the default for new targets.
If you have changed the policy or other definitions in an existing scan, you can set up the
next scan as a full scan. Select the following option:
Scan all items for the next scan. Subsequent scans will be incremental.
If you always want to scan all items in this target, select the following option:
Always scan all items (full scan)
 Setting up scans of SharePoint servers 1643
Configuring and running SharePoint server scans

9 On the Filters tab, select path filters.

Use the Include Filter and Exclude Filter to specify the items that Symantec Data Loss
Prevention should process or skip. If the field is empty, Symantec Data Loss Prevention
performs matching on all items. If you enter any values for the Include Filter, Symantec
Data Loss Prevention scans only those items that match your filter. Delimit entries with a
comma, but do not use any spaces.
You can provide filters using regular expressions, or paths relative to the location of the
SharePoint site. Filters can include a site collection, site, sub site, folder, file name, or file
extension. Filters cannot include the protocol or hostname. Path filters are not applied on
attachments of an item, such as a .doc attachment to a list item.
For example: to exclude the site https://app-1234.foo.com/sites/travel/XYZ, the
exclude filter *XYZ works, but https://app* and
https://app-1234.foo.com/sites/travel/XYZ* do not.
All path filters are case-sensitive.
For the Include Filter, regular expression matching is applied to files, but not to folders.
For the Exclude Filter, regular expression matching is applied to both files and folders.
Only the path until the first "?" or "*" is considered when a folder or file is matched.
When all the specified path filters are relative, the matching folder is skipped, and the
scan statistics do not include the items in the skipped folders.
For best result, begin your include or exclude filter with a wildcard character.
See “Setting up Endpoint Discover filters to include or exclude items from the scan”
on page 1773.
10 On the Filters tab, select date filters.
The date filters let you include items from the matching process based on their dates. Any
items that match the specified date filters are scanned.
See “Filtering Discover targets by date last accessed or modified” on page 1545.
11 On the Filters tab, select size filters.
The size filters let you exclude items from the matching process based on their size.
Symantec Data Loss Prevention includes only the items that match your specified size
filters. If you leave this field empty, Symantec Data Loss Prevention performs matching
on items or documents of all sizes.
See “Filtering Discover targets by item size” on page 1545.
12 Select the Advanced tab for options to optimize scanning. On the Advanced tab, you
can configure throttling options and set Inventory Mode for scanning.
■ Throttling Options
 Setting up scans of SharePoint servers 1644
Installing the SharePoint solution on the Web Front Ends in a farm

Specify the maximum number of items to be processed per minute per detection server,
or specify the maximum number of bytes to be processed per minute per detection
server. For bytes, specify the unit of measurement from the drop-down list. The options
are bytes, KB (kilobytes), or MB (megabytes).

Note: Byte throttling is only applied after the fetch of each item. Therefore, actual
network traffic may not exactly match the byte throttling that is set.

■ Inventory Scanning
Enter the number of incidents to produce before moving on to the next site to scan (a
URL from the Scanned Content tab). To audit whether confidential data exists on a
target, without scanning all of it, set up Inventory Mode for scanning. Setting incident
thresholds can improve the performance of scanning by skipping to the next site to
scan, rather than scanning everything.
After the incident threshold has been reached, the scanning of this site is stopped,
and scanning proceeds to the next site. Because the process is asynchronous, a few
more incidents may be created than specified in the incident threshold.

Installing the SharePoint solution on the Web Front

Ends in a farm
To scan a SharePoint target using Network Discover, you must install the Symantec SharePoint
solution on the Web Front Ends in a farm.
The SharePoint target running on Network Discover communicates with the SharePoint solution
and fetches content after the target is authenticated with SharePoint. You can configure the
application to use SSL if secure data transfer is required between the Network Discover and
SharePoint servers.
Specific permissions are required for the SharePoint solution installation process.
See “Access privileges for SharePoint scans” on page 1639.
The Symantec SharePoint solution is versioned, and is not backward-compatible. If you are
upgrading from Symantec Data Loss Prevention version 14.x or earlier, you must uninstall
your existing SharePoint solution and install the 15.0 version. Table 65-2 lists the SharePoint
Solution version that is compatible with your version of Symantec Data Loss Prevention.

Table 65-2 Symantec SharePoint Solution version compatibility

Symantec SharePoint Solution version Compatible Symantec Data Loss Prevention

versions

No version number 11.0 through 11.5

 Setting up scans of SharePoint servers 1645
Installing the SharePoint solution on the Web Front Ends in a farm

Table 65-2 Symantec SharePoint Solution version compatibility (continued)

Symantec SharePoint Solution version Compatible Symantec Data Loss Prevention

versions

11.5.1 11.5.1

11.6 11.6, 11.6.1, 11.6.2

12.0 12.0, 12.0.1

12.5 12.5, 12.5.1, 12.5.2

14.0 14.0, 14.0.1, 14.0.2

14.5 14.5, 14.5 MP1

14.6 14.6, 14.6 MP1

15.0 15.0

To install the Symantec SharePoint solution

1 Copy the SharePoint solution installer Symantec_DLP_Solution_15.0.exe to a temporary
directory on the SharePoint Web Front End. This file is located in the
DLP_Home\Symantec_DLP_15.0_Win\Third_Party\SharePoint or
DLP_Home/Symantec_DLP_15.0_Lin/Third_Party/SharePoint directory, where DLP_Home
is the name of the directory in which you unzipped the Symantec Data Loss Prevention
software.
2 Start the Windows SharePoint Services Administration service on the SharePoint server.
On the SharePoint server, click Start > All Programs > Administrative Tools >
SharePoint Central Administration.
3 Double-click the Symantec_DLP_Solution_15.0.exe file. The Symantec Data Loss
Prevention solution installation program starts.
4 Click Next, and the installation program performs a number of preliminary checks.
If one of these checks fail, correct the problem and restart the installation program.
Click Next.
5 Accept the Symantec License Agreement , and click Next.
6 The installation program copies the files and deploys the solution to all Web Applications
in the SharePoint farm.
7 After installation, verify that the SharePoint solution has been correctly deployed to the
server or server farm.
 Setting up scans of SharePoint servers 1646
Enabling SharePoint scanning without installing the SharePoint solution

8 Connect to SharePoint Central Administration. On the SharePoint server, go to Start

> All Programs > Administrative Tools > SharePoint Central Administration.
9 For SharePoint 2007, click the Operations tab. In the Global Configuration section,
select Solution management.
10 For SharePoint 2010, 2013, and 2016, click System Settings. Then select Manage Farm
Solutions.
11 Verify the deployment. If the solution is installed correctly, the list includes
symantec_dlp_solution.wsp.
12 If the solution must be removed, use the SharePoint retract and undeploy features.

Enabling SharePoint scanning without installing the

SharePoint solution
You can enable SharePoint scanning without installing the SharePoint solution of the Web
Front-End of your SharePoint farm. You may want to take this approach if you have multiple
SharePoint farms on isolated networks, for example.
Scanning SharePoint repositories without using the SharePoint solution entails the following
limitations:
■ You cannot use a web application as a content root for the scan. Instead, you must manually
extract site collections to use as content roots.
See “To enumerate site collection URLs” on page 1647.
■ SharePoint incident details do not include any permissions-related information.
■ You cannot use any Server FlexResponse actions to remediate SharePoint incidents,
including the SharePoint Encrypt response action.
To enable SharePoint scanning without installing the SharePoint solution
1 On each Discover detection server that you want to use to scan SharePoint repositories
without using the SharePoint solution, open the /Protect/config/Crawler.properties
file in a text editor.
2 Add sharepointcrawler.use.plugin=false to the Crawler.properties file.
3 Save the edited file.
4 Recycle the Discover detection server.
 Setting up scans of SharePoint servers 1647
Setting up SharePoint scans to use Kerberos authentication

To enumerate site collection URLs

1 Open Windows PowerShell and enter the following command, where "http://MyWebApp"
is your web application URL (line break added for legibility):

Get-SPWebApplication http://MyWebApp| Get-SPSite | Select Url |

Out-File -FilePath "C:\spSites.txt"

2 Use the spSites.txt file to enter your site collections when configuring your Discover
target.

Setting up SharePoint scans to use Kerberos

authentication
A SharePoint scan can optionally use Kerberos authentication.
SharePoint must already be set up to work with Kerberos authentication.
The Discover Server must then be configured to communicate with the Key Distribution Center
(KDC) and the SharePoint server.
To configure the Discover Server for Kerberos authentication
1 Create a file named krb5.conf which contains the realm and the KDC information. On
Windows, this file is usually named krb5.ini. A sample file is in the folder
C:\SymantecDLP\Protect\config (in a Windows default Symantec Data Loss Prevention
installation).
See “Creating the configuration file for Active Directory integration” on page 122.
2 Copy this file to the Discover Server into the folder C:/SymantecDLP/jre/lib/security/
(in a Windows default Symantec Data Loss Prevention installation).
 Setting up scans of SharePoint servers 1648
Troubleshooting SharePoint scans

3 Update the default realm and directory server parameters (realms) in this file.

[libdefaults]
default_realm = ENG.COMPANY.COM

[realms]
ENG.COMPANY.COM = {
kdc = engADserver.emg.company.com
}
MARK.COMPANY.COM = {
kdc = markADserver.emg.company.com
}

See “Creating the configuration file for Active Directory integration” on page 122.
4 On the Discover Server, update the Protect.properties file in the folder
C:\SymantecDLP\Protect\config (in a Windows default Symantec Data Loss Prevention
installation). Update the property that points to the updated krb5.ini file.

# Kerberos Configuration Information

java.security.krb5.conf=C:/SymantecDLP/jre/lib/security/krb5.ini

Troubleshooting SharePoint scans

Table 65-3 provides suggestions for troubleshooting issues with SharePoint scans.

Table 65-3 Troubleshooting SharePoint scans

Issue Recommended steps

If an internal SharePoint Specify the public URL for the SharePoint site. All the site collections are
URL is specified, only the scanned.
default site collection is
scanned.

No site collections, or Specify the site collection/site/web application URL with a fully qualified domain
only the default site name.
collection, are scanned
To validate the access from the Discover Server, try to access the SharePoint
when the Discover
URL from a browser. If a short name does not work, try to use the fully qualified
Server and SharePoint
domain name.
site are in different
domains. Only the default site collection is scanned if the web application URL does
not contain fully qualified domain name.
 Setting up scans of SharePoint servers 1649
Troubleshooting SharePoint scans

Table 65-3 Troubleshooting SharePoint scans (continued)

Issue Recommended steps

The bytes reported as To improve performance, the scan statistics do not include items in the folders
scanned does not match that are skipped (filtered out).
the number of bytes in
Dynamic content, such as .aspx files, can change size.
the content.
You can set the Advanced Server setting
Discover.countAllFilteredItems to get more accurate scan statistics.

See “Advanced server settings” on page 245.

Scans are not working
properly with Kerberos
configured.
If you are having trouble with Kerberos authentication, check the following
items:
■ Ensure that DNS resolution for the domain controller and SharePoint
servers is successful from the detection server.
■ Ensure that client integration is enable for the zone in which the web
application runs.
■ Consider adding domain realms to the
C:/SymantecDLP/jre/lib/security/krb5.ini file. For example:

[domain_realms]
.MYDOMAIN.COM=MYDOMAIN.COM

Scans using Confirm that the Federation Service Name is entered correctly. The
claims-based Federation Service Name is the URL of the ADFS server. You can find the
authentication fail with an correct name in the Federation Services Properties section of the ADFS
ADFS connection error. console.

General troubleshooting Symantec Data Loss Prevention logs scan errors in the scan log and the file
reader logs.
 Chapter 66
Setting up scans of
Exchange servers
This chapter includes the following topics:

■ Setting up server scans of Exchange repositories

■ About scans of Exchange servers

■ Supported Exchange Server targets

■ Configuring Exchange Server scans

■ Setting up Exchange scans to use Kerberos authentication

■ Example configurations and use cases for Exchange scans

■ Troubleshooting Exchange scans

Setting up server scans of Exchange repositories

You can crawl Exchange 2007 SP2 (and later), 2010, 2013, and 2016 (on-premises) servers.

Table 66-1 Setting up an Exchange server scan

Step Action Description

1 Verify that Exchange Web Services and the For information about Exchange Web Services and the
Autodiscover Service are enabled on your Exchange Autodiscover service, see your Microsoft Exchange
server and are accessible from the Network Discover documentation.
server.
 Setting up scans of Exchange servers 1651
About scans of Exchange servers

Table 66-1 Setting up an Exchange server scan (continued)

Step Action Description

2 If you need secure access between the Discover Server By default, Symantec Data Loss Prevention only allows
and Exchange Web Services or your Active Directory HTTPS connections to the Active Directory server and
server, set up HTTPS and LDAPS. Exchange Web Services. To allow HTTP connections,
set the
Discover.Exchange.UseSecureHttpConnections
setting in Server Detail > Advanced Server Settings
to false.

See “Advanced server settings” on page 245.

3 Ensure that your Exchange user credentials can For information about enabling impersonation for your
impersonate any mailbox you want to scan. user credentials, see your Microsoft Exchange
documentation.

4 Go to Manage > Discover Scanning > Discover See “Configuring Exchange Server scans” on page 1653.
Targets to create an Exchange target and to configure
scans of Exchange servers.

5 Set any additional scan options for the Exchange See “Network Discover/Cloud Storage Discover scan
target. target configuration options” on page 1532.

6 Start the Exchange server scan. Go to Manage > Discover Scanning > Discover
Targets.

Select the scan target from the target list, then click
the Start icon.

7 Verify that the scan is running successfully. See “Managing Network Discover/Cloud Storage
Discover target scans” on page 1553.

About scans of Exchange servers

You can scan Exchange 2007 SP2 (and later), 2010, 2013, and 2016 (on-premises) servers.
Exchange scanning does not require an agent on the Exchange server, and it does not search
every Exchange server. Using the Exchange Autodiscover feature, it fetches Exchange server
and mailbox information from Active Directory, and pulls data directly from the appropriate
Exchange servers using the Simple Object Access Protocol (SOAP). For more information on
the Exchange Autodiscover feature, see
http://technet.microsoft.com/en-us/library/bb124251.aspx.
The Network Discover Server locates a range of exposed confidential data on Exchange
servers, including email messages, calendar items, contacts, journal, and flagged items.
Network Discover does not scan equipment or room mailboxes.
 Setting up scans of Exchange servers 1652
Supported Exchange Server targets

Communication is secure when the Exchange server is configured to use SSL (HTTPS).
Communication with the Active Directory server is secure when it is configured to use LDAPS.
For HTTPS, validation of the server SSL certificate is not the default. To enable validation of
the server SSL certificate, turn on the advanced setting Discover.ValidateSSLCertificates.
Then import the server SSL certificate to the Discover Server.
By default, Network Discover uses secure connections to the Exchange and Active Directory
servers. You can disable secure access to Exchange and Active Directory by setting the
Discover.Exchange.UseSecureHttpConnections setting in Server Detail > Advanced
Server Settings to false.
See “Advanced server settings” on page 245.
See “Importing SSL certificates to Enforce or Discover servers” on page 238.

Note: Network Discover does not support scans of Exchange targets using Dynamic Distribution
Groups.

Supported Exchange Server targets

Symantec Data Loss Prevention supports the following Exchange Server targets:
■ Microsoft Exchange Server 2007 SP3
■ Microsoft Exchange Server 2010 (Deprecated in Symantec Data Loss Prevention 15.0)
■ Microsoft Exchange Server 2010 SP1 (Deprecated in Symantec Data Loss Prevention
15.0)
■ Microsoft Exchange Server 2010 SP2 (Deprecated in Symantec Data Loss Prevention
15.0)
■ Microsoft Exchange Server 2013
■ Microsoft Exchange Server 2016 (on-premises)
To use the Exchange Web Services connector, Exchange Web Services and the Autodiscover
Service must be enabled on your Exchange server and are accessible to the Network Discover
server.
You can scan the data objects that are stored within Public Folders, such as:
■ Email messages
■ Message attachments
■ Microsoft Word documents
■ Excel spreadsheets
 Setting up scans of Exchange servers 1653
Configuring Exchange Server scans

The Exchange scan also targets mail stored in Exchange 2013 and 2016 Personal Archives.

Configuring Exchange Server scans

Before you run a scan, you must set up a target using the following procedure.
To set up a new target for the scan of an Exchange server
1 Go to Manage > Discover Scanning > Discover Targets > New Target > Server >
Exchange.
2 On the General tab, enter the name of this scan target.
3 Select the policy groups that contain the policies for this target scan.
4 Select Scheduling options.
Choose Submit Scan Job on Schedule to set up a schedule for scanning the specified
target. Select an option from the schedule drop-down list to display additional fields.
Choose Pause Scan between these times to automatically pause scans during the
specified time interval. You can override a target’s pause window by going to the Discover
Targets screen and clicking the start icon for the target entry. The pause window remains
intact, and any future scans that run up against the window can pause as specified. You
can also restart a paused scan by clicking the continue icon for the target entry.
See “Scheduling Network Discover/Cloud Storage Discover scans” on page 1535.
5 On the Targeting tab, select the Network Discover Servers where this target scan can
run.
6 On the Scanned Content tab, enter the credentials for this scan.
All Exchange user names must include the domain name, for example:

DOMAIN_NAME\user_name

Ensure that the user credentials you provide can impersonate all mailboxes you want to
scan. For information about configuring Exchange Impersonation, see
http://msdn.microsoft.com/en-us/library/bb204095.aspx.
See “Providing the password authentication for Network Discover scanned content”
on page 1537.
7 Enter a target URL for the Microsoft Active Directory server. For example,
ldaps://dc.domain.com:636.

Note: Only one Active Directory server can be specified per Discover target.
 Setting up scans of Exchange servers 1654
Configuring Exchange Server scans

8 Select Public folders to scan all public folders on the Exchange server. The user of the
credentials that are specified must have access to these public folders.

Note: In mixed Exchange environments where Exchange 2007, 2010, and 2013 servers
are deployed, Network Discover only scans the public folders from the version specified
by the credentials you entered in the Exchange Network Discover target. To scan public
folders across versions 2007, 2010, and 2013 in mixed environments, create a separate
Network Discover target for each version.

You can select this option in addition to All users on a Directory Server or Directory
groups and users.
9 Select Mailboxes to scan user mailboxes on your Exchange servers. Select one of the
following methods of entering the items to scan on the Exchange server:
■ All users on Directory Server
If a directory server is available, then select the Directory Server from the drop-down
list.
To use this option, select the Directory Server connection you have already specified,
or click the Create new Directory Connection link to configure another directory
connection.
See “Configuring directory server connections” on page 141.
■ Directory groups and users
If directory user groups are available, then select the groups to include in this target.
To use this option, directory groups must be established. If no directory groups are
set up, click the link Create new User Group to jump to the page to configure the
directory user groups.
See “Configuring User Groups” on page 748.
■ Specify User Mailboxes to include in this Target
Enter specific mailboxes. Alphanumeric characters and the following special characters
are allowed in mailbox names:

! # $ ' - ^ _ ` { }

You can combine this option with directory groups and users. No directory groups are
needed for the user mailboxes option.
■ Personal Archives
Select this option to scan Exchange 2010 and 2013 Personal Archive mailboxes for
the users you have specified.
 Setting up scans of Exchange servers 1655
Configuring Exchange Server scans

10 On the Filters tab, select path filters.

Use Include Filters and Exclude Filters to specify the items that Symantec Data Loss
Prevention should process or skip. If the field is empty, Symantec Data Loss Prevention
performs matching on all items. If you enter any values for the Include Filter, Symantec
Data Loss Prevention scans only those items that match your filter. Delimit entries with a
comma, but do not use any spaces.
You can provide filters using regular expressions, or paths relative to the location of the
Exchange site. Filters can include a folder name or file name. All path filters are
case-sensitive .
Exchange may append an email identifier to the end of the path. To match the filter, add
a wildcard to the end. For example to filter for “sample public folder item” use the following
filter:

*/folder/*/*sample public folder item*

You can provide filters using regular expressions, or paths relative to the location of the
Exchange site. Filters can include a site collection, site, sub site, folder, file name, or file
extension. All path filters are case-sensitive .
For Include Filters, regular expression matching is applied to files, but not to folders.
For Exclude Filters, regular expression matching is applied to both files and folders.
Only the path until the first "?" or "*" is considered when a folder or file is matched.
When all the specified path filters are relative, the matching folder is skipped, and the
scan statistics do not include the items in the skipped folders.
See “Setting up Endpoint Discover filters to include or exclude items from the scan”
on page 1773.
11 On the Filters tab, select size filters.
The size filters let you exclude items from the matching process based on their size.
Symantec Data Loss Prevention includes only the items that match your specified size
filters. If you leave this field empty, Symantec Data Loss Prevention performs matching
on items of all sizes.
See “Filtering Discover targets by item size” on page 1545.
12 On the Filters tab, select a differential scan (optional).
Select Only Scan files added or modified since the last full scan to have Symantec
Data Loss Prevention scan only the items or the documents that have been added or
modified since the last full scan. The first scan has to be a full (initial base) scan. A full
scan occurs if you select this option before Symantec Data Loss Prevention scans this
target for the first time.
 Setting up scans of Exchange servers 1656
Setting up Exchange scans to use Kerberos authentication

13 Select Date Filters.

The date filters let you include items from the matching process based on their dates. Any
items that match the specified date filters are scanned.
See “Filtering Discover targets by date last accessed or modified” on page 1545.
14 Select the Advanced tab for options to optimize scanning. On the Advanced tab, you
can configure throttling options and set Inventory Mode for scanning.
■ Throttling Options
You can use throttling to limit the bandwidth consumed by your scan, or to limit the
load on your Exchange server. Specify the maximum number of items to be processed
per minute per detection server, or specify the maximum number of bytes to be
processed per minute per detection server. For bytes, specify the unit of measurement
from the drop-down list. The options are bytes, KB (kilobytes), or MB (megabytes).
■ Inventory Scanning
Enter the number of incidents to produce before completing this scan. To audit whether
confidential data exists on a target, without scanning all of it, set up inventory mode
for scanning.
After the incident threshold has been reached, the scanning is stopped. Because the
process is asynchronous, a few more incidents may be created than specified in the
incident threshold.

Setting up Exchange scans to use Kerberos

authentication
An Exchange scan can optionally use Kerberos authentication.
Exchange must already be set up to work with Kerberos authentication.
The Discover Server must then be configured to communicate with the Key Distribution Center
(KDC) and the Exchange server.
To configure the Discover Server for Kerberos authentication
1 Create a file named krb5.conf which contains the realm and the KDC information. On
Windows, this file is usually named krb5.ini. A sample file is in the folder
C:\SymantecDLP\Protect\config (in a Windows default Symantec Data Loss Prevention
installation).
See “Creating the configuration file for Active Directory integration” on page 122.
2 Copy this file to the Discover Server into the folder C:/SymantecDLP/jre/lib/security/
(in a Windows default Symantec Data Loss Prevention installation).
 Setting up scans of Exchange servers 1657
Example configurations and use cases for Exchange scans

3 Update the default realm and directory server parameters (realms) in this file.

[libdefaults]
default_realm = ENG.COMPANY.COM

[realms]
ENG.COMPANY.COM = {
kdc = engADserver.emg.company.com
}
MARK.COMPANY.COM = {
kdc = markADserver.emg.company.com
}

See “Creating the configuration file for Active Directory integration” on page 122.
4 On the Discover Server, update the Protect.properties file in the folder
C:\SymantecDLP\Protect\config (in a Windows default Symantec Data Loss Prevention
installation). Update the property that points to the updated krb5.ini file.

# Kerberos Configuration Information

java.security.krb5.conf=C:/SymantecDLP/jre/lib/security/krb5.ini

Example configurations and use cases for Exchange

scans
Table 66-2 lists the options to select on the Scanned Content tab during the configuration of
an Exchange target.
Ensure that the user credentials you provide can impersonate all mailboxes you want to scan.
For information about configuring Exchange Impersonation, see
http://msdn.microsoft.com/en-us/library/bb204095.aspx.

Table 66-2 Exchange scan use cases

Use case Description

Scan all user mailboxes and Select the following options in the user interface:
public folders.
■ Public folders
■ Mailboxes > All users on Directory Server

The credentials must have permission to impersonate all mailboxes you want to scan.

Scan all user mailboxes (but Select Mailboxes > All users on Directory Server in the user interface.
not public folders).
The credentials must have permission to impersonate all mailboxes you want to scan.
 Setting up scans of Exchange servers 1658
Troubleshooting Exchange scans

Table 66-2 Exchange scan use cases (continued)

Use case Description

Scan all public folders. Select Public folders in the user interface.

Scan specific groups or Select Mailboxes > Directory groups and users in the user interface.
users.
To scan a Directory Group, select the Directory Group from the groups in the list. All
user mailboxes in the group are scanned. You can click Create new User Group to
create a new Directory Group.

To scan for specific users, enter a comma-separated list of user mailbox names.

The credentials must have permission to impersonate all mailboxes you want to scan.

Scan an Exchange 2010 Select Mailboxes > All users on Directory Server > Personal Archives or Mailboxes
Personal Archive. > Directory groups and users > Personal Archives in the user interface. If necessary,
specify which mailboxes to scan. Network Discover scans the Personal Archives
associated with the specified mailboxes.

Troubleshooting Exchange scans

If you experience problems with Exchange scans, you can look for more information here:
■ FileReader0.log: This file logs all SOAP requests and responses between Network
Discover and Exchange Web Services.
To configure the file reader log to list SOAP requests, edit the
FileReaderLogging.properties file as follows:

java.util.logging.FileHandler.level = FINEST
org.apache.cxf.interceptor.LoggingInInterceptor.level = FINEST
org.apache.commons.beanutils.converters.level = WARNING

See “Operational log files” on page 294.

Note: Only the java.util.logging.FileHandler.level = FINEST line is present. You must add
the others as specified in the above example.

■ Exchange logs: You might find useful troubleshooting information in the logs created by
your Microsoft Exchange Server.
 Chapter 67
About Network Discover
scanners
This chapter includes the following topics:

■ Setting up scanning of Microsoft Exchange Servers

■ How Network Discover scanners work

■ Troubleshooting scanners

■ Scanner processes

■ Scanner installation directory structure

■ Scanner configuration files

■ Scanner controller configuration options

Setting up scanning of Microsoft Exchange Servers

The Exchange Scanner is a stand-alone utility that lets you extract data from Microsoft Exchange
and send the data to Network Discover for content processing.
The Exchange scanner accesses client mailboxes on the Exchange server using a connected
Outlook client.
The Exchange scanner lets you specify which MAPI profile should be used to extract data
from the Exchange structure. The Exchange scanner uses Profiles to connect to the Exchange
Server through the MAPI interface. It then posts the files to Discover.
You can use the Exchange Scanner to perform the following tasks:
■ Scan public folders using a specific account to find the confidential data.
■ Scan all the mailboxes using an Administrator account that can access all the mailboxes.
 About Network Discover scanners 1660
How Network Discover scanners work

■ Scan a particular user's mailbox using the Administrator account.

■ Scan a single user's mailbox, with the user name and password known.
To set up scanning of Microsoft Exchange Servers , complete the following process:

Table 67-1 Setting up an Exchange scanner

Step Action Description

1 Verify that your Exchange server is either version 2003

or 2007.

2 Install the Exchange scanner on any computer that has

Microsoft Outlook 2003 or 2007 installed and a valid
Outlook profile configured.

3 Configure the ProfileName, and the setting for

DNMailbox.

4 Perform any manual configurations by editing the

configuration files and properties files.

5 On the Enforce Server, add a new Exchange target. See “Adding a new Network
Discover/Cloud Storage Discover
target” on page 1529.

6 Start the Exchange scan. See “Starting file system scans”

on page 1672.
Start the scanner on the scanner computer, and also
start the scan on the Enforce Server.

7 Verify that the scan is running successfully. See “Troubleshooting scanners”

on page 1661.

How Network Discover scanners work

Scanners are the standalone applications that collect content and metadata from a repository
and send them to Network Discover for processing.
For example, in a two-tier configuration you might have an Enforce Server and a Network
Discover Server that is connected to a Documentum server with a scanner installed.
You can perform the following tasks on the computers in this configuration:
■ On the Enforce Server, define the scan target (in this example, Documentum).
■ On the Documentum server, install the Documentum scanner, configure the scanner to
post content to the Network Discover Server, and start (or stop) a scanner.
 About Network Discover scanners 1661
Troubleshooting scanners

■ On the Enforce Server, start or stop a target scan (with the Start icon), and view the incident
reports.
The scanner system communicates with the Network Discover Server using the HTTP protocol.
When the scanner runs, it performs following tasks:
■ Natively connects to the repository, and crawls the repository to read the content and
metadata.
■ Extracts the text and some metadata.
■ Posts this extracted information to the Network Discover Server.
■ Network Discover consumes the text and metadata and applies detection.
See “About Network Discover/Cloud Storage Discover” on page 1522.

Troubleshooting scanners
After a scan is started, it extracts content and metadata from the repository. Then it passes
this content to the Scan Controller and the Network Discover Server.
See “How Network Discover scanners work” on page 1660.
If a scanner does not seem to be processing items, use the following suggestions:

Table 67-2 Scanner troubleshooting suggestions

Issue Suggestions

Scanner does not seem to Verify that the scanner was installed properly.
be running.
On the system where the scanner is installed, make sure that the scanner processes
are running.

See “Scanner processes” on page 1662.

Incidents do not appear in Verify that the scan target is set up properly. Scanners can only send content to a target
the reports. of the same type. Multiple scanners of the same type can feed content to a Network
Discover scan of that type.

Check that the scan is not stalled.

The scan does not seem to Look in the outgoing folder.

start.
See “Scanner installation directory structure” on page 1663.

If a given scanner cannot send content to Network Discover, that content queues up in
the outgoing folder.

Items that appear and disappear from this folder indicate normal progress.
 About Network Discover scanners 1662
Scanner processes

Table 67-2 Scanner troubleshooting suggestions (continued)

Issue Suggestions

The scan appears stalled. If a scanner cannot send content to Network Discover, the scanner content queues up
on the scanner system. The scanner system must have access to the Network Discover
Server. System warnings such as low disk space or down services should be in place
on both systems before installation.

To verify received content on the Network Discover Server, view the scan statistics page
of the scan. To view scan statistics, click on the running scan in the target scan list.

Verify that scan information moves through the scan process by checking the logs and
temporary directories.

See “Scanner installation directory structure” on page 1663.

If the scan appears stalled, check the following locations on the scanner computer to
diagnose the problem:

■ The /logs folder

The /scanner_typeScanner/logs folder has the scanner start, stop, and
connection status to Network Discover. Similar information is in the Console Window.
Check the log files to verify that a scanner is running successfully.
■ The /failed folder
Items that appear in the /failed folder indicate a mismatch of the scanner types,
between the New Target and the scanner. For example if an Exchange scanner is
specified in the New Target, but the scanner is SharePoint, then items appear in the
/failed folder.
■ The /outgoing folder
Items that appear and disappear from this folder indicate normal progress. If items
linger in this folder and are not consumed (do not disappear), a problem in extracting
text and metadata is indicated.
If a given scanner cannot send content to Network Discover, that content queues up
in the /outgoing folder.
■ The /scanner_typeScanner/scanner directory has the scanner connection
status to the repository, repository crawling information, and fetched data.

Scanner processes
Table 67-3 provides the information about Network Discover scanner processes on a Windows
operating system.
 About Network Discover scanners 1663
Scanner installation directory structure

Table 67-3 Discover processes

Processes Executable Description

ScannerController scanner_typeScanner_Console.exe Process that configures and controls

the connector, sends content to the
or
Network Discover Server, and sends
scanner_typeScanner_Service.exe end-of-scan message to Network
Discover.

Connector scanner_typeScanner.exe Process that extracts documents

and metadata from the repository.

ImportModule ImportSlave.exe Process that extracts text and

metadata from the documents that
the connector downloaded.

KeyView KVoop.exe The KeyView process does the text

extraction and metadata extraction
from known document types.

Binslave BinSlave.exe Process that attempts to extract text

from unknown document types.

Scanner installation directory structure

Table 67-4 describes the directory structure for Network Discover scanner configuration files.

Table 67-4 Installation directory structure

Path Description

/scanner_typeScanner

..../bin Files to run the scanner, start, and stop it.

......../Clean.exe Cleans all temp files and logs under the /scanner
directory.

......../EncryptPassword.exe Can be used to encrypt the user names and

passwords that are put in the
scanner_typeScanner.cfg file.

......../scanner_typeScanner_Console.exe Launches the scanner as a console application

(with a window). Type CTRL+C to stop the
scanner.
 About Network Discover scanners 1664
Scanner configuration files

Table 67-4 Installation directory structure (continued)

Path Description

......../scanner_typeScanner_Service.exe Launches the scanner as an application without a

window. Typically, this launch is only used when
the scanner is registered and run as a Windows
or UNIX service.

..../config Configuration files are in this directory.

......../ScannerController.properties Configuration file for the ScannerController.

......../ScannerControllerLogging.properties Properties file for the Scanner logging.

......../scanner_typeScanner.cfg The configuration file for the connector. This file

is copied to the /scanner directory before the
child process is launched.

..../logs Contains the log files for the

ScannerController process.

..../outgoing XML files that contain content and metadata are

queued in this folder before they are sent to the
Network Discover Server.

..../scanner Binaries, the log files, and the temp files are under
this directory.

......../outgoing Some connectors (for example Exchange and

SharePoint2003) cannot be configured to write the
.idx files to the ./outgoing folder. Instead, they
write them to ./scanner/outgoing folder and
the ScannerController moves them to the
./outgoing directory so that they can be sent
to the Network Discover Server.

......../failed If the Network Discover Server cannot parse the

XML and returns a 500 error code, the
ScannerController moves the offending XML
document to the ./failed folder.

Scanner configuration files

Configuration options can be edited after installation and before you start a scan by editing
the following files on the scanner system.
 About Network Discover scanners 1665
Scanner controller configuration options

File name Configuration Tasks

ScannerController.properties In the ScannerController.properties file, you

can configure the following options:

■ Define Network Discover Server connection

information.
■ Provide content compression to reduce network
load.
■ Turn on and off incremental scanning. Additional
configuration may be required in the
Vontuscanner_typeScanner.cfg file.

See “Scanner controller configuration options”

on page 1665.

ScannerControllerLogging.properties In the ScannerControllerLogging.properties

file, you can configure the following options:

■ Specify the logging levels from .level = INFO to

.level = FINEST.

Vontuscanner_typeScanner.cfg In the Vontuscanner_typeScanner.cfg file, you

can configure the following options:

■ Specify multiple jobs (run sequentially).

■ Define access credentials.
See “Encrypting passwords in configuration files”
on page 1541.
■ Define filters.
■ Define throttling.
■ Specific settings are also available for each scanner
type.

Scanner controller configuration options

Initial scanner configuration occurs during installation. Following installation, you can modify
or specify additional scan settings.
Table 67-5 provides an explanation of commonly modified parameters in the
ScannerController.properties file.
 About Network Discover scanners 1666
Scanner controller configuration options

Table 67-5 Commonly modified parameters in ScannerController.properties

Parameter Default Description

discover.host localhost The host name or IP address of the Network Discover Server
the scanner routes content to. Before you configure this value,
the Network Discover Server should be added to the Enforce
Server, and access to it from the scanner verified.

discover.port 8090 The Network Discover port to which the scanner routes data.

discover.compress true Specify whether or not to compress content before routing it

to the Network Discover Server. Compression reduces network
load, but consumes extra CPU on the scanner computer and
on the Network Discover Server.

discover.retry.interval 1000 Milliseconds the scanner should wait before it retries to connect
to the Network Discover Server after a disconnect or previous
failure.

scanner.send.endofscanmarker true If this parameter is set to false, the scanner runs until it is
stopped manually in the Enforce Server console. The scan
restarts from the beginning after it reaches the end of the scan
list.

scanner.incremental false When true, the scanner only scans documents with created
or modified dates after the last complete scan. When false, all
files are scanned each time the scan is run.

dre.fake.port disabled Used only by certain scanners to prevent content from being
misdirected to an incorrect process. Must also be modified
http://localhost:19821
with values for DREHost and ACIPort in the
scanner_typeScanner.cfg file.

The dre.fake.port specifies the port that the

ScannerController binds to. It makes sure that the
connector does not attempt to send content to some other
process.

queue.folder.path disabled Used only for certain scanners to bridge a difference in location
between where .idx files are written and where they are
./scanner/outgoing
expected. This parameter is for the Exchange and SharePoint
2003 scanners.
 Chapter 68
Setting up scanning of file
systems
This chapter includes the following topics:

■ Setting up remote scanning of file systems

■ Supported file system scanner targets

■ Installing file system scanners

■ Starting file system scans

■ Installing file system scanners silently from the command line

■ Configuration options for file system scanners

■ Example configuration for scanning the C drive on a Windows computer

■ Example configuration for scanning the /usr directory on UNIX

■ Example configuration for scanning with include filters

■ Example configuration for scanning with exclude filters

■ Example configuration for scanning with include and exclude filters

■ Example configuration for scanning with date filtering

■ Example configuration for scanning with file size filtering

■ Example configuration for scanning that skips symbolic links on UNIX systems
 Setting up scanning of file systems 1668
Setting up remote scanning of file systems

Setting up remote scanning of file systems

Scanning the file systems that are not file shares or servers is accomplished with a multiple
computer installation. On the computer with the file system, scanning software sends data to
the Network Discover Server for processing.
See “How Network Discover scanners work” on page 1660.
For file shares, use the server file system target.
See “Setting up server scans of file systems” on page 1601.
To set up scanning of file systems, complete the following process:

Table 68-1 Setting up a file system scanner

Step Action Description

1 Verify that your file system is on the list of supported See “Supported file system scanner
targets. targets” on page 1669.

The file system scanner can scan local file systems on

remote Windows, Linux, AIX, and Solaris servers.

2 On the server that contains the file system, install the See “Installing file system scanners”
file system scanner. on page 1669.

The setup for scanning file systems requires installation See “Installing file system scanners
of the scanner software on the computer where the file silently from the command line”
system is located. on page 1673.

On Linux, AIX, and Solaris, the root user must install the
scanner.

3 Perform any manual configurations by editing the See “Configuration options for file
configuration files and properties files. system scanners” on page 1674.

4 On the Enforce Server, add a new Scanner File System See “Adding a new Network
target. Discover/Cloud Storage Discover
target” on page 1529.

5 Start the file system scan. See “Starting file system scans”
on page 1672.
Start the scanner on the scanner computer, and also
start the scan on the Enforce Server.

6 Verify that the scan is running successfully. See “Troubleshooting scanners”

on page 1661.
 Setting up scanning of file systems 1669
Supported file system scanner targets

Supported file system scanner targets

The following remote Windows systems can be scanned:
■ Windows Server 2008 R2
■ Windows Server 2012 R2
■ Windows Server 2016
The following Linux file systems can be scanned:
■ Red Hat Enterprise Linux 5.x
■ Red Hat Enterprise Linux 6.x
■ Red Hat Enterprise Linux 7.4
The following AIX file systems can be scanned:
■ AIX 7.1
AIX requires the following C run time libraries, as well as Java 1.5 and Java 7 JRE:
■ xlC.aix50.rte (v8.0.0.0+)

■ xlC.rte (v8.0.0.0+)

The following 32-bit Solaris file systems can be scanned (64-bit systems are not supported):
■ Solaris 9 (SPARC platform)
■ Solaris 10 (SPARC platform)
Solaris requires the following patch levels for the scanner:
■ Solaris 9, 115697-01
http://sunsolve.sun.com/search/document.do?assetkey=1-21-115697-02-1
File systems on UNIX systems can also be scanned using the SFTP protocol. This protocol
provides a method similar to share-based file scanning, instead of using the File System
Scanner. Contact Symantec Professional Services for details.

Installing file system scanners

The File System Scanner must be installed on the computer with the file system you want to
scan.
On Linux, AIX, and Solaris, the root user must install the scanner.
If a user other than the one who installed the scanner wants to run it, permissions must be
changed. On Linux, AIX, and Solaris, appropriate permissions must be given to the directories
and files.
 Setting up scanning of file systems 1670
Installing file system scanners

To install the file system scanner

1 On the computer with the file system to scan, download or copy (as binary) the relevant
installation file to a temporary directory. The file is located in the
DLP_Home\Symantec_DLP_15.0_Win\Scanners or
DLP_Home/Symantec_DLP_15.0_Lin/Scanners directory, where DLP_Home is the name
of the directory in which you unzipped the Symantec Data Loss Prevention software.
The file is one of the following file names:
■ SymantecDLPScanners_windows_x32_15.0.exe

■ SymantecDLPScanners_Aix_15.0.sh

■ SymantecDLPScanners_Unix_x32_15.0.sh (for 32-bit Linux systems)

■ SymantecDLPScanners_Unix_x64_15.0.sh (for 64-bit Linux systems)

Note: You can install either the 32-bit or 64-bit scanner on 64-bit Linux systems.
Symantec recommends the 64-bit version.

■ SymantecDLPScanners_Solaris_15.0.sh

2 Start the scanner installation program.

Use the -c flag to install a scanner with a console command (rather than with a GUI).
Windows GUI:

SymantecDLPScanners_windows_x32_15.0.exe

32-bit Linux GUI:

./SymantecDLPScanners_Unix_x32_15.0.sh

32-bit Linux console:

./SymantecDLPScanners_Unix_x32_15.0.sh -c

3 If applicable, confirm the version of the scanner you want to install (32-bit or 64-bit).
4 Confirm the license ageement.
5 Select File System Scanner.
6 Select the installation Destination Directory (the directory where you want the SymantecDLP
File System Scanner installed).
7 For Windows, select the Start Menu Folder (shortcut in the Start menu). The default is
SymantecDLP FileSystem Scanner.
 Setting up scanning of file systems 1671
Installing file system scanners

8 Enter the following connection information for the Network Discover Server:
■ Discover Host (IP or host name of the Network Discover Server)
■ Discover Port

9 Configure the File System Scanner by entering the following information:

■ Scan Directory
List of directories to scan. Delimit with a comma (no space).
■ Path Include Filter
Only the paths that include all the string(s) specified here are scanned. Delimit with a
comma (no space).
■ Path Exclude Filter
Everything but the directories that contain the string(s) specified here are scanned.
Delimit entries with a comma, but do not use any spaces.
Note that the Include Filter and Exclude Filter file names are relative to the file system
root. Specify full paths or subdirectories, as needed.

10 The scanner installs.

11 Select the Startup Mode.
While you initially test or verify that the scanner runs successfully, do not select either of
these options, but start the scanner manually.
You can select one (or none) of the following options:
■ Install as a service on a Windows system.
■ Start after installation.

12 The File Scanner installation is complete on the scanner computer.

13 Perform any manual configurations by editing the configuration files and properties files.
See “Configuration options for file system scanners” on page 1674.
See “Scanner installation directory structure” on page 1663.
See “Scanner configuration files” on page 1664.
14 On the Enforce Server, create a New Target for the scanner File System type.
15 Start the scan on both the scanner computer and the Enforce Server.
See “Starting file system scans” on page 1672.
 Setting up scanning of file systems 1672
Starting file system scans

Starting file system scans

Make sure that the scanner is installed and configured on the target computer, and a new
target is added on the Enforce Server.
See “Installing file system scanners” on page 1669.
Then, you can start the scan.
The procedures are different for each of the following scenarios:
■ One scanner per target (first procedure).
■ Multiple scanners for one target (second procedure).
To start a file system scan with one scanner for one target
1 Log on to the Enforce Server.
Go to Manage > Discover Scanning > Discover Targets to navigate to the list of targets.
2 Select the scan target from the target list, then click the Start icon.
3 On the scanner computer, start the File System scanner.
On Windows, select Start > Vontu FileSystem Scanner > Vontu FileSystem Scanner
Console.
On UNIX, enter the following command:

/opt/FileSystemScanner/bin/FileSystemScanner_Console

4 The scanner starts the process of scanning data.

See “How Network Discover scanners work” on page 1660.
5 If the scan does not progress normally, you can troubleshoot it.
See “Troubleshooting scanners” on page 1661.
6 Stop and restart the scanner whenever you make changes to the configuration file. To
stop the scanner, type the control-C character in the console window.
 Setting up scanning of file systems 1673
Installing file system scanners silently from the command line

To start a file system scan with multiple scanners for one target
1 On each of the scanner computers, start the File System scanner on that computer.
On Windows, select Start > Vontu FileSystem Scanner > Vontu FileSystem Scanner
Console.
On UNIX, enter the following command:

/opt/FileSystemScanner/bin/FileSystemScanner_Console

Make sure that each of the scanners has started, and has posted information. Check the
outgoing folder on each of the computers.

See “Scanner installation directory structure” on page 1663.

2 Log on to the Enforce Server.
Go to Manage > Discover Scanning > Discover Targets to navigate to the list of targets.
3 Select the scan target from the target list, then click the Start icon.
4 The scanner starts the process of scanning data.
See “How Network Discover scanners work” on page 1660.
5 If the scan does not progress normally, you can troubleshoot it.
See “Troubleshooting scanners” on page 1661.
6 Stop and restart the scanner whenever you make changes to the configuration file. To
stop the scanner, type the control-C character in the console window.

Installing file system scanners silently from the

command line
To automate installation, you can preconfigure a text file varfile with your installation choices,
and then launch the installation from a command line.
Another method of installing a scanner is with an interactive installation.
See “Installing file system scanners” on page 1669.
 Setting up scanning of file systems 1674
Configuration options for file system scanners

To automate file scanner installation

1 Create a text file, for example FileSystemScanner.varfile.
2 Enter your specific parameters, and save the file to the same location as the relevant shell
script for your scanner installation.

sys.programGroup.allUsers$Boolean=true
discover.host=test-server.test.lab
discover.port=8090
sys.service.selected.417$Boolean=true
job.0.excludeFilters=
sys.languageId=en
sys.programGroup.linkDir=/usr/local/bin
installService$Boolean=false
sys.installationDir=/opt/FileSystemScanner
sys.programGroup.enabled$Boolean=true
job.0.includeFilters=
job.0.directory=/home/text_files/text_scan/text
sys.service.startupType.417=auto
startAfterInstall$Boolean=false

3 To run the installation with the varfile, type the following command (for Linux):

# ./FileSystemScanner_Unix_11.6.sh
-varfile FileSystemScanner.varfile -q

The parameter -q performs a silent installation.

Configuration options for file system scanners

Table 68-2 provides a description of the primary parameters in the
VontuFileSystemScanner.cfg file.

Table 68-2 Parameters in the VontuFileSystemScanner.cfg file

Type Parameter Description

Scanned Content DirectoryPathCSVs Comma-separated list of directories to

scan.

Scanned Content DirectoryCantHaveCSVs Exclude filters of the paths. Delimit

entries with a comma, but do not use any
spaces.
 Setting up scanning of file systems 1675
Example configuration for scanning the C drive on a Windows computer

Table 68-2 Parameters in the VontuFileSystemScanner.cfg file (continued)

Type Parameter Description

Scanned Content DirectoryMustHaveCSVs Include filters of the paths. Delimit entries

with a comma, but do not use any
spaces.

Scanned Content DirectoryAfterDate Date filter (in days relative to today).

Scanned Content DirectoryBeforeDate Date filter (in days relative to today).

Scanned Content DirectoryFileMatch For scanning files without an extension

on Solaris or Linux systems, set this
parameter to the following value:

DirectoryFileMatch=*

Scanned Content ImportPreImportMinLength Minimum size of files.

Scanned Content ImportPreImportMaxLength Maximum size of files.

Throttling ImportPoliteness Specify the amount of time (in

milliseconds) that the import module
should wait between documents.

Throttling PollingMaxNumber The number of files that are aggregated

before they are imported into each XML
file that is sent to Network Discover.
See “Optimizing resources with Network
Discover/Cloud Storage Discover scan
throttling” on page 1548.

Example configuration for scanning the C drive on a

Windows computer
Scan the C drive on a Windows computer.
This configuration is in the file VontuFileSystemScanner.cfg.
See “Configuration options for file system scanners” on page 1674.

DirectoryPathCSVs=C:\
DirectoryMustHaveCSVs=
DirectoryCantHaveCSVs=
 Setting up scanning of file systems 1676
Example configuration for scanning the /usr directory on UNIX

Example configuration for scanning the /usr directory

on UNIX
Scan the /usr directory on a UNIX computer.
This configuration is in the file VontuFileSystemScanner.cfg.
See “Configuration options for file system scanners” on page 1674.

DirectoryPathCSVs=/usr
DirectoryMustHaveCSVs=
DirectoryCantHaveCSVs=

Example configuration for scanning with include

filters
Scan selected files and directories using the include filters.
This configuration is in the file VontuFileSystemScanner.cfg.
See “Configuration options for file system scanners” on page 1674.
Include only the files that have temp in the path under the directory C:\Windows.

DirectoryPathCSVs=C:\Windows
DirectoryMustHaveCSVs=*/temp/*
DirectoryCantHaveCSVs=

Include only the files that end with extension tmp or the directory name has xml in the path.

DirectoryPathCSVs=C:\Windows
DirectoryMustHaveCSVs=*/xml/*,*.tmp
DirectoryCantHaveCSVs=

Include only the files that end with the extension txt under the UNIX directory /home/data.

DirectoryPathCSVs=/home/data
DirectoryMustHaveCSVs=*.txt
DirectoryCantHaveCSVs=

Example configuration for scanning with exclude

filters
Scan selected files and directories using the exclude filters.
 Setting up scanning of file systems 1677
Example configuration for scanning with include and exclude filters

This configuration is in the file VontuFileSystemScanner.cfg.

See “Configuration options for file system scanners” on page 1674.
Exclude all the files with extension exe in the directory C:\Windows.

DirectoryPathCSVs=C:\Windows
DirectoryMustHaveCSVs=
DirectoryCantHaveCSVs=*.exe

Exclude all files that end with extension tmp or if the directory name contains bin under the
UNIX directory /home/data.

DirectoryPathCSVs=/home/data
DirectoryMustHaveCSVs=
DirectoryCantHaveCSVs=*/bin/*,*.tmp

Example configuration for scanning with include and

exclude filters
Scan selected files and directories using both the include and exclude filters.
This configuration is in the file VontuFileSystemScanner.cfg.
See “Configuration options for file system scanners” on page 1674.
Scan all directories with temp in the path or ending with pdf. Exclude files under the bin
directory or ending with tmp under the directory C:\data.

DirectoryPathCSVs=C:\data
DirectoryMustHaveCSVs=*/temp/*,*.pdf
DirectoryCantHaveCSVs=*/bin/*,*.tmp

Example configuration for scanning with date filtering

The parameters DirectoryBeforeDate and DirectoryAfterDate let you specify a date range
within which documents must be modified for the scanner to process them.
Use the parameter DirectoryAfterDate to enter a number of days relative to the current date
after which the page must be modified. A negative number specifies a date in the past.
User the parameter DirectoryBeforeDate to enter a number of days relative to the current
date before which the page must be modified.
In the examples, both DirectoryBeforeDate and DirectoryAfterDate are required.
This configuration is in the file VontuFileSystemScanner.cfg.
 Setting up scanning of file systems 1678
Example configuration for scanning with file size filtering

See “Configuration options for file system scanners” on page 1674.

Scan all the pdf files that have been modified in the last six months.

DirectoryMustHaveCSVs=*.pdf
DirectoryAfterDate=-180
DirectoryBeforeDate=0

Scan all files that have been modified between 60 days and 360 days in the past.

DirectoryAfterDate=-360
DirectoryBeforeDate=-60

Example configuration for scanning with file size

filtering
Scan files using file size filtering to limit what is scanned.
This configuration is in the file VontuFileSystemScanner.cfg.
See “Configuration options for file system scanners” on page 1674.
Scan all the files in the size range of 3000 bytes to 4000 bytes. Do not import any files that fall
outside the size range.

ImportPreImportMinLength=3000
ImportPreImportMaxLength=4000
ImportEmptyFiles=false

Scan all doc files greater than 4 KB.

DirectoryMustHaveCSVs=*.doc
ImportPreImportMinLength=4096
ImportEmptyFiles=false

Example configuration for scanning that skips

symbolic links on UNIX systems
Scan a UNIX system, but skip all the symbolic links.
Specify a file which contains all the files that the scanner should scan. Only those files are
scanned during the run. Place this file outside the scanner installation directory. In the example,
this file is named /opt/test/filenames.txt.
This configuration is in the file VontuFileSystemScanner.cfg.
 Setting up scanning of file systems 1679
Example configuration for scanning that skips symbolic links on UNIX systems

See “Configuration options for file system scanners” on page 1674.

Make sure that the DirectoryPathCSVs and related parameters are commented out. Also,
make sure that the parameter PollingMethod is present only once in the configuration file.

PollingMethod=1
FilePollFilename=/opt/test/filenames.txt
 Chapter 69
Setting up scanning of Web
servers
This chapter includes the following topics:

■ Setting up remote scanning of web servers

■ Supported web server (scanner) targets

■ Installing web server scanners

■ Starting web server scans

■ Configuration options for web server scanners

■ Example configuration for a web site scan with no authentication

■ Example configuration for a web site scan with basic authentication

■ Example configuration for a web site scan with form-based authentication

■ Example configuration for a web site scan with NTLM

■ Example of URL filtering for a web site scan

■ Example of date filtering for a web site scan

Setting up remote scanning of web servers

The web server scanner can retrieve web site documents.
The web server scanner uses crawlers to find web pages and to process the web pages for
content and links to other web sites. After a crawler has finished retrieving documents from
the web site, the web server scanner imports the content that the crawler has retrieved into
index file format (IDX). The scanner then posts the IDX files to Network Discover for content
 Setting up scanning of Web servers 1681
Supported web server (scanner) targets

processing. The web server scanner can retrieve content from various document types,
including web documents, Word, Excel, and PDF files.
The web server scanner crawls web pages for links and content. The crawler processes the
page content and either accepts or rejects the page for retrieval. If the page is accepted, the
crawler looks for links from the page, filters the links and queues the accepted links for the
crawler process. If the page is rejected, the crawler looks for links only if you have configured
it to follow links on rejected pages. The links are filtered before they are added to the crawler
queue. The crawler then retrieves the page content of accepted pages. The crawler requests
the next link in its queue, and the process repeats.
To set up scanning of web servers, complete the following process:

Table 69-1 Setting up a web server scanner

Step Action Description

1 The web server scanner can scan web sites. See “Supported web server (scanner)
targets” on page 1681.
It has been tested with IIS and Apache web servers.

2 On the server with read access to the web site, install See “Installing web server scanners”
the web server scanner. on page 1681.

3 Perform any manual configurations by editing the See “Configuration options for web
configuration files and properties files. server scanners” on page 1685.

4 On the Enforce Server, add a new Scanner File System See “Adding a new Network
target. Discover/Cloud Storage Discover
target” on page 1529.

5 Start the file system scan. See “Starting web server scans”
on page 1683.
Start the scanner on the scanner computer, and also
start the scan on the Enforce Server.

6 Verify that the scan is running successfully. See “Troubleshooting scanners”

on page 1661.

Supported web server (scanner) targets

The web server scanner supports scanning of a static HTTP web site.

Installing web server scanners

The web server scanner must be installed on the computer that has access to the web sites
that you want to scan.
 Setting up scanning of Web servers 1682
Installing web server scanners

To install the web server scanner

1 On the computer with the file system to scan, download or copy (as binary) the relevant
installation file to a temporary directory. The file is located in the
DLP_Home\Symantec_DLP_15.0_Win\Scanners or
DLP_Home/Symantec_DLP_15.0_Lin/Scanners directory, where DLP_Home is the name
of the directory in which you unzipped the Symantec Data Loss Prevention software.
The file is one of the following file names:
■ SymantecDLPScanners_windows_x32_15.0.exe

■ SymantecDLPScanners_Unix_15.0_x32.sh (for 32-bit Linux systems)

2 Start the scanner installation program.

Use the -c flag to install a scanner with a console command (rather than with a GUI).
Windows GUI:

SymantecDLPScanners_windows_x32_15.0.exe

Linux GUI:

./SymantecDLPScanners_Unix_x32_15.0.sh

Linux console:

./SymantecDLPScanners_Unix_15.0.sh -c

3 Confirm the version of the scanner you want to install (32-bit or 64-bit).
4 Confirm the license ageement.
5 Select web Server Scanner.
6 Select the installation Destination Directory (the directory where you want the web server
scanner installed).
Click Next.
7 Select the Start Menu Folder (shortcut in the Start menu). The default is Symantec DLP
WebServer Scanner.
Click Next.
8 Enter the following connection information for the Network Discover Server:
■ Discover Host (IP or host name of the Network Discover Server)
■ Discover Port
Click Next.
9 Configure the web server scanner by entering the following information:
 Setting up scanning of Web servers 1683
Starting web server scans

■ Start URL
Enter the URL where the scan starts.
■ Include Filter
Only the paths that include all the strings specified here are scanned. Delimit entries
with a comma, but do not use any spaces. Wildcards are supported.
■ Path Exclude Filter
Everything but the paths that contain the strings specified here are scanned. Delimit
entries with a comma, but do not use any spaces. Wildcards are supported.
Click Next.
10 The scanner installs.
11 Select the Startup Mode.
While you initially test or verify that the scanner runs successfully, do not select either of
these options, but start the scanner manually.
You can select one (or none) of the following options:
■ Install as a service on a Windows system.
■ Start after installation.
Click Next.
Click Finish.
12 The web server scanner installation is complete on the scanner computer.
13 Perform any manual configurations by editing the configuration files and properties files.
See “Configuration options for web server scanners” on page 1685.
See “Scanner installation directory structure” on page 1663.
See “Scanner configuration files” on page 1664.
14 On the Enforce Server, create a New Target for the scanner web server type.
15 Start the scan on both the scanner computer and the Enforce Server.
See “Starting web server scans” on page 1683.

Starting web server scans

Make sure that the scanner is installed and configured on the target computer, and a new
target is added on the Enforce Server.
See “Installing web server scanners” on page 1681.
Then, you can start the scan.
 Setting up scanning of Web servers 1684
Starting web server scans

The procedures are different for each of the following scenarios:

■ One scanner per target (first procedure).
■ Multiple scanners for one target (second procedure).
To start a web server scan with one scanner for one target
1 Log on to the Enforce Server.
Go to Manage > Discover Scanning > Discover Targets to navigate to the list of targets.
2 Select the scan target from the target list, then click the Start icon.
3 On the scanner computer, start the web server scanner.
Click Start > Vontu WebServer Scanner > Vontu WebServer Scanner Console.
4 The scanner starts the process of scanning data.
See “How Network Discover scanners work” on page 1660.
5 If the scan does not progress normally, you can troubleshoot it.
See “Troubleshooting scanners” on page 1661.
6 Stop and restart the scanner whenever you make changes to the configuration file. To
stop the scanner, type the control-C character in the console window.
To start a web server scan with multiple scanners for one target
1 On each of the scanner computers, start the web server scanner.
Click Start > Vontu WebServer Scanner > Vontu WebServer Scanner Console.
Make sure that each of the scanners has started, and has posted information. Check the
outgoing folder on each of the computers.

See “Scanner installation directory structure” on page 1663.

2 Log on to the Enforce Server.
Go to Manage > Discover Scanning > Discover Targets to navigate to the list of targets.
3 Select the scan target from the target list, then click the Start icon.
4 The scanner starts the process of scanning data.
See “How Network Discover scanners work” on page 1660.
5 If the scan does not progress normally, you can troubleshoot it.
See “Troubleshooting scanners” on page 1661.
6 Stop and restart the scanner whenever you make changes to the configuration file. To
stop the scanner, type the control-C character in the console window.
 Setting up scanning of Web servers 1685
Configuration options for web server scanners

Configuration options for web server scanners

Table 69-2 provides an explanation of the VontuWebServerScanner.cfg file.

Table 69-2 Parameters in the VontuWebServerScanner.cfg file

Type Parameter Description

Scanned Content URL A valid URL at which the crawler starts. If you want more
than one page to be retrieved, the starting web page must
contain links to other web pages. You must include the
initial http:// in the configuration parameter.

Scanned Content NavDirAllowCSVs The list with include filters for paths. This list contains the
strings that the URL of a page must contain for the
scanner to process the page. Use the parameter
NavDirCheck to specify how and when the scanner
checks for these strings.

Use * for wildcard. Delimit entries with a comma, but do

not use any spaces.

Scanned Content NavDirDisallowCSVs The list with exclude filters for paths. This list contains
the strings that the URL of a page must not contain for
the scanner to process the page. Use the parameter
NavDirCheck to specify how and when the scanner
checks for these strings.

Use * for wildcard. Delimit entries with a comma, but do

not use any spaces.

Scanned Content NavDirCheck A bitwise mask number that is used to determine where
and how the scanner checks for the NavDirAllowCSVs
strings and NavDirDisallowCSVs strings. If the URL
of a page does not contain one of the NavDirAllowCSVs
strings or does contain one of the NavDirDisallowCSVs
strings, the scanner does not process the page.

See “Example of URL filtering for a web site scan”

on page 1689.

Scanned Content Extensions Enter file extensions to restrict the document types the
scanner can crawler. To enter multiple extensions,
separate them with commas . Use * for wildcard. No
spaces before or after commas.

Example to only fetch the documents that have .doc or

.html as extensions:

Extensions=*.doc,*.html*
 Setting up scanning of Web servers 1686
Configuration options for web server scanners

Table 69-2 Parameters in the VontuWebServerScanner.cfg file (continued)

Type Parameter Description

Scanned Content MaxLinksPerPage The maximum number of links a page can have. Pages
with many links are often navigation pages and this
parameter can be used to filter them out.

Scanned Content StayOnSite You can configure the crawler to stay on the web site on
which it starts, or allow it to follow links to external web
sites in domains different from the starting web site. By
default, the crawler stays on the starting web site domain.

Scanned Content AfterDate Number of days after which a page must be modified
before it is saved. Enter the number of days relative to
the current date. A negative number specifies a date in
the past.

Scanned Content BeforeDate Number of days before which a page must be modified
before it is saved. Enter the number of days relative to
the current date. A negative number specifies a date in
the past.

Authentication LoginMethod The authentication method for the site. The value must
be AUTHENTICATE, FORMPOST, or FORMGET.

See “Example configuration for a web site scan with basic

authentication” on page 1687.

See “Example configuration for a web site scan with

form-based authentication” on page 1688.

Authentication LoginURL The page that contains the logon form.

Authentication LoginUserValue The user name to use for authentication (plain text or
encrypted).

Authentication LoginPassValue The password to use for authentication. Encrypt this

password.

See “Encrypting passwords in configuration files”

on page 1541.

Authentication LoginUserField The name of the user name form field (for FORMPOST
or FORMGET logon methods).

Authentication LoginPassField The name of the password form field (for FORMPOST
or FORMGET logon methods). Encrypt this password.

See “Encrypting passwords in configuration files”

on page 1541.
 Setting up scanning of Web servers 1687
Example configuration for a web site scan with no authentication

Table 69-2 Parameters in the VontuWebServerScanner.cfg file (continued)

Type Parameter Description

Proxies ProxyHost The host name or IP address of the proxy server.

Proxies ProxyPort The port number of the proxy server.

Proxies ProxyUsername The user name (plain text or encrypted) for the proxy
server.

Proxies ProxyPassword The password for the proxy server. Encrypt this password.

See “Encrypting passwords in configuration files”

on page 1541.

Throttling PageDelay Number of seconds between downloading a page and

requesting the next page.

Throttling BatchSize The number of files that are aggregated into each XML
file that is sent to Network Discover.

Example configuration for a web site scan with no

authentication
Scan a web site with no authentication.
This configuration is in the file VontuWebServerScanner.cfg.
See “Configuration options for web server scanners” on page 1685.

//##########################################################
//# Jobs
//##########################################################
URL=http://www.cnn.com

Example configuration for a web site scan with basic

authentication
Scan a web site that is protected with standard authentication.
This configuration is in the file VontuWebServerScanner.cfg.
See “Configuration options for web server scanners” on page 1685.

//##########################################################
//# Jobs
 Setting up scanning of Web servers 1688
Example configuration for a web site scan with form-based authentication

//##########################################################
URL=http://site.domain.com
LoginURL=http://domain.server.com/login.html
LoginMethod=AUTHENTICATE
LoginUserValue=some_user
LoginPassValue=9sfIy8vw

Example configuration for a web site scan with

form-based authentication
Scan a web site that is protected with form-based authentication.
This configuration is in the file VontuWebServerScanner.cfg.
See “Configuration options for web server scanners” on page 1685.

//##########################################################
//# Jobs
//##########################################################
URL= http://wiki.symantec.corp/dashboard.action

LoginMethod=FORMPOST
LoginURL=http://wiki.symantec.corp/login.action

LoginUserField=os_username
LoginUserValue=some_user

LoginPassField=os_password
LoginPassValue=9sfIy8vw

Example configuration for a web site scan with NTLM

Scan a web site that is protected with NTLM.
Make sure the NTLMUsername is in the format of Domain\user name.
This configuration is in the file VontuWebServerScanner.cfg.
See “Configuration options for web server scanners” on page 1685.

//##########################################################
//# Jobs
//##########################################################
URL=http://some_site
 Setting up scanning of Web servers 1689
Example of URL filtering for a web site scan

NTLMUsername=Some_Domain\some_domain_user
NTLMPassword=9sfIy8vw

Example of URL filtering for a web site scan

Use the parameter NavDirCheck to determine where and how the scanner checks for the
NavDirAllowCSVs strings and NavDirDisallowCSVs strings.

Create the NavDirCheck number by adding together some of the following numbers:

Parameter Value Description

URL 1 You must enter 1 to enable the scanner to check whether the URL
of a page contains any of the strings that are specified in the
parameter NavDirAllowCSVs or NavDirDisallowCSVs.

Case insensitive 64 If you add 64 to the URL value, the scanner checks the URL of a
page for a match for the strings that are specified in the parameter
NavDirAllowCSVs or NavDirDisallowCSVs. This match is not
case-sensitive .

Before download 128 If you add 128 to the URL value, the scanner checks whether the
URL has any NavDirAllowCSVs or NavDirDisallowCSVs
strings before the page is downloaded.

Valid site structure 512 If you add 512 to the URL value, the scanner rechecks the
NavDirAllowCSVs and NavDirDisallowCSVs values for the
site to ensure that the site is still valid before it updates it. If you do
not include this setting, then changes to these values are never
checked. If the site is not valid, it is not downloaded.

In the following example, the scanner checks the URLs for matches for the strings "archive"
or "test." This match is not case-sensitive , and part of a word or a whole word is matched. If
the URL contains one of these strings, the page is not processed.

NavDirDisallowCSVs=*archive*,*test*
NavDirCheck=65

In the following example, the scanner checks the URLs for matches for the strings "news" or
"home." This match is not case-sensitive , and part of a word or a whole word is matched. If
the URL does not contain one of these strings, the page is not processed.

NavDirAllowCSVs=*news*,*home*
NavDirCheck=65
 Setting up scanning of Web servers 1690
Example of date filtering for a web site scan

Example of date filtering for a web site scan

The following example retrieves the documents that were modified 365 days before the current
date and 7 days after the current date.

AfterDate=-365
BeforeDate=7
 Chapter 70
Setting up scanning of
Documentum repositories
This chapter includes the following topics:

■ Setting up remote scanning of Documentum repositories

■ Supported Documentum (scanner) targets

■ Installing Documentum scanners

■ Starting Documentum scans

■ Configuration options for Documentum scanners

■ Example configuration for scanning all documents in a Documentum repository

Setting up remote scanning of Documentum

repositories
The Documentum scanner scans Documentum repositories.
To set up scanning of Documentum repositories, complete the following process:

Table 70-1 Setting up a Documentum scanner

Step Action Description

1 Verify that your Documentum repository is on the list of See “Supported Documentum
supported targets. (scanner) targets” on page 1692.

2 The Documentum scanner can be installed on any See “Installing Documentum

computer that has network connectivity to the computer scanners” on page 1692.
that hosts the Documentum Document Broker.
 Setting up scanning of Documentum repositories 1692
Supported Documentum (scanner) targets

Table 70-1 Setting up a Documentum scanner (continued)

Step Action Description

3 Perform any manual configurations by editing the See “Configuration options for
configuration files and properties files. Documentum scanners” on page 1695.

4 On the Enforce Server, add a new Scanner Documentum See “Adding a new Network
target. Discover/Cloud Storage Discover
target” on page 1529.

5 Start the Documentum scan. See “Starting Documentum scans”

on page 1694.
Start the scanner on the scanner computer, and also
start the scan on the Enforce Server.

6 Verify that the scan is running successfully. See “Troubleshooting scanners”

on page 1661.

Supported Documentum (scanner) targets

The Documentum scanner supports scanning a Documentum Content Server 5.3.x or 6.6.x
repository.

Installing Documentum scanners

The Documentum scanner can be installed on any computer that has network connectivity to
the computer that hosts the Documentum Document Broker.
To install and deploy the Documentum scanner
1 On the computer that has network connectivity to the computer that hosts the Documentum
Document Broker, download the installation file. Download or copy (as binary) the
SymantecDLPScanners_windows_x32_15.0.exe file to a temporary directory. The file is
located in the DLP_Home\Symantec_DLP_15.0_Win\Scanners where DLP_Home is the name
of the directory in which you unzipped the Symantec Data Loss Prevention software.
2 Start the scanner installation program on this computer.

SymantecDLPScanners_windows_x32_15.0.exe

Note: This scanner should only be installed on 32-bit Windows servers.

3 Confirm the version of the scanner you want to install (32-bit).

4 Confirm the license ageement.
 Setting up scanning of Documentum repositories 1693
Installing Documentum scanners

5 Select Documentum Scanner.

6 Select the installation Destination Directory, the folder where you want the Documentum
Scanner to be installed.
The default is c:\Program Files\DocumentumScanner\.
Click Next.
7 Select the Start Menu Folder (shortcut in the Start menu).
The default is SymantecDLP Documentum Scanner.
Click Next.
8 Enter the following connection information for the Network Discover Server:
■ Discover Host (IP or host name of the Network Discover Server)
■ Discover Port

9 Click Next.
10 Enter the following Documentum configuration values for the scanner:

Doc Broker Host The name of the server where the repository for the DocBase is stored.

Doc Base The name of the repository you want the Documentum scanner to retrieve.

User Name Specify an account with full access rights to the Documentum files you want to
scan.

Password Password for the account. This password is plain text in the configuration file.

WebTop Host The host name of the Web interface to the Documentum content repository.

WebTop Port The port number for the Web interface.

11 Click Next.
12 The scanner installs.
13 Select the Startup Mode.
While you initially test or verify that the scanner runs successfully, do not select either of
these options, but start the scanner manually.
You can select one (or none) of the following options:
■ Install as a service on a Windows system.
■ Start after installation.
The default is to start the scanner manually.
 Setting up scanning of Documentum repositories 1694
Starting Documentum scans

14 The Documentum scanner installation is complete on the scanner computer.

15 Perform any manual configurations by editing the configuration files and properties files.
See “Configuration options for Documentum scanners” on page 1695.
See “Scanner installation directory structure” on page 1663.
See “Scanner configuration files” on page 1664.
16 After installing the Documentum scanner, copy the dmcl40.dll file from your Documentum
installation bin directory, to the \DocumentumScanner\scanner folder in the scanner
installation directory.
See “Scanner installation directory structure” on page 1663.
17 On the Enforce Server, create a New Target for the scanner Documentum type.
18 Start the scan on both the scanner computer and the Enforce Server.
See “Starting Documentum scans” on page 1694.

Starting Documentum scans

Make sure that the scanner is installed and configured on the target computer, and a new
target is added on the Enforce Server.
See “Installing Documentum scanners” on page 1692.
Then, you can start the scan.
The procedures are different for each of the following scenarios:
■ One scanner per target (first procedure).
■ Multiple scanners for one target (second procedure).
To start a Documentum scan with one scanner for one target
1 Log on to the Enforce Server.
Go to Manage > Discover Scanning > Discover Targets to navigate to the list of targets.
2 Select the scan target from the target list, then click the Start icon.
3 On the scanner computer, start the Documentum scanner.
Click Start > Vontu Documentum Scanner > Vontu Documentum Scanner Console.
4 The scanner starts the process of scanning data.
See “How Network Discover scanners work” on page 1660.
 Setting up scanning of Documentum repositories 1695
Configuration options for Documentum scanners

5 If the scan does not progress normally, you can troubleshoot it.
See “Troubleshooting scanners” on page 1661.
6 Stop and restart the scanner whenever you make changes to the configuration file. To
stop the scanner, type the control-C character in the console window.
To start a Documentum scan with multiple scanners for one target
1 On each of the scanner computers, start the Documentum scanner.
Click Start > Vontu Documentum Scanner > Vontu Documentum Scanner Console.
Make sure that each of the scanners has started, and has posted information. Check the
outgoing folder on each of the computers.

See “Scanner installation directory structure” on page 1663.

2 Log on to the Enforce Server.
Go to Manage > Discover Scanning > Discover Targets to navigate to the list of targets.
3 Select the scan target from the target list, then click the Start icon.
4 The scanner starts the process of scanning data.
See “How Network Discover scanners work” on page 1660.
5 If the scan does not progress normally, you can troubleshoot it.
See “Troubleshooting scanners” on page 1661.
6 Stop and restart the scanner whenever you make changes to the configuration file. To
stop the scanner, type the control-C character in the console window.

Configuration options for Documentum scanners

Table 70-2 provides an explanation of the VontuDocumentumScanner.cfg file.

Table 70-2 Parameters in the VontuDocumentumScanner.cfg file

Parameter Description

DocBase The name of the repository you want Documentum to retrieve.

UserName Specify an account with access rights to the Documentum files you
want to scan.

Password Password for the account that is specified in UserName. Encrypt

this password.

See “Encrypting passwords in configuration files” on page 1541.

 Setting up scanning of Documentum repositories 1696
Configuration options for Documentum scanners

Table 70-2 Parameters in the VontuDocumentumScanner.cfg file (continued)

Parameter Description

ExtensionCSVs List of file types to scan (Include Filter), for example:

ExtensionCSVs=*.doc,*.htm,*.ppt,*.xls

Delimit with a comma (no space).

ImportRefReplaceWithCSVs Comma-separated list of one or two values that are used to

construct the URL of the scanned documents.

first_value,second_value

If the Documentum interface client is a Windows desktop or desktop

client, then the first-value is concatenated to the left of the
document-id. The second string is concatenated to the right, for
example:

first_valuedocument_idsecond_value

If the Documentum Webtop (Web-based) interface is your client

interface, only one value is necessary; for example:

ImportRefReplaceWithCSVs=
http://documentum-server.mycompany.com:8080/
webtop/component/drl?objectId=

AfterDate A maximum age for documents to be scanned. For example, if you

set AfterDate to five days, only documents that are no more than
five days old are scanned. AfterDate looks at the last modified
date.

You can enter one of the following values:

N hours

N days

N weeks

N months

The Documentum scanner does not support automatic incremental

scanning, but you can manually perform incremental scans, by
setting the AfterDate and BeforeDate parameters.
 Setting up scanning of Documentum repositories 1697
Example configuration for scanning all documents in a Documentum repository

Table 70-2 Parameters in the VontuDocumentumScanner.cfg file (continued)

Parameter Description

BeforeDate A minimum age for documents to be scanned. For example, if you

set AfterDate to five days, only documents that are no more than
five days old are scanned. AfterDate looks at the last modified
date.

You can enter one of the following values:

N hours

N days

N weeks

N months

FolderCSVs Specify the repository folders from which to fetch documents. All
entries must begin with a slash but cannot consist of a slash alone.
Leave the entry blank to specify all folders. Cabinets are treated
as folders. For example:

FolderCSVs=/support,/clients,/marketing,/finance

Table 70-3 shows the host parameter in the dmcl.ini file.

[DOCBROKER_PRIMARY]
host = documentum-server.mycompany.com

During installation of the Symantec Data Loss Prevention scanner, the host parameter is set
in the dmcl.ini file. If the Documentum Document Broker (server) later changes, this file must
be edited to point to the new server.

Table 70-3 dmcl.ini file

Parameter Description

host The computer that hosts the Documentum Document Broker (server).

Example configuration for scanning all documents in

a Documentum repository
Scan all documents in the repository.
The configuration is in the file VontuDocumentumScanner.cfg.
See “Configuration options for Documentum scanners” on page 1695.
 Setting up scanning of Documentum repositories 1698
Example configuration for scanning all documents in a Documentum repository

//##########################################################
//# Jobs
//##########################################################
[JOBS]
NUMBER=1
0=Job0
[Job0]
DocBase=Vontu_1
UserName=Administrator
Password=mypassword
ImportRefReplaceWithCSVs=
http://documentum-server.mycompany.com:8080/webtop/
component/drl?objectId=
LogFile = Job0.log
 Chapter 71
Setting up scanning of
Livelink repositories
This chapter includes the following topics:

■ Setting up remote scanning of OpenText (Livelink) repositories

■ Supported OpenText (Livelink) scanner targets

■ Creating an ODBC data source for SQL Server

■ Installing Livelink scanners

■ Starting OpenText (Livelink) scans

■ Configuration options for Livelink scanners

■ Example configuration for scanning a Livelink database

Setting up remote scanning of OpenText (Livelink)

repositories
The Livelink scanner can scan an OpenText (Livelink) database.
To set up scanning of OpenText (Livelink) repositories, complete the following process:

Table 71-1 Setting up an OpenText (Livelink) scanner

Step Action Description

1 Verify that your OpenText (Livelink) repository is on the See “Supported OpenText (Livelink)
list of supported targets. scanner targets” on page 1700.
 Setting up scanning of Livelink repositories 1700
Supported OpenText (Livelink) scanner targets

Table 71-1 Setting up an OpenText (Livelink) scanner (continued)

Step Action Description

2 Create an ODBC data source for SQL Server. See “Creating an ODBC data source
for SQL Server” on page 1700.
Install the Livelink scanner.
See “Installing Livelink scanners”
on page 1701.

3 Perform any manual configurations by editing the See “Configuration options for
configuration files and properties files. Livelink scanners” on page 1704.

4 On the Enforce Server, add a new Scanner Livelink See “Adding a new Network
target. Discover/Cloud Storage Discover
target” on page 1529.

5 Start the Livelink scan. See “Starting OpenText (Livelink)

scans” on page 1703.
Start the scanner on the scanner computer, and also
start the scan on the Enforce Server.

6 Verify that the scan is running successfully. See “Troubleshooting scanners”

on page 1661.

Supported OpenText (Livelink) scanner targets

The Livelink scanner supports scanning of OpenText (Livelink) Server 9.x targets.

Creating an ODBC data source for SQL Server

This procedure assumes that the Livelink database is an SQL Server database. If you have
an Oracle Livelink database contact Symantec Data Loss Prevention support for specific
instructions.
To create an ODBC data source for SQL Server
1 Go to Control Panel > Administrative Tools > Data Sources (ODBC).

Note: On 64-bit Windows systems, use the 32-bit ODBC administrator tool to configure
the data source. The 32-bit version is available at c:\windows\sysWOW64\odbcad32.exe.

2 Click the System DSN tab.

3 Click Add.
4 Select SQL Server.
 Setting up scanning of Livelink repositories 1701
Installing Livelink scanners

5 Give it a name (for example, “OpenText”). This name is referenced in the

VontuLivelinkScanner.cfg file.

6 Click Next.
7 Select With SQL Server authentication using a login ID and password entered by
the user.
8 Check the option for Connect to SQL Server to obtain default settings for additional
configuration options and enter the SQL Server credentials.
9 Click Next. Accept the defaults.
10 Click Next. Accept the defaults.
11 Click Finish.

Installing Livelink scanners

Install the Livelink scanner on a computer that has access to the OpenText (Livelink) database.
To install a Livelink scanner
1 Create an ODBC data source for SQL Server.
See “Creating an ODBC data source for SQL Server” on page 1700.
2 On the computer that has access to the OpenText (Livelink) database, download the
installation file. Download or copy (as binary) the
SymantecDLPScanners_windows_x32_15.0.exe file to a temporary directory. The file is
located in the DLP_Home\Symantec_DLP_15.0_Win\Scanners where DLP_Home is the name
of the directory in which you unzipped the Symantec Data Loss Prevention software.
3 Start the scanner installation program on this computer.

SymantecDLPScanners_windows_x32_15.0.exe

Note: This scanner should only be installed on 32-bit Windows servers.

4 Confirm the version of the scanner you want to install (32-bit).

5 Confirm the license ageement.
6 Select Livelink Scanner.
7 Select the installation Destination Directory, the folder where you want the Livelink Scanner
to be installed.
The default is c:\Program Files\LivelinkScanner\.
Click Next.
 Setting up scanning of Livelink repositories 1702
Installing Livelink scanners

8 Select the Start Menu Folder (shortcut in the Start menu).

The default is SymantecDLP Livelink Scanner.
Click Next.
9 Enter the following connection information for the Network Discover Server:
■ Discover Host (IP or host name of the Network Discover Server)
■ Discover Port
Click Next.
10 Enter the following Livelink configuration values for the scanner:

Livelink Host The host name or IP address of the Livelink server.

Livelink Port The HTTP port of the Livelink server.

Livelink User Name The user name to use when you scan.

Livelink Password The password to use when you scan.

Encrypt this password.

See “Encrypting passwords in configuration files” on page 1541.

Livelink Connection The Livelink API connection name. This name is the dbconnection
Name in the opentext.ini file on the Livelink server.

Livelink API Port This port should be 2099 unless it has been changed in the
opentext.ini file on the Livelink server. The default is 2099.

ODBC DSN The name of the ODBC data source on the computer running the
Livelink scanner.

SQL User Name User name to use to connect to the ODBC data source.

SQL Password Password to use to connect to the ODBC data source.

Encrypt this password.

See “Encrypting passwords in configuration files” on page 1541.

Click Next.
11 The scanner installs.
12 Select the Startup Mode.
While you initially test or verify that the scanner runs successfully, do not select either of
these options, but start the scanner manually.
You can select one (or none) of the following options:
 Setting up scanning of Livelink repositories 1703
Starting OpenText (Livelink) scans

■ Install as a service on a Windows system.

■ Start after installation.
The default is to start the scanner manually.
13 The Livelink scanner installation is complete on the scanner computer.
14 Perform any manual configurations by editing the configuration files and properties files.
See “Configuration options for Livelink scanners” on page 1704.
See “Scanner installation directory structure” on page 1663.
See “Scanner configuration files” on page 1664.
15 Copy the following files from the Livelink installation to the \LivelinkScanner\scanner
folder:
■ LAPI_ATTRIBUTES.dll

■ LAPI_BASE.dll

■ LAPI_DOCUMENTS.dll

■ LAPI_USERS.dll

■ LLKERNEL.dll

16 Create an ODBC data source for the database instance that OpenText (Livelink) uses.
This data source is referenced in the VontuLivelinkScanner.cfg file.
See “Creating an ODBC data source for SQL Server” on page 1700.
17 On the Enforce Server, create a New Target for the scanner Livelink type.
18 Start the scan on both the scanner computer and the Enforce Server.
See “Starting OpenText (Livelink) scans” on page 1703.

Starting OpenText (Livelink) scans

Make sure that the scanner is installed and configured on the target computer, and a new
target is added on the Enforce Server.
See “Installing Livelink scanners” on page 1701.
Then, you can start the scan.
The procedures are different for each of the following scenarios:
■ One scanner per target (first procedure).
■ Multiple scanners for one target (second procedure).
 Setting up scanning of Livelink repositories 1704
Configuration options for Livelink scanners

To start a Livelink scan with one scanner for one target

1 Log on to the Enforce Server.
Go to Manage > Discover Scanning > Discover Targets to navigate to the list of targets.
2 Select the scan target from the target list, then click the Start icon.
3 On the scanner computer, start the Livelink scanner.
Click Start > Vontu Livelink Scanner > Vontu Livelink Scanner Console.
4 The scanner starts the process of scanning data.
See “How Network Discover scanners work” on page 1660.
5 If the scan does not progress normally, you can troubleshoot it.
See “Troubleshooting scanners” on page 1661.
6 Stop and restart the scanner whenever you make changes to the configuration file. To
stop the scanner, type the control-C character in the console window.
To start a Livelink scan with multiple scanners for one target
1 On each of the scanner computers, start the Livelink scanner.
Click Start > Vontu Livelink Scanner > Vontu Livelink Scanner Console.
Make sure that each of the scanners has started, and has posted information. Check the
outgoing folder on each of the computers.

See “Scanner installation directory structure” on page 1663.

2 Log on to the Enforce Server.
Go to Manage > Discover Scanning > Discover Targets to navigate to the list of targets.
3 Select the scan target from the target list, then click the Start icon.
4 The scanner starts the process of scanning data.
See “How Network Discover scanners work” on page 1660.
5 If the scan does not progress normally, you can troubleshoot it.
See “Troubleshooting scanners” on page 1661.
6 Stop and restart the scanner whenever you make changes to the configuration file. To
stop the scanner, type the control-C character in the console window.

Configuration options for Livelink scanners

Table 71-2 provides an explanation of the VontuLivelinkScanner.cfg file.
 Setting up scanning of Livelink repositories 1705
Example configuration for scanning a Livelink database

Table 71-2 Parameters in the VontuLivelinkScanner.cfg file

Type Parameter Description

Connectivity OpenTextServer The host name or IP address of the Livelink server.

Connectivity OpenTextPort The HTTP port of the Livelink server.

Connectivity OpenTextUsername The user name to use when you scan.

Connectivity OpenTextPassword The password to use when you scan. Encrypt this
password.

See “Encrypting passwords in configuration files”

on page 1541.

Connectivity LLConnection The OpenText (Livelink) API connection name. This

parameter is the name of the dbconnection in the
opentext.ini file on the Livelink server.

Connectivity LLApiPort This value should be 2099 unless it has been changed
in the opentext.ini file on the OpenText (Livelink)
server.

Connectivity DSN The name of the ODBC data source on the computer
that runs the OpenText (Livelink) scanner.

Connectivity SQLUserName User name to use to connect to the ODBC data source.

Connectivity SQLPassWord Password to use to connect to the ODBC data source.

Encrypt this password.
See “Encrypting passwords in configuration files”
on page 1541.

Throttling BatchSize The number of files that are aggregated before they are
imported into each XML file that is sent to Network
Discover.

See “Optimizing resources with Network Discover/Cloud

Storage Discover scan throttling” on page 1548.

Example configuration for scanning a Livelink

database
Scan everything in the Livelink database.
The configuration is in the file VontuLivelinkScanner.cfg.
See “Configuration options for Livelink scanners” on page 1704.
 Setting up scanning of Livelink repositories 1706
Example configuration for scanning a Livelink database

//##########################################################
//# Jobs
//##########################################################
[JOBS]
Number=1
0=Job0
[Job0]
OpenTextServer=mydatabase-Livelink.test.lab
OpenTextPort=80
OpenTextUsername=Admin
OpenTextPassword=Livelink
LLConnection=LivelinkDB
LLApiPort=2099
DSN=Livelink
SQLUserName=lldbuser
SQLPassWord=Livelink
 Chapter 72
Setting up Web Services for
custom scan targets
This chapter includes the following topics:

■ Setting up Web Services for custom scan targets

■ About setting up the Web Services Definition Language (WSDL)

■ Example of a Web Services Java client

■ Sample Java code for the Web Services example

Setting up Web Services for custom scan targets

The Web Services target type enables customers to write custom scanners. These custom
scanners send content and metadata to Network Discover as Simple Object Access Protocol
(SOAP) requests. The Network Discover Server becomes a Web Service host.
See “About setting up the Web Services Definition Language (WSDL)” on page 1708.
An example of a Java SOAP client is available.
See “Example of a Web Services Java client” on page 1708.
To set up custom web Services for Network Discover, complete the following process:

Table 72-1 Setting up a custom scan target

Step Action Description

1 Add a Web Services target type. See “Adding a new Network

Discover/Cloud Storage Discover
target” on page 1529.
 Setting up Web Services for custom scan targets 1708
About setting up the Web Services Definition Language (WSDL)

Table 72-1 Setting up a custom scan target (continued)

Step Action Description

2 Start the scan. Select the scan target from the target
list, then click the Start icon.

See “Managing Network

Discover/Cloud Storage Discover
target scans” on page 1553.

3 Save and modify the WSDL, and a create a client (such See “About setting up the Web
as a Java client), or SOAP request. Services Definition Language
(WSDL)” on page 1708.

An example Java client is available.

See “Example of a Web Services

Java client” on page 1708.

4 Run the client, and verify the results. See “Example of a Web Services
Java client” on page 1708.

About setting up the Web Services Definition

Language (WSDL)
The concrete Web Service Definition Language (WSDL) can be downloaded from the following
URL when a Web Services target is running. The following port is the default. Enter the location
of your Network Discover Server and port number.
http://discover_server:8090/?wsdl

See the online Help for a Web Services sample WSDL and for a Web Services sample SOAP
request.

Example of a Web Services Java client

The following procedure and code provide an example of Web Services. This example sends
content and metadata of all the files in a folder to the Network Discover Server.
To create and run a Web Services Java client
1 Log into the Enforce Server and create a Network Discover Web Services target type.
See “Adding a new Network Discover/Cloud Storage Discover target” on page 1529.
Use the default settings. Note the scanner port number; the default is 8090.
2 Start the scan.
 Setting up Web Services for custom scan targets 1709
Sample Java code for the Web Services example

3 Browse to the following URL:

http://discover_server:8090/?wsdl

Save the page as a WSDL file named DiscoverSOAPTarget.wsdl in a folder (for example
sample_folder).

Edit the URL to replace port number 8090 if the scanner port number is different in step
1.
4 Install the Java Development Kit (JDK), if it is not available on your system.
5 Set the Java home to the folder where you installed the JDK.

JAVA_HOME=jdk_install_dir

6 Install Apache CXF, an open source service framework.

See http://cxf.apache.org/
7 Transform the WSDL to Java code.

apache-cxf-installdir\bin\wsdl2java
-client sample_folder\DiscoverSOAPTarget.wsdl

Java source files are automatically created under packages com.vontu.discover and
com.vontu.wsdl.discoversoaptarget.

8 Edit a file named DiscoverSOAPClient.java in the sample_folder and insert the Java
code. Place the new code at the beginning of this file. Change the constants as needed.
See “Sample Java code for the Web Services example” on page 1709.
9 Compile the Java code with the following command:

javac DiscoverSOAPClient.java

10 Run the program using the following command:

java DiscoverSOAPClient

11 On the Enforce Server, verify that the expected number of items are reported for the
Network Discover target that is created in step 1.

Sample Java code for the Web Services example

Enter the following source code at the beginning of the file named DiscoverSOAPClient.java.
See “Example of a Web Services Java client” on page 1708.
 Setting up Web Services for custom scan targets 1710
Sample Java code for the Web Services example

import javax.xml.datatype.DatatypeFactory;
import javax.xml.namespace.QName;
import java.io.ByteArrayOutputStream;
import java.io.File;
import java.io.FileInputStream;
import java.net.URL;
import java.util.Date;

import com.vontu.discover.ComponentContentType;
import com.vontu.discover.ComponentType;
import com.vontu.discover.DocumentType;
import com.vontu.discover.ProcessDocumentsType;
import com.vontu.wsdl.discoversoaptarget.DiscoverSOAPTargetPortType;
import com.vontu.wsdl.discoversoaptarget.DiscoverSOAPTargetService;
import com.sun.org.apache.xerces.internal.impl.dv.util.Base6

public class DiscoverSOAPClient

{
private static final QName SERVICE_NAME = new QName(
"http://www.vontu.com/wsdl/DiscoverSOAPTarget.wsdl",
"DiscoverSOAPTarget_Service");
private static final String OWNER = "DiscoverSOAPClient";
private static final String BODY = "This is the body";
private static final String TYPE = "Text";
private static final String ENCODING = "base64";

//Change this value according to your needs

private static final String TEST_FOLDER_NAME = "c:\\temp\\data";

//Change this based on your discover host name and scanner port
private static final String WSDL_PATH =
"http://localhost:8090/?wsdl";

public static void main(String []args)

{
try
{
URL wsdl = new URL(WSDL_PATH);
File folder = new File(TEST_FOLDER_NAME);
DiscoverSOAPTargetService service =
new DiscoverSOAPTargetService(wsdl, SERVICE_NAME);
DiscoverSOAPTargetPortType client = service.getDiscoverPort();
 Setting up Web Services for custom scan targets 1711
Sample Java code for the Web Services example

for(File file : folder.listFiles())

{
if(file.isDirectory())
{
//only files in the test folder are sent to Discover
continue;
}
System.out.println(file);
ProcessDocumentsType processDocumentsType =
new ProcessDocumentsType();
DocumentType documentType = new DocumentType();
processDocumentsType.getDocument().add(documentType);
documentType.setOwner(OWNER);
documentType.setURI(file.toString());
GregorianCalendar time = new GregorianCalendar();
time.setTime(new Date(file.lastModified()));
documentType.setLastModifiedDate(
DatatypeFactory.newInstance().
newXMLGregorianCalendar(time));
documentType.setLastModifiedDate(
DatatypeFactory.newInstance().
newXMLGregorianCalendar(time));

//create a component
ComponentType body = new ComponentType();
documentType.setComponent(body);
body.setName(file.getName());

//add body
ComponentContentType bodyContent =
new ComponentContentType();
body.setComponentContent(bodyContent);
bodyContent.setType(TYPE);
bodyContent.setContent(BODY);

ComponentType attachment = new ComponentType();

body.getComponent().add(attachment);
attachment.setName(file.getName());

//add some content to the component

ComponentContentType attachmentContent =
new ComponentContentType();
attachment.setComponentContent(attachmentContent);
 Setting up Web Services for custom scan targets 1712
Sample Java code for the Web Services example

attachmentContent.setType(ENCODING);

ByteArrayOutputStream bytes =
new ByteArrayOutputStream();
FileInputStream in = new FileInputStream(file);
byte[] buf = new byte[1024];

for(;;)
{
int len = in.read(buf);
if(len == -1)
{
break;
}
bytes.write(buf,0,len);
}

attachmentContent.setContent(
Base64.encode(bytes.toByteArray()));

//make the SOAP call

client.processDocuments(processDocumentsType);
}

}catch(Exception e)
{
}
}
}
 Section 9
Discovering and preventing
data loss on endpoints

■ Chapter 73. Overview of Symantec Data Loss Prevention for endpoints

■ Chapter 74. Summary of DLP Agent for Mac support

■ Chapter 75. Using Endpoint Prevent

■ Chapter 76. Using Endpoint Discover

■ Chapter 77. Working with agent configurations

■ Chapter 78. Working with Agent Groups

■ Chapter 79. Managing Symantec DLP Agents

■ Chapter 80. Using application monitoring

■ Chapter 81. Working with Endpoint FlexResponse

■ Chapter 82. Using Endpoint tools

 Chapter 73
Overview of Symantec Data
Loss Prevention for
endpoints
This chapter includes the following topics:

■ About discovering and preventing data loss on endpoints

■ Guidelines for authoring Endpoint policies

About discovering and preventing data loss on

endpoints
To use Endpoint Discover or Endpoint Prevent features, you need to deploy DLP Agents and
Endpoint Servers.
Endpoint Prevent and Endpoint Discover both apply Data Loss Prevention policies to protect
your sensitive or at-risk data. Sensitive or at-risk data can include credit card numbers or
names, addresses, and identification numbers. You can configure both of these products to
recognize and protect the files that contain sensitive data.
See “About Endpoint Prevent monitoring” on page 1736.
Endpoint Prevent stops sensitive data from moving off endpoints and supported virtual desktops.
For example, Endpoint Prevent can stop a file that contains credit card numbers from being
transferred to eSATA, USB, or FireWire-connected media. Endpoint Prevent stops sensitive
the files from being transferred to network shares. And Endpoint Prevent can monitor and
prevent data from being transferred to applications you specify.
Endpoint Discover scans the internal hard drives of an endpoint to identify stored confidential
data so steps can be taken to inventory, secure, or relocate this data. It enables
 Overview of Symantec Data Loss Prevention for endpoints 1715
About discovering and preventing data loss on endpoints

high-performance, parallel scanning of tens of thousands of endpoints with minimal system

effect. Each DLP Agent can scan approximately 5 GB/hr. Users can set up Endpoint Discover
scans to use multiple Endpoint Servers to increase performance and scan availability. Endpoint
Discover can automatically quarantine confidential files either locally to a folder on the Windows
endpoint computer (including to an encrypted folder) or remotely to a folder on the network.
Table 73-1 provides description of these features as well as where to find additional information.
See “About Endpoint Discover” on page 63.
You can configure agent settings, group agents, set response rules, check agent health, and
troubleshoot agents.

Table 73-1 Endpoint features

Feature Description Additional information

Agent configuration
You can select which endpoint See “About agent configurations”
egress channels to monitor, and on page 1783.
you can optimize monitoring by
choosing appropriate filters. You
can also configure server-agent
communication bandwidth limits
and agent resource consumption.

Agent groups You use agent groups to send See “About agent groups”
agent configurations to groups of on page 1849.
agents.

Agent health and management You can review DLP Agent health See “About Symantec DLP Agent
and complete troubleshooting and administration” on page 1862.
management tasks.

Application monitoring You can configure this feature to See “About monitoring
monitor applications for CD/DVD applications” on page 1896.
burning, IM, email, or HTTP/S
clients.

FlexResponse You can create response rules See “About Endpoint

that automatically remediate FlexResponse” on page 1913.
incidents.

Endpoint tools You use Endpoint tools to See “About agent password
complete various maintenance management”on page
tasks on the endpoint, like 1923 on page 1923.
shutting down watchdog services,
inspecting the agent database,
and restarting Mac agents.
 Overview of Symantec Data Loss Prevention for endpoints 1716
Guidelines for authoring Endpoint policies

When considering your Endpoint deployment, be aware that there are differences in the features
that are supported between Mac and Windows DLP Agents. See “About DLP Agent feature-level
support” on page 1718.

Guidelines for authoring Endpoint policies

Symantec Data Loss Prevention uses a two-tiered detection architecture to analyze activity
on endpoints. Detection occurs either directly on DLP Agents or on the Endpoint Servers as
required. Endpoint Servers can perform all types of detection, such as Exact Data Matching
(EDM), Indexed Document Matching (IDM), and Directory Group Matching (DGM). Agents
can perform Described Content Matching (DCM) and Indexed Document Matching (IDM).
Symantec Data Loss Prevention can detect locally on keywords, regular expressions, and
data identifiers. It must send input content to the Endpoint Server to detect on exact data
fingerprints or indexed document fingerprints.

Note: Agents running on Mac endpoints can perform IDM and DCM detection only.

Two-tiered detection has implications for the kinds of detection rules and response rules you
can combine in a policy and use on endpoints. It also has implications for the optimization of
system usage and performance of Symantec Data Loss Prevention on endpoints. As you
create the policies that apply to endpoints, the following guidelines are recommended.
Do not create a policy that combines a server-side detection rule with an Endpoint Prevent
response rule. For example, do not combine an EDM or DGM rule with an Endpoint Block or
Endpoint Notify response rule. If a server-side detection rule triggers an Endpoint Prevent
response rule, Symantec Data Loss Prevention cannot execute the Endpoint Prevent response
rule, and the system displays an error message.
See “Author policies to limit the potential effect of two-tier detection” on page 419.
When creating an endpoint policy that includes a server-side detection rule, combine that
detection rule with an agent-side detection rule in one compound rule. This practice helps
Symantec Data Loss Prevention perform detection on the endpoint without sending the content
to the Endpoint Server. Symantec Data Loss Prevention saves network bandwidth and improves
performance by performing detection on the endpoint.
For example, you can couple an EDM detection rule with a keyword detection rule in one
compound rule. In a compound rule, all conditions must be met before Symantec Data Loss
Prevention registers a match. Conversely, if one condition is not met, Symantec Data Loss
Prevention determines there is no match without having to check the second condition. For
example, to register a match the content must meet the first condition AND all other conditions
in the same rule. When you set up the compound rule in this way, the DLP Agent checks the
input content against the agent-side rule first. If there is no match, Symantec Data Loss
Prevention does not need to send the content to the Endpoint Server. However, if you create
 Overview of Symantec Data Loss Prevention for endpoints 1717
Guidelines for authoring Endpoint policies

a compound rule that involves a DCM or an EDM policy, the content is still sent to the Endpoint
Server.
Before you combine a server-side detection rule (for example, an EDM rule) with an All: Limit
Incident Data Retention response rule that retains original files for endpoint incidents, consider
the bandwidth implications of retaining original files. When it sends data to an Endpoint Server
for analysis, the DLP Agent sends either text data or binary data according to policy
requirements. Whenever possible, DLP Agents send text to cut down on bandwidth use. By
default, Symantec Data Loss Prevention discards original files for endpoint incidents. If a
response rule retains original files for endpoint incidents, DLP Agents must send binary data
to the Endpoint Server. In this case, make sure that your network can handle the increased
traffic between DLP Agents and Endpoint Servers without degrading performance.
Combine agent-side detection rules (for example, DCM) with an Endpoint Prevent response
rule in the same policy. Symantec Data Loss Prevention can execute an Endpoint Prevent
response rule only when a DLP Agent detection rule triggers the response.
Table 73-2 lists detection and response rules that cannot be combined.

Table 73-2 Incompatible detection rules and response rules

Do not combine these server-based detection ...with these Endpoint Prevent response rules.
rules...

■ Content Matches Exact Data (EDM) ■ Endpoint: Block

■ Sender/User Matches Directory (profiled DGM) ■ Endpoint: Notify
■ Recipient Matches Directory (profiled DGM) ■ Endpoint: User Cancel

See “Workflow for implementing policies” on page 337.

 Chapter 74
Summary of DLP Agent for
Mac support
This chapter includes the following topics:

■ About DLP Agent feature-level support

■ Mac agent installation and tools feature details

■ Mac agent management features

■ Overview of Mac agent detection technologies and policy authoring features

■ Mac agent monitoring support

■ Endpoint Prevent for Mac agent advanced agent settings features

■ Endpoint Discover for Mac targets features

■ Endpoint Discover for Mac file system support

■ Endpoint Discover for Mac advanced agent settings support

About DLP Agent feature-level support

Symantec Data Loss Prevention enables you to monitor both Windows and Mac endpoints.
However, feature-level support varies between the two operating systems.
The following topics summarize DLP Agent for Mac feature-level support in relation to Windows.
Feature-level support differences is something to be aware of as you plan your deployment.
Agent feature-level support for Mac endpoints includes the following:
■ Installation
See “Mac agent installation support” on page 1719.
 Summary of DLP Agent for Mac support 1719
Mac agent installation and tools feature details

■ Endpoint tools
See “Mac endpoint tools features” on page 1720.
■ Endpoint location
See “Mac agent endpoint location” on page 1721.
■ Agent groups
See “Mac agent groups features” on page 1721.
■ Detection technologies
See “Mac agent detection technologies” on page 1721.
■ Policy and response rules
See “Mac agent policy response rule features” on page 1724.
■ Monitoring support
See “Mac agent monitoring support” on page 1737.
■ Endpoint Prevent advanced agent settings
See “Endpoint Prevent for Mac agent advanced agent settings features” on page 1733.
■ Endpoint Discover features
See “Endpoint Discover for Mac targets features” on page 1734.
See “Endpoint Discover for Mac file system support” on page 1734.
See “Endpoint Discover for Mac advanced agent settings support” on page 1735.

Mac agent installation and tools feature details

You can manually install an agent, or use your endpoint deployment tools (for example, Apple
Remote Desktop and Casper) to install agents to many Mac endpoints.

Mac agent installation support

To install the DLP Agent on Mac endpoints, you create an installation package using the Agent
Packaging screen in the Enforce Server administration console.
Table 74-1 provides additional information regarding installation support.
 Summary of DLP Agent for Mac support 1720
Mac agent management features

Table 74-1 Mac agent installation support

Supported Not supported

■ Command-line installation for installing a single ■ UI-based installer for single agent manual
agent manually. installation.
■ You can find more information in the "Process ■ Disabling the agent uninstall password using the
to install the DLP Agent on Mac" topic of the Enable Uninstall Password troubleshooting
Symantec Data Loss Prevention Installation task.
Guide.
■ Installation of many agents using endpoint
deployment tools.
■ You can find more information in the "Installing
DLP Agents on Mac endpoints silently" topic of
the Symantec Data Loss Prevention Installation
Guide.

Mac endpoint tools features

Table 74-2 provides information about endpoint tools support for the Mac DLP Agent.

Table 74-2 Endpoint tools features

Supported Not supported

■ create_package ■ GetAppInfo
■ DeviceID You can use the Activity Monitor application to
■ logdump gather the same information. See “Defining
■ start_agent macOS application binary names” on page 1909.
■ uninstall_agent
■ vontu_sqlite3
■ service_shutdown

See “About agent password management”on page 1923 on page 1923.

Mac agent management features

Symantec Data Loss Prevention provides the ability to generate location information for the
incidents that are logged from Mac DLP Agents.
 Summary of DLP Agent for Mac support 1721
Overview of Mac agent detection technologies and policy authoring features

Mac agent endpoint location

Table 74-3 Mac agent endpoint location

Supported Not supported

■ Automatic location ■ Manual

If the Manual option is selected, all incidents
indicate that the incident was logged while the
agent was off the corporate network.

See “Setting the endpoint location” on page 1751.

Mac agent groups features

Table 74-4 Mac agent groups features

Supported Not supported

■ Endpoint Server Group condition Custom attributes based on Active Directory

■ Agent Attributes:
■ Agent Host Domain
■ Agent Host Type
■ Agent Host Version
■ Logged in User
■ Logged in User Domain
■ Custom attributes based on Active Directory

See “Creating and managing agent attributes” on page 1852.

Overview of Mac agent detection technologies and

policy authoring features
Mac DLP Agents support Described Content Matching (DCM), which includes detection through
data identifier, regular expression, and keyword rules. Mac DLP Agents support Indexed
Document Matching (IDM). The agent also supports various response rules for Endpoint
Prevent and Endpoint Discover.

Mac agent detection technologies

The following detection technology features apply to both Endpoint Prevent and Endpoint
Discover.
 Summary of DLP Agent for Mac support 1722
Overview of Mac agent detection technologies and policy authoring features

Table 74-5 Detection technology support for Mac endpoints

Supported Not supported

■ Described Content Matching (DCM) to detect ■ Exact Data Matching (EDM)

the following content and context: ■ Vector Machine Learning (VML)
■ Data Identifiers ■ Two-tier detection
See “Introducing data identifiers” on page 612. ■ Directory Group Matching (DGM) for User
■ Keywords Group-based policies that use the Recipient
See “Introducing keyword matching” based on a Directory Server Group rule
on page 686.
■ Regular Expressions
See “Introducing regular expression
matching” on page 700.
■ File properties
See “Introducing file property detection”
on page 711.
■ User, sender, and recipient patterns
See “Introducing described identity matching”
on page 737.
■ Protocol signatures
See “Introducing protocol monitoring for
network” on page 723.
■ Destinations, devices, and protocols
See “Introducing endpoint event detection”
on page 727.
■ Directory Group Matching (DGM) for User
Group-based policies, limited to the condition
Sender/User based on a Directory Server Group
rule
See “Configuring the Sender/User based on a
Directory Server Group condition” on page 751.
■ Indexed Document Matching (IDM) using partial
matching in the following detection scenarios:
■ Data moved to removable storage and
network shares using Save As operations
are monitored using partial match IDM
■ Data pasted to browsers or other configured
applications are monitored using partial
match IDM
See “Introducing Indexed Document Matching
(IDM)” on page 512.
 Summary of DLP Agent for Mac support 1723
Overview of Mac agent detection technologies and policy authoring features

Mac agent detection technology policy scenarios

If a policy uses both supported and unsupported detection technologies, the Mac DLP Agent
applies the DCM and IDM detection rules in exceptions and policies and does not provide any
matches for unsupported detection technologies.
Table 74-6 outlines policy configurations that your organization may be using and states
whether detection is applied on Mac endpoints for each.

Table 74-6 Policy rules and detection scenarios for Mac endpoints

Policy configuration Detection applied on Mac Description

endpoints

DCM rule DCM rule is applied If the policy uses keyword matching
with EDM index matching (connected
OR
by OR expression), the documents
EDM or VML rules that contain the keyword log incidents.

However, if the document does not

contain the keyword but matches the
EDM index, no incident is logged. The
EDM index is not applied.

DCM rule No rules are applied If the policy uses keyword matching
with EDM index exact matching
AND
(connected by AND expression), the
EDM or VML rules documents that contain the keyword
do not log incidents, even if the
document matches the EDM index.
The EDM index is not applied.

Exception rule in a policy that contains DCM exception is applied If the policy uses an exception with
DCM detection keyword matching (for example,
"sensitive") and uses EDM profile
OR
matching (connected by OR
Exception rule in a policy that contains expression), the document that
EDM, or VML rules contains the "sensitive" keyword is
excluded from being monitored.

However, if the document does not

contain the "sensitive" keyword but
matches the EDM index, the document
is not excluded from being monitored.
In this scenario, only the DCM
exception rule is applied. Documents
that match the EDM index are not
excluded from being monitored.
 Summary of DLP Agent for Mac support 1724
Overview of Mac agent detection technologies and policy authoring features

Table 74-6 Policy rules and detection scenarios for Mac endpoints (continued)

Policy configuration Detection applied on Mac Description

endpoints

Exception rule in a policy that contains No exceptions are applied If the policy uses an exception with
DCM detection keyword matching (for example,
"sensitive") and EDM profile matching
AND
(connected by AND expression), the
Exception rule in a policy that contains document that contains the "sensitive"
EDM or VML keyword is excluded from being
monitored even if the document
matches the EDM index. Documents
that match the EDM index are not
excluded from being monitored.

DCM rule DCM rule is applied If the policy uses keyword matching
(for example "sensitive") and uses an
AND
EDM profile exception (connected by
Exception rule in a policy that contains AND expression), the documents that
EDM or VML contain the keyword log incidents.

However, the documents that match

the EDM index are not excluded from
being monitored.

See “About policy creation for Endpoint Prevent” on page 1748.

Mac agent policy response rule features

The following policy response rule features apply to Endpoint Prevent and Endpoint Discover
as noted.
See “About monitoring policies with response rules for Endpoint Servers” on page 1748.

Endpoint Discover on Mac response rule features

If unsupported response rules are part of a policy that is applied to Mac endpoints, incidents
are logged, but the agent does not apply the unsupported response rules.
 Summary of DLP Agent for Mac support 1725
Mac agent monitoring support

Table 74-7 Symantec Data Loss Prevention response rules

Supported Not supported

■ Add Note ■ Endpoint Discover: Quarantine File

■ Log to a Syslog Server ■ Endpoint FlexResponse
■ Send Email Notification
■ Set Status
■ Limit Incident Data Retention

Endpoint Prevent on Mac response rule features

In most cases, if unsupported response rules are part of a policy that is applied to Mac
endpoints, incidents are logged, but the agent does not apply these response rules.

Table 74-8 Endpoint Prevent response rules

Supported Not supported

■ Endpoint: Notify ■ Endpoint: User Cancel

■ Endpoint: Block
■ Endpoint Prevent: Encrypt
■ Add Note
■ Log to a Syslog Server
■ Send Email Notification
■ Set Status
■ Limit Incident Data Retention
■ Endpoint FlexResponse
■ Limit Incident Data Retention response rule
combined with Endpoint: Block configuration
used with Application File Access
If these response rules are used together,
sensitive files are blocked, but blocked files are
not available for access in the Application File
Access incident.

See “Response rule actions for endpoint detection” on page 1201.

Mac agent monitoring support

The following section provides information on the channels, applications, and file filters that
the Mac DLP Agent monitors.
 Summary of DLP Agent for Mac support 1726
Mac agent monitoring support

Table 74-9 Monitoring channels supported on Mac endpoints

Supported Not supported

■ Destinations ■ Destinations
■ Removable storage ■ CD/DVD
See “Mac agent removable storage features” ■ Local drive
on page 1727. ■ Printer/Fax
■ Clipboard ■ Clipboard
■ Paste ■ Copy
See “Clipboard features supported on Mac ■ Email
agents” on page 1728. ■ Lotus Notes
■ Email ■ Web
■ Outlook
■ IE (HTTPS)
See “Mac agent Email features” on page 1729.
■ Edge (HTTPS)
■ Web
■ HTTP
■ Firefox (HTTPS)
■ FTP
■ Chrome (HTTPS)
■ Configured Applications
■ Safari (HTTPS)
■ Cloud Storage
See “Mac agent browser features”
■ Network Shares
on page 1730.
■ Copy to Local Drive
■ Configured Applications
■ Location based monitoring
■ Application File Access
If Manual is used for the Endpoint Location, all
See “Mac agent Application Monitoring
Mac agents are identified as Off the Corporate
features” on page 1730.
Network.
■ Network Shares
■ Device Control
■ Copy to Share
■ USB Storage
See “Mac agent copy to network share
■ Network Share
features” on page 1731.
■ Block Print Screen
■ Location based monitoring
If Automatic is used for the Endpoint Location,
DLP Agents running on Mac endpoints support
this feature.

The Mac agent does not support monitoring files saved from Microsoft Office applications to
the following cloud and web locations:
■ WebDAV shares
■ SharePoint
■ SharePoint Online
■ OneDrive
■ OneDrive for Business
 Summary of DLP Agent for Mac support 1727
Mac agent monitoring support

See “About Endpoint Prevent monitoring” on page 1736.

Mac agent removable storage features

Table 74-10 provides information about the removable storage features for the Mac DLP Agent.

Table 74-10 Mac agent removable storage features

Supported Not supported

■ Removable storage file systems include HFS+ (all
versions of macOS Extended), FAT, and exFAT
■ File type filters applied based on file extension
■ USB devices mounted as mass storage device
■ USB 2.0 and 3.0 removable storage devices
■ File copy operations, including support for these
applications: Finder and Terminal
■ Documents that are saved to removable storage using
Save As operation from the following applications:
■ Microsoft Office 2011
■ TextEdit
■ Preview
■ Archive Utility
■ Acrobat Reader
■ Sensitive files that are blocked are automatically moved ■
to the File Recovery location
See “Recovering sensitive files on Mac endpoints”
on page 1801.
■ Restoring files
■ True file type filtering. The Mac agent does not perform
a file signature match when it filters on certain file types.
The agent uses the file extension to apply file type
filters.
See “Filter by File Properties settings” on page 1788.
■ Configurable recovery file path. When a block response
rule is applied, sensitive files are moved to the recovery
folder on the Mac endpoint. This recovery folder is at
$HOME/My Recovered Files, where $HOME is the
endpoint user's home directory. The file is saved in the
recover location to prevent a complete loss of the file.
The recover location is specified in the Block pop-up.
See “Recovering sensitive files on Mac endpoints”
on page 1801.
■ File copies to NTFS removable storage file systems
File types for iWorks 2013 and higher
■ USB 1.0 removable storage devices
■ Response rule pop-ups when sudo commands are
used to move sensitive files to removable storage
devices. Detection occurs, appropriate response rules
are executed, and default pop-up responses are sent.
■ File transfers over Media Transfer Protocol (MTP)
■ Pop-up when command-line terminals (for example,
SSH client) from remote machines are used to move
sensitive files to removable storage devices
■ Actual file names in incidents for Microsoft Office files.
When an Office file is saved to a removable storage
device using a Save As operation, the Mac agent
displays the actual file name in the incident. For other
applications, the Mac agent might capture a temporary
file name that macOS creates during the Save As
process.
See “About endpoint incident lists” on page 1316.

See “About removable storage monitoring” on page 1737.

 Summary of DLP Agent for Mac support 1728
Mac agent monitoring support

The following known issues apply to the Mac DLP Agent support for removable storage. The
"Issue ID" is a Symantec internal number used for tracking purposes only.

Table 74-11 Removable storage known issues

Description Workaround

A file copy operation of multiple files using Finder is blocked when one file contains sensitive data. None

Sensitive files that have been recovered may no longer contain Spotlight metadata-like comments. None

If a keyword policy that uses a Block response rule detects sensitive information being moved from None
a Mac endpoint to a removable storage device and the sensitive information is found in a package
file (for example .pkg, .dmg, or .lpdf), the sensitive file is blocked and the rest of the package
file is moved to its intended destination. This often causes the package file to become corrupt.

Clipboard features supported on Mac agents

Table 74-12 lists supported and unsupported Clipboard Paste operations monitoring.

Table 74-12 Clipboard Paste features

Supported Not supported

■ Monitoring Clipboard data pasted to specific ■ Monitoring 32-bit Mac applications

applications ■ Monitoring sandboxed applications
■ Monitoring Clipboard Paste for the following ■ Monitoring data copied from one chat application
applications (though Paste monitoring in general window to another window in the same chat
still needs to be enabled): application. Effected chat applications can
■ Firefox include Jabber and Skype.
■ Google Chrome
Note: Clipboard Paste monitoring is
automatically enabled when you enable the
Chrome HTTPS monitor channel. When
sensitive data is pasted from the Clipboard
in this scenario, the agent logs HTTPS
incidents.
■ Safari
■ Cisco Jabber
■ Skype

See “About clipboard monitoring” on page 1743.

The following known issues apply to the Mac DLP agent Clipboard Paste monitoring feature.
 Summary of DLP Agent for Mac support 1729
Mac agent monitoring support

Table 74-13 Clipboard Paste monitoring known issues

Description Workaround

Duplicate incidents are created when the Clipboard Disable Clipboard Paste for the browser on the
Paste setting is enabled for browsers monitored Application Monitoring screen.
using the Application Monitoring feature, and the
browser's HTTPS monitor channel is also enabled.

Some applications use paste operations that the Symantec advises that you test the application
endpoint user does not initiate, which may cause behavior before you enable Clipboard Paste
false positive incidents. monitoring.

Mac agent Email features

Table 74-14 lists Outlook monitoring support.

Table 74-14 Outlook features

Supported Not supported

■ Microsoft Outlook 2011 and 2016 ■ Monitoring data pasted to Outlook

■ Monitoring sensitive information in all fields of ■ Monitoring contacts contained in an unexpanded
email, and meeting invitations, as well as distribution list (DL)
attachments in each ■ Ability to monitor data when the sender or user
■ Detecting and preventing sensitive information matches the User Group (EDM policies)
from leaving a Mac endpoint when sent from ■ Monitoring out of office messages
Outlook ■ Using signature-based file monitoring filters (on
■ Detecting and preventing sensitive information Outlook 2011 and 2016)
in both plain text and HTML formats
■ Ability to ignore and monitor attachments based
on file type and size
■ Ability to monitor data whether Outlook is
connected to the network or not

Table 74-15 Outlook 2016 known issue

Description Workaround

If a meeting invitation contains sensitive data and None

is blocked, the invitation remains in the sender's
calendar.

See “About endpoint network monitoring” on page 1739.

 Summary of DLP Agent for Mac support 1730
Mac agent monitoring support

Mac agent browser features

Table 74-16 lists information about the browser features for the Mac DLP Agent. These features
apply to monitor support for Firefox, Chrome, and Safari browsers.

Table 74-16 Browser features

Supported Not supported

■ Preventing sensitive information from being ■ Monitoring inline data

uploaded to HTTPS and HTTP sites.
■ Filtering by file size and type
■ Monitoring child processes
■ Monitoring pasted data
■ Monitoring files uploaded using drag and drop

See “About endpoint network monitoring” on page 1739.

The following known issues apply to the Mac DLP Agent support for browsers.

Table 74-17 Mac agent browser known issues

Description Workaround

Duplicate incidents are created for users who Disable the Monitor Application File Access
upgraded from a previous version of Symantec Data setting on the Application Monitoring screen.
Loss Prevention in which Chrome was monitored
See “Changing application monitoring settings”
using the Monitor Application File Access feature.
on page 1897.

Multiple URLs display in an incident when users None

upload the same sensitive file to multiple browser
tabs. For example, multiple URLs display in an
incident when a user uploads a sensitive file to
gmail.com and box.net that are running in two tabs.

Block and notify pop-ups display unknown for the None

URL when sensitive files are uploaded through a
child process.

Mac agent Application Monitoring features

Table 74-18 lists Application Monitoring settings support.
 Summary of DLP Agent for Mac support 1731
Mac agent monitoring support

Table 74-18 Application Monitoring features

Supported Not supported

■ Monitoring and preventing file uploads using browsers
(Chrome, Firefox, and Safari)
■ Monitoring and preventing files sent in emails in Outlook
2011 and Outlook 2016
■ White listing applications
Enable the Removable Storage setting under the
Application Monitoring Configuration, Destinations
area to use this feature.
You can find more information on white listing. See
“Ignoring macOS applications” on page 1909.
■ Monitoring using the Application File Access, Open
access monitoring setting under the Application
Monitoring Configuration, Application File Access
area
■ Monitoring using the Clipboard, Paste monitoring
setting under the Application Monitoring
Configuration, Clipboard area
■ Monitoring using the Application Monitoring
Configuration setting: Application File Access, Open
■ The following fields do not apply to Mac applications:
■ Internal Name
■ Original Filename
■ Publisher Name
■ Monitoring using the Local Drive and Print/Fax
settings under the Application Monitoring
Configuration, Destinations area
■ Monitoring using the monitoring setting under the
Application Monitoring Configuration area
■ Monitoring using the Clipboard, Copy monitoring
setting under the Application Monitoring
Configuration, Clipboard area
■ Monitoring using the HTTP and FTP settings under the
Application Monitoring Configuration, Web area
■ Monitoring using the Application Monitoring
Configuration setting: Application File Access, Read
The system defaults to the Open setting.
■ Monitoring data pasted from the Clipboard for 32-bit
applications.

See “About monitoring applications” on page 1896.

The following known issue applies to the Mac DLP Agent support for applications.

Table 74-19 Application Monitoring known issue

Description Workaround

Duplicate incidents are created and pop-ups display when Disable these applications on the Application Monitoring
sensitive data is moved to the following applications or screen.
protocols:

■ Chrome
■ Safari
■ Firefox
■ Outlook

Mac agent copy to network share features

Mac agent copy to network share features lists supported and unsupported Copy to network
share features.
 Summary of DLP Agent for Mac support 1732
Mac agent monitoring support

Table 74-20 Copy to network share features

Supported Unsupported

■ Endpoint: Notify response rule ■ WebDAV

■ Endpoint: Block response rule ■ Endpoint: FlexResponse response rule
■ The following network protocols: ■ Endpoint Prevent: User Cancel
■ Apple Filing Protocol (AFP)
■ Common Internet File System (CIFS)
■ File Transfer Protocol (FTP) (including
Secure File Transfer Protocol [SFTP] and
FTP Secure [FTPS])
■ Network File System (NFS)
■ Secure message block (SMB)

See “About network share monitoring” on page 1742.

Mac agent filter by file properties features

Table 74-21 lists file property filter features for the Mac DLP Agent.

Note: The stated support also applies to removable storage monitoring.

Table 74-21 Filter by file properties

Supported Not supported

■ File type The Mac DLP Agent does not perform true file type
■ File size matching when it filters file types. The agent uses
■ File path the file extension to apply file type filters.

Note: File path filters are supported for See “True file type filtering” on page 1792.
Application File Access but not Removable
Storage monitoring.
■ File extension monitoring

See “Filter by File Properties settings” on page 1788.

Mac agent filter by network properties features

Table 74-22 lists network property filter features for the Mac DLP Agent.
 Summary of DLP Agent for Mac support 1733
Endpoint Prevent for Mac agent advanced agent settings features

Table 74-22 Filter by network properties

Supported Not supported

■ Filtering by file type, size, and path ■ Filtering using IP addresses

■ File copies from Mac endpoints to network ■ File copies from network shares to Mac
shares endpoints

See “Filter by Network Properties settings” on page 1793.

Endpoint Prevent for Mac agent advanced agent

settings features
Supported advanced agent settings
■ FileSystem.APPS_LIST_USES_TRUNCATE_FILE_FOR_BLOCK_RULE
■ FileSystem.ENABLE_FILE_RESTORATION
■ FileSystem.IGNORE_STORAGE_BUS_TYPE
■ FileSystem.MONITOR_APPLICTION_CHILD_PROCESS_FILE_ACCESS
■ FileSystem.NUM_OF_LISTENER_THREADS
■ FileSystem.THREAD_POOL_MAX_CAPACITY

Unsupported advanced agent settings

■ FileSystem.DRIVER_FILE_OPEN_REQUEST_TIMEOUT
■ FileSystem.ENABLE_VEP_FILE_ELIMINATION
■ FileSystem.MAX_BACKLOG
■ FileSystem.NUM_TIMES_TO_OVERWRITE_FILE
See “Advanced agent settings” on page 1804.
 Summary of DLP Agent for Mac support 1734
Endpoint Discover for Mac targets features

Endpoint Discover for Mac targets features

Table 74-23 Endpoint Discover targets features

Supported Not supported

■ Using multiple Endpoint Servers for an Endpoint ■ Using environment variables to include or
Discover scan exclude file locations (for example, $Windows$)
■ Using filters to include or exclude specific file ■ Long-term average CPU usage
paths and file types as well as using wildcards ■ Minimum battery life remaining
(*) ■ Endpoint quarantine
■ Using filters to include or exclude by file size ■ Pausing scans
■ Scanning files added or modified since last full
scan
■ Scanning files that were modified last
■ Running incremental scans
■ Setting next scan and full scan
■ Adjusting the scan idle timeout
■ Setting max scan duration
■ Enabling scan when user idle
■ Scanning specific computers using IP address
and host name

See “About Endpoint Discover scanning” on page 1755.

Note: For macOS, a file’s timestamp (the timestamp when the file was created, modified, or
accessed) does not change if you copy the file from one location to some other location. If an
Endpoint Discover full scan is run, and later, if any files are locally moved into the Endpoint
Discover target folder path, but the files were last modified prior to the time of the full scan,
then the next incremental scan does not scan these files. Since the timestamp of the files
predates the time of the full scan, even though the files were added to the target folder after
the scan, they are not recognized as files to be considered for an incremental scan.
In such a case, Symantec recommends that you run a full scan instead of an incremental scan.

See “About Endpoint Discover full scanning” on page 1757.

See “About Endpoint Discover incremental scanning” on page 1757.

Endpoint Discover for Mac file system support

Table 74-24 lists support for the file systems that Endpoint Discover can scan.
 Summary of DLP Agent for Mac support 1735
Endpoint Discover for Mac advanced agent settings support

Table 74-24 Endpoint Discover supported file systems

Supported Not supported

■ HFS+ (all versions of macOS Extended) NTFS

■ FAT
■ exFAT

Endpoint Discover for Mac advanced agent settings

support
The following advanced agent settings are supported:
■ Discover.CRAWLER_THREAD_PRIORITY.str
■ Discover.POST_SCAN_REPORT_INTERVAL.int
■ Discover.SCAN_ONLY_WHEN_IDLE.int
■ Discover.SECONDS_UNTIL_IDLE.int
■ Discover.STANDARD_REPORT_INTERVAL.int
See “Advanced agent settings” on page 1804.
 Chapter 75
Using Endpoint Prevent
This chapter includes the following topics:

■ About Endpoint Prevent monitoring

■ About policy creation for Endpoint Prevent

■ How to implement Endpoint Prevent

About Endpoint Prevent monitoring

Endpoint Prevent policies detect and block confidential information moving from endpoints or
virtual desktops in your organization. The Endpoint Server either pushes policies to DLP Agents
or applies policies directly to files that are sent from the DLP Agents. Depending on the type
of policy that you create, the policy is applied either by the DLP Agents directly or by the
Endpoint Server. When DLP Agents or Endpoint Servers detect an activity that violates a policy
rule, an incident is generated. You can review and remediate the incidents that display in the
endpoint incident list.

Note: Policy groups that are assigned to an Endpoint Server apply equally only to connected
Windows agents.

Endpoint Prevent can perform many different types of monitoring. The following table provides
references to the types of monitoring you can select.

Table 75-1 Endpoint Prevent Monitoring

Type of Monitoring

About removable storage monitoring

About endpoint network monitoring

 Using Endpoint Prevent 1737
About Endpoint Prevent monitoring

Table 75-1 Endpoint Prevent Monitoring (continued)

Type of Monitoring

About CD/DVD monitoring

About print/fax monitoring

About network share monitoring

About clipboard monitoring

About application monitoring

About cloud storage application monitoring

About virtual desktop support with Endpoint Prevent

Endpoint Prevent monitors the activity on endpoints regardless if they are connected to an
Endpoint Server. If an endpoint is disconnected from the network and cannot connect to an
Endpoint Server, Endpoint Prevent continues to monitor the endpoint. All incidents are stored
in the Agent Store until the endpoint is re-connected to the Endpoint Server. If the Agent Store
exceeds the specified size limit, older files are ejected until the size limit is no longer exceeded.
Endpoint Prevent does not stop monitoring the endpoint if the Agent Store exceeds the specified
size limit.
See “About Endpoint Prevent monitoring” on page 1736.
See “About the DLP Agent store” on page 1800.
See “Workflow for implementing policies” on page 337.
See “Mac agent monitoring support” on page 1737.

About removable storage monitoring

Endpoint Prevent lets you block data transferring from your hard drive to a removable media
device on Windows and Mac endpoints. About removable storage monitoring lists the supported
removable media devices where applicable.

Table 75-2 Supported removable storage media devices

Media device Supported on Windows endpoints Supported on Mac

endpoints

Compact flash card Yes Yes

eSATA removable drives Yes No

FireWire connected devices Yes Yes

 Using Endpoint Prevent 1738
About Endpoint Prevent monitoring

Table 75-2 Supported removable storage media devices (continued)

Media device Supported on Windows endpoints Supported on Mac

endpoints

Memory cards, including Yes Yes

SDXC and SDHC cards

USB flash drives a memory Yes Yes

sticks

Thunderbolt storage devices No Yes

Devices that use Media Yes No

Transfer Protocol (MTP)

macOS supported removable storage file systems include the following:

■ HFS+ (all versions of macOS Extended)
■ FAT
■ FAT32
■ exFAT
Windows supported removable storage file systems include the following:
■ NTFS
■ FAT
■ FAT32
When the DLP Agent detects that an incident has occurred, the data is not transferred. An
incident is created and sent to the Endpoint Server. When an incident occurs, the DLP Agent
displays a pop-up notification to the user that informs the user that the incident has occurred.
The notification also requires a justification for the file transfer. This justification appears in the
incident snapshot.
See “Setting report preferences” on page 1354.
For example, a user copies a Microsoft Word file that contains medical records from an endpoint
to a USB flash drive. The DLP Agent blocks this file from being transferred to the flash drive.
When the file is blocked, a pop-up notification appears on the user’s screen, stating that the
file transfer is a violation of a specific policy. The pop-up notification also provides a text box
in which the user can justify moving the file to the flash drive. The justification that the user
enters into the pop-up window is visible on the incident snapshot for this incident.
See “About Endpoint Prevent monitoring” on page 1736.
See “Mac agent removable storage features” on page 1727.
 Using Endpoint Prevent 1739
About Endpoint Prevent monitoring

About endpoint network monitoring

Endpoint Prevent lets you monitor or block various types of network events. These events
include the following:
■ HTTP/HTTPS
■ Email/SMTP
■ FTP
Endpoint Prevent lets you block network violations regardless of whether the endpoint is
connected to the corporate network or not. For example, a user takes a laptop out of the office
and accesses a wireless Internet connection in a coffee shop. The Symantec DLP Agent can
still detect, remove, or block any file, text, or email from transferring over the unsecured network.
Incidents that are generated when the endpoint is not connected to the Endpoint Server are
stored in a temporary database. The incidents remain in the database until the connection is
re-established. After the connection to the Endpoint Server is re-established, the incidents are
sent to the Endpoint Server.

HTTP/HTTPS and browser monitoring

DLP Agents can monitor HTTP or HTTPS Web pages and applications. For example, it can
monitor and prevent sensitive information from being transferred by Microsoft Internet Explorer,
Mozilla Firefox, Google Chrome, or any other HTTP application. HTTPS monitoring lets you
monitor or prevent any files from being transferred to an encrypted HTTPS site by Internet
Explorer, Google Chrome, or Firefox web browsers. HTTP and HTTPS prevention also allow
blocking of email messages and attachments from being transferred through Web email
applications. Incidents include destination IP, URL, and message information.
The following browsers are configured to be monitored automatically once you enable the
HTTP/HTTPS channel:
■ IE (HTTPS) on Windows endpoints
■ Firefox (HTTPS) on Windows and Mac endpoints
■ Chrome (HTTPS) on Windows and Mac endpoints
■ Safari (HTTPS) on Mac endpoints
The support of specific capabilities of browsers varies between Windows and Mac endpoints.
See “Mac agent browser features” on page 1730.

Email application monitoring

Endpoint Prevent monitors the most common email applications, Microsoft Outlook, and Lotus
Notes. It can monitor and prevent any information transferring from these applications regardless
of the email protocol. Attachments as well as content in the subject and body of the message
are analyzed. Incidents include information about the endpoint location, sender, recipient, and
the email subject and message.
 Using Endpoint Prevent 1740
About Endpoint Prevent monitoring

FTP protocol monitoring

FTP monitoring prevents files from transferring to an outside file repository over the FTP
protocol. For example, a user attempts to send a file that violates a policy to a remote file
repository using the FTP application Mozilla Filezilla. Endpoint Prevent prevents the file from
transferring to the FTP location. An incident is created for the violation and appears in the
Endpoint reporting section of the Enforce Server. The incident snapshot contains information
about which users attempted to send the file through FTP. It displays the violating file as well
as the IP address of the destination FTP server.

Note: Some network types do not match on the file name monitoring condition. These network
events do not contain file names and so cannot match on this condition. The network monitoring
types that cannot match the file name condition include HTTP/HTTPS and Outlook message
body and text.

All incidents are reported under Endpoint Prevent in the Reports section.
See “About Endpoint Prevent monitoring” on page 1736.
See “About monitoring applications” on page 1896.

About CD/DVD monitoring

CD/DVD monitoring is compatible with all major CD/DVD burning applications.
Endpoint CD/DVD monitoring is designed to monitor specific file types. Performance filters
are available in the agent configuration section. Use them to specify the file types that Endpoint
Prevent monitors. You can also control the effect of the monitoring on the CD/DVD burning
application.
To enable CD/DVD protection, you must select the CD/DVD toggle in the Channels tab of the
Endpoint Server configuration page. You can also create a policy for the files that are copied
to a CD/DVD burner. Create a Protocol or Endpoint Destination rule with the CD/DVD as the
destination. You must specify the content criteria for the policy. Policies can be created using
AND/OR Boolean conditions. Specify the content criteria only using the AND condition in the
policy builder.
For example, you want to create a policy that prevents files with the keyword Farallon from
being burned to a DVD. Your DVD burning application is Roxio 9. Create a blank policy with
a protocol or a device type rule. Select the CD/DVD device type and also match a Content
Matches Keyword rule. Enter Farallon as the keyword. Finish creating the rule with an Endpoint
Block response rule. After you save the policy, the DLP Agent blocks any file that contains the
keyword Farallon from being burned to a DVD.
By selecting the CD/DVD device type, you have specified that the policy affects only files
burned to a CD/DVD. Endpoint hard drives and USB connected media are not affected. By
 Using Endpoint Prevent 1741
About Endpoint Prevent monitoring

combining the device type and keyword match rules, you guarantee that DLP Agents block
only files with the specified keyword. The agents do not block all of the files that are sent to
the CD/DVD application. If you create the CD/DVD block rule without the conjoined keyword
rule, the policy blocks every file that is sent to the burning application. Or, it would block the
files that contain the keyword at the endpoint hard drive and USB connected media as well.

Note: Small files of less than 64 bytes are not detected when read by CD/DVD monitoring.
Files over 64 bytes in size are detected normally.

See “Guidelines for authoring Endpoint policies” on page 1716.

See “About Endpoint Prevent monitoring” on page 1736.

About print/fax monitoring

Endpoint Prevent lets you monitor and prevent sensitive information from being either printed
or faxed. Endpoint Prevent uses the same mechanism to monitor printed and faxed data.
Endpoint Prevent can monitor print jobs started from within an application or using the native
Print utility in Windows Explorer.
Endpoint Prevent analyzes each page of a file as it is sent to the printer or the fax machine.
This means that the initial pages of the file may be printed or faxed if a violation is found in the
middle of the file. For example, a user sends a 10-page document to a printer. If Endpoint
Prevent finds a violation on page three it stops the print job. Pages one and two print but pages
three through ten do not. Endpoint Prevent sends an incident to the Endpoint Server containing
file information and the matching text.

Note: Endpoint Prevent does not monitor the text in the cover page of a fax.

The DLP Agent can also monitor and block the entire print job. The DLP Agent always monitors
PDF files printed from Adobe Acrobat in this manner. You can set the DLP Agent to monitor
files printed from Microsoft Word, PowerPoint, and Excel when Monitor entire file is enabled.
See “Printer/Fax settings” on page 1803.
The incident snapshot contains information regarding which endpoint sent the violating file,
the violating file, and the printer name and the printer type. The printer type is a locally
connected printer, a shared printer, or a network printer, or the user selected the Print to file
option. When Monitor entire file is enabled, the incident snapshot lists the location where the
file was located.
See “Setting report preferences” on page 1354.
See “About Endpoint Prevent monitoring” on page 1736.
 Using Endpoint Prevent 1742
About Endpoint Prevent monitoring

About network share monitoring

Network share monitoring prevents users from moving sensitive files from a network share to
an endpoint and from an endpoint to a network share.
For Windows endpoints, you can use any endpoint response rule for network share monitoring.
For Mac endpoints, you can use the Endpoint: Notify and Endpoint: Block response rules.
The Copy to Local Drive feature prevents users from moving sensitive data from a network
drive to a local drive on a Windows endpoint using Windows Explorer. For example, you have
a remote network share labeled g: drive and local drive labeled c: drive. You can create a
policy that prevents users from moving sensitive data from the g: drive to the c: drive. You
can also create filters in the agent configuration that monitor or ignore files by type, size, and
path which apply to Windows endpoints.
The Copy to Local Drive feature monitors Windows Explorer copy operations. Other types of
network share copy operations, like FTP transfers, third-party applications, save-as operations,
command line utilities, or copy and paste applications, are not covered by this feature.
The Copy to Share feature prevents users from moving sensitive data from a local drive on a
Windows or Mac Endpoint to a network share drive. You can create a policy that blocks sensitive
data from being copied from the c: drive to the g: drive. You can also create filters in the agent
configuration that monitor or ignore files by type, size, and path. The filters you create apply
to both Mac and Windows endpoints.
See “Configuring file filters” on page 1789.
See “About Endpoint Prevent monitoring” on page 1736.
See “Mac agent copy to network share features” on page 1731.

Supported network share monitoring protocols on Windows endpoints

Endpoint Prevent prevents the sensitive data that transfers from Windows endpoints through
Windows Explorer as well as through third-party applications, file browsers, and command
line interfaces that use any of the following Windows network redirector services:
■ LAN Manager (LanMan)
■ Remote Desktop Protocol (RDP)
■ Web Distributed Authoring and Versioning (WebDAV)
The Copy to Share feature monitors network shares like Windows shares, DFS, NAS, UNIX
shares that are configured through Samba, Microsoft Remote Desktop shares, and WebDAV
shares that are accessed through a default WebDAV redirector.
 Using Endpoint Prevent 1743
About Endpoint Prevent monitoring

Supported network share monitoring protocols on Mac endpoints

Endpoint Prevent prevents the sensitive data that transfers from Mac endpoints through Finder,
Terminal commands, and the following file transfer protocols:
■ Apple Filing Protocol (AFP)
■ Common Internet File System (CIFS)
■ File Transfer Protocol (FTP) (including Secure File Transfer Protocol [SFTP] and FTP
Secure [FTPS])
■ Network File System (NFS)
■ Secure message block (SMB)

About clipboard monitoring

Endpoint Prevent stops users from copying and pasting sensitive data from one application
to another by the Windows Clipboard. Endpoint Prevent does not prevent users from copying
and pasting sensitive data within the same application.
For example, if a user copies sensitive information from a Word document and pastes it in an
IM message, Endpoint Prevent blocks the transfer. The blocking occurs because copy and
paste functions use the Windows Clipboard. The user receives a pop-up notification that states
the reason why the transfer was blocked. In the Endpoint Report, the incident snapshot contains
an incident and the text of the information pasted into the email message. Incidents are created
at the time of the cut, copy or paste action.
See “Setting report preferences” on page 1354.
See “About Endpoint Prevent monitoring” on page 1736.
See “Clipboard features supported on Mac agents” on page 1728.

About application monitoring

By default, Symantec Data Loss Prevention monitors applications such as Microsoft Outlook,
Cisco Jabber, Skype, Google Chrome, and Mozilla Firefox. You can configure global changes
to default applications. You can set Symantec Data Loss Prevention to monitor blacklist or
whitelist items, CD/DVD applications, applications that use Clipboard functions, and applications
that upload content to the Internet.
Symantec Data Loss Prevention lets you monitor third-party applications for IM, email, or
HTTP/S clients. Examples of third-party applications include Yahoo Messenger (YM), AIM,
and Mozilla Thunderbird. To monitor these applications, you add them on the Application
Monitoring screen (System > Agents > Application Monitoring).
 Using Endpoint Prevent 1744
About Endpoint Prevent monitoring

The SPDY protocol is automatically disabled to prevent data loss over HTTPS. You can turn
off this setting using the NetworkMonitor.DISABLE_SPDY_PROTOCOL advanced agent
setting. See “Advanced agent settings” on page 1804.
See “About monitoring applications” on page 1896.
See “Mac agent Application Monitoring features” on page 1730.

About cloud storage application monitoring

Endpoint cloud storage application monitoring provides monitor and prevent support for cloud
file sync and share applications. You can access cloud storage application monitoring settings
on the System > Agents > Application Monitoring screen.
If an endpoint user updates content in the files that a cloud application syncs, the cloud
application attempts to upload the file to the cloud service. If a user adds sensitive content,
Symantec Data Loss Prevention prevents the file from uploading to the cloud.
The DLP Agent monitors and blocks sensitive files that a user attempts to save from Microsoft
Office 2010, 2013, and 2016 applications (Word, Excel, and PowerPoint) to cloud storage and
web locations. The following destinations are monitored by default:
■ Box
■ WebDAV share
■ SharePoint
■ SharePoint Online
■ Microsoft OneDrive
■ Microsoft OneDrive for Business
The agent also monitors files uploaded from supported Microsoft Office applications (including
Outlook) to Box using the Box for Office add-in. You enable this feature on the Agent
Configuration screen. See “Cloud Storage settings” on page 1802.
If you use a block response rule in the policy, Symantec Data Loss Prevention creates a Cloud
Storage incident, and sensitive content is quarantined on the endpoint. The endpoint user can
restore the previous file version from the configured recovery location where the file is saved
indefinitely. See “File Recovery Area Location settings” on page 1800.
You cannot delete any of the default cloud storage applications that are provided on the
Application Monitoring screen. If you want to monitor a cloud storage application that is not
listed on this screen, you can add it. See “Adding a Windows application” on page 1902.
You can allow uploads of sensitive files by corporate users to corporate Box accounts and
prevent sensitive file uploads to non-corporate Box accounts (for Windows endpoints). This
feature monitors and prevents file uploads through the Box Sync application as well as those
performed from the Word, Excel, PowerPoint, and Outlook Microsoft Office applications
 Using Endpoint Prevent 1745
About Endpoint Prevent monitoring

(versions 2010, 2013, and 2016) through the Box for Office add-in. See “Ignore User Identities
for Cloud Storage Applications settings” on page 1795.
Table 75-3 lists the default cloud storage applications that Symantec Data Loss Prevention
monitors.

Table 75-3 Brand names and binary names of monitored cloud storage applications

Brand name Binary name

Box BoxSync.exe

Dropbox Dropbox.exe

Google Drive googledrivesync.exe

HighTail Hightail.exe

iCloud iCloudDrive.exe

Microsoft OneDrive OneDrive.exe

Microsoft Skydrive SkyDrive.exe

About virtual desktop support with Endpoint Prevent

Endpoint Prevent can monitor virtual desktops and prevent remote users from copying sensitive
data that is accessible through a virtual desktop. A DLP Agent can be installed in each virtual
desktop. By running a DLP Agent in the virtual host, you can prevent a user from copying
confidential data that is accessible from the hosted virtual desktop to a remote computer or
device that may not be secure. You can configure the DLP Agent to monitor storage volumes,
print and fax requests, clipboards, and network activity on the virtual desktop.
Endpoint Prevent can monitor virtual desktops hosted by any of the following virtualization
software:
■ Microsoft Hyper-V virtualization server
■ Microsoft Remote Desktop Services
■ VMware View virtualization server
■ VMware Fusion
■ Citrix XenDesktop and Citrix XenApp/Application servers
See “About Citrix XenDesktop and Citrix XenApp support” on page 1746.
See “About Endpoint Prevent monitoring” on page 1736.
 Using Endpoint Prevent 1746
About Endpoint Prevent monitoring

About Citrix XenDesktop and Citrix XenApp support

The DLP Agent is installed on Citrix XenDesktop and Citrix XenApp/Application servers, where
it can detect confidential data sent to a Citrix client computer.

Performance and deployment

Table 75-4 provides deployment recommendations and performance details.

Table 75-4 Citrix deployment and performance

Product Deployment recommendations and performance details

Citrix XenApp ■ You must install the DLP Agent software on each XenApp server host and
on any individual application servers that publish applications through
XenApp.
■ All detection on Citrix XenApp is performed in a single thread (all user
activities are analyzed sequentially).
■ Symantec tests indicate that the DLP Agent software can support a maximum
of 40 simultaneous clients per Citrix server. However, detection performance
varies depending on the server hardware, the type of applications that are
used, and the activities that Citrix clients perform. You must verify the DLP
Agent performance characteristics for your environment.

Citrix XenDesktop ■ You must install the DLP Agent software on each virtual machine on the
XenDesktop server.
■ The DLP Agent software can connect either to a dedicated Endpoint Prevent
server or to an Endpoint Prevent server that is shared with non-Citrix agents.
You cannot connect to an Endpoint Prevent server that is reserved for Citrix
XenApp.
Note: If you use the same server for both Citrix and non-Citrix agents, you
cannot configure events independently for each environment.

Detection server restriction for Symantec DLP Agents on Citrix XenApp

Symantec does not recommend using a single Endpoint Prevent detection server with both
physical endpoint computers and Citrix XenApp servers. When you use the Enforce Server
administration console to configure endpoint events to monitor, you must deselect CD/DVD
and Local Drive events for Citrix XenApp agents. (These items are present on the Agent
Configuration screen, but they are not supported for Citrix XenApp.) Using the same Endpoint
Server for non-Citrix agents limits the functionality of those agents because you must disable
Local Drive and CD/DVD events for the server as a whole.
To support the DLP Agent on both Citrix XenApp servers and physical endpoint computers,
Symantec recommends that you deploy two Endpoint Servers and ensure that each server is
reserved for either Citrix XenApp agents or physical endpoint agent installations.
 Using Endpoint Prevent 1747
About Endpoint Prevent monitoring

Citrix virtualized endpoint monitor coverage

The DLP Agent monitors the following locations and activities on the Citrix virtualized endpoint:
■ Volumes
■ Print/fax requests
■ Clipboard
■ Network
■ Scanning Microsoft Office files
■ Restoring files on Citrix client drives
■ Monitoring application file access and files uploaded to browsers

Note: If XenApp streams an application directly to an endpoint computer, the Symantec DLP
Agent that is deployed to the XenApp server cannot monitor the streamed application.

Incidents logged from Citrix virtualized endpoints

All incidents that are generated on Citrix drives by the DLP Agent display as Removable
Storage Device incidents. In the Enforce Server administration console, you cannot deselect
the Removable Storage event for Citrix drives. The Removable Storage event is always
monitored by the agents that are deployed to Citrix servers.

Note: The IP addresses in incident snapshots contain the IP address of the XenDesktop virtual
machine or XenApp server, and not a Citrix client.

About VMware Fusion implementation

The settings you make when you implement VMware Fusion virtual endpoints affects what
Symantec Data Loss Prevention can monitor.
The following settings affect Symantec Data Loss Prevention monitor support:
■ More Seamless allows Symantec Data Loss Prevention to monitor files that reside on or
move from both the Windows virtualized endpoint and the Mac host file system.
■ More Isolated allows Symantec Data Loss Prevention to monitor data that resides on or
moves from the Windows virtualized endpoint.

About rules results caching (RRC)

Rules results caching (RRC) is a form of pre-detection on the DLP Agent. By caching information
about any content that does not match a rule, the DLP Agent can ignore that content. RRC
 Using Endpoint Prevent 1748
About policy creation for Endpoint Prevent

speeds detection because it allows the DLP Agent to only perform detection on new or recently
changed content.
Only Described Content Matching (DMC) rule results can be cached in the DLP Agent. Other
types of detection, Exact Data Matching (EDM), File Properties Type (FPT), and Indexed Data
Matching (IDM) are not applicable to RRC. Additionally, RRC is not applicable to protocol or
to group detection rules.
See “Detecting data loss” on page 340.
Any time that the policies that are associated to the DLP Agent change, the RRC cache is
deleted. Previous RRC results are cleared and you must scan all of your content again.
However, after the initial scan is complete, subsequent scans are much quicker to complete.
By default, RRC is active. If you do not want RRC, go to the advanced agent settings and set
it to Off.

About policy creation for Endpoint Prevent

Endpoint Prevent policies execute DCM and VML conditions locally on the endpoint. An
Endpoint Prevent policy contains a response rule that creates a real-time user interaction. The
user interaction either blocks a file transfer or notifies the user of a policy violation. These
notifications are then attached to the incident.
Endpoint policies also differ as to where the detection occurs. Detection for EDM and DGM
policies is performed on the Endpoint Server. Detection for DCM and IDM policies is performed
directly by the Symantec DLP Agent.
The response rules Block, Notify, and User Cancel are performed only by the Symantec DLP
Agent.
Because detection for EDM, and DGM policies is performed on the Endpoint Server, the
detection takes more time and uses more bandwidth. Extra time and bandwidth are required
because file contents are sent to the Endpoint Server for detection. When an agent performs
detection for IDM and DCM policies, it only sends incidents to the Endpoint Server.
See “Guidelines for authoring Endpoint policies” on page 1716.
See “Workflow for implementing policies” on page 337.
See “Mac agent detection technology policy scenarios” on page 1723.

About monitoring policies with response rules for Endpoint Servers

Endpoint-specific response rules include Endpoint Block, Endpoint Notify, Endpoint Quarantine,
and User Cancel. Endpoint Block stops the movement of data that violate policies. Endpoint
Notify educates the user about the violation that has occurred, but does not block or stop
movement of the data. Endpoint Quarantine moves a file with sensitive information from the
 Using Endpoint Prevent 1749
About policy creation for Endpoint Prevent

local drive to a secure location. Endpoint Quarantine is only applicable for Endpoint Discover.
User Cancel lets the endpoint user decide whether or not to allow the data to transfer. All rules
create a pop-up display window that contains information about the violated policy. Each rule
requests that the user provide a justification for the action. Endpoint Block and Endpoint Notify,
and User Cancel are applicable to all Endpoint Prevent detection policies that are performed
on the endpoint. For example, HTTP/HTTPS, Email/STMP, FTP, CD/DVD, eSATA, Print/Fax,
and USB monitoring all use Endpoint Block or Endpoint Notify rules.
The Endpoint Notify and Block and User Cancel response rules are not applicable to:
■ Violations that are found through Endpoint Discover
■ Violations on local drive monitoring
See “Workflow for implementing policies” on page 337.
See “Mac agent policy response rule features” on page 1724.

About Endpoint Block

You can create a policy to restrict any data from transferring from the endpoint. For example,
you want to stop any text, email, or file that contains the keyword Farallon from transferring
from the computer. You can create a keyword match policy with the word Farallon as the
violation keyword.
See “Workflow for implementing policies” on page 337.
You want to ensure that this policy is used across all endpoints. In the response rules section,
select Endpoint Block as the response rule. This response rule is only applicable to the
endpoint. If a file is transferred from the hard drive to a CD/DVD drive, a pop-up notification
appears on that specific endpoint. The notification states that the action is in violation of the
Farallon keyword policy.
The Endpoint Block response rule prevents the file from being moved. However, you also want
to have a record of why the violation occurred. In the response rule, you can create a series
of justifications. These justifications allow the endpoint user who committed the violation to
explain why the violation occurred. These justifications can include user education, a
manager-approved file move, or others.

About Endpoint Notify

You can create a policy and a response rule that educates endpoint users by using the Endpoint
Notify response rule. The Endpoint Notify response rule displays a pop-up message describing
the violation and educates the endpoint user on the appropriate policy.
For example, an endpoint user sends an email that contains the word Farallon in the body of
the email. Endpoint Notify generates an incident that is sent to the Endpoint Server and displays
a pop-up notification on the endpoint. The notification states the policy that was violated and
that the endpoint action is now monitored. The endpoint user enters a reason for the violation,
 Using Endpoint Prevent 1750
About policy creation for Endpoint Prevent

accepts the notification, and the email proceeds normally. Endpoint Notify does not prevent
data movement, it only notifies users of policy violations. The endpoint user’s justification for
the violation becomes part of the incident report that is sent to the Enforce Server.
Not all policy groups and policies are applicable with Endpoint response rules. If you try to
create a policy with incompatible rules and responses, you will receive an error message. The
error states that the policy is incompatible with the Endpoint response rules.
Response rules can distinguish between those incidents that are created on the corporate
network and those created off of the corporate network. This condition lets you specify whether
the rule operates at all times or only when the endpoint is connected or disconnected from the
corporate network.

About Endpoint User Cancel

You can create a response rule that lets endpoint users decide whether or not to allow sensitive
data to transfer from their computers. You can use the User Cancel response rule to educate
your endpoint users on proper business policies. For example, if an endpoint user sends
sensitive information through email and receives the User Cancel popup notification, they can
cancel the data transfer. They are now educated on your company's policies. Additionally, if
there is a legitimate need for the endpoint user to transfer sensitive data, they can allow the
action. If they allow the action, the data is transferred normally.
In both cases, the Symantec DLP Agent generates an incident that is sent to the Enforce
Server.
Endpoint users are only allowed a specific amount of time to decide whether or not to override
the policy. If the specified amount of time is exceeded, the policy automatically blocks the data
transfer and generates an incident. By default, the time is limited to 60 seconds. That option
is applied to all violations of that policy that occur in the following 10 seconds.
If multiple violations of the same policy are blocked, the endpoint user must only enter the
justification once. The justification appears in the incident snapshot of the incident. The incident
snapshot also contains the action that was taken. The incident snapshot contains one of the
following actions:
■ User Notified, Action: Allowed
■ User notified, Action: Canceled
■ User Notified, Action: Timeout Canceled
■ User Notified, Action: Timeout Allowed

Note: You can specify whether or not to allow the default action of a timeout to block the data
transfer or allow it.

See “Configuring the Endpoint Prevent: User Cancel action” on page 1282.
 Using Endpoint Prevent 1751
How to implement Endpoint Prevent

See “Guidelines for authoring Endpoint policies” on page 1716.

How to implement Endpoint Prevent

Endpoint Prevent monitors each endpoint for the data that is moved from one place to another.
If Endpoint Prevent detects a violation, it blocks the data from being transferred. Endpoint
Prevent notifies the user of the violation and can require a justification from the user.
Implementing Endpoint Prevent requires that you complete the following processes in order.

Table 75-5 Implementation steps

Step Action For more information

1 Add an Endpoint Server. See “Adding a detection server” on page 234.

2 Create endpoint agent configurations. See “About agent configurations” on page 1783.

3 Set the endpoint location. This is an optional See “Setting the endpoint location” on page 1751.
step.

4 Install the Symantec DLP Agent. For installation details, see the appropriate Symantec
Data Loss Prevention Installation Guide.

5 Create an endpoint policy. See “About policy creation for Endpoint Prevent”
on page 1748.

6 Create endpoint response rules. See “Response rule actions for endpoint detection”
on page 1201.

7 Configure reports. See “About Symantec Data Loss Prevention reports”

on page 1352.

See “Introducing synchronized Directory Group Matching (DGM)” on page 747.

Setting the endpoint location

The endpoint location is used to define how Symantec Data Loss Prevention determines
whether or not the endpoint is connected to the corporate network. You can specify if you want
the Endpoint Server to automatically detect if the endpoint is on the corporate network. You
can also enter domain names or IP addresses to use to manually determine if the endpoint is
connected to the network.
Using the automatic method to determine endpoint location, Symantec Data Loss Prevention
identifies the computer as on or off the corporate network based on the DLP Agent connection
to the Endpoint Server.
The automatic endpoint location method is explained in the following list:
 Using Endpoint Prevent 1752
How to implement Endpoint Prevent

■ On the corporate network:

If the DLP Agent is connected to the Endpoint Server, Symantec Data Loss Prevention
identifies the agent as on the corporate network. The DLP Agent connection to the Endpoint
Server is transient, which means that the agent disconnects from the Endpoint Server after
a prescribed period of time. During the transient connection period, Symantec Data Loss
Prevention considers the agent as on the corporate network.
■ Off the corporate network:
This status means that the DLP Agent is disconnected from the Endpoint Server. The DLP
agent may become disconnected ungracefully from the Endpoint Server. For example, an
ungraceful disconnection occurs when the network interface that connects the agent to the
Endpoint Server becomes disconnected. If the DLP Agent is disconnected ungracefully,
Symantec Data Loss Prevention identifies the endpoint as off the corporate network.

See “About agent status” on page 1867.

Using the manual method to determine endpoint location means that you must first input a
range of domain names or IP addresses. Symantec Data Loss Prevention then uses this
information to determine if the endpoint is connected to the corporate network. If a range of
domain names is configured, the DLP Agent performs a reverse DNS lookup on the host IP
address. It then matches the retrieved DNS host names with the configured domain names in
the list. If a range of IP addresses is configured, the DLP Agent matches the host IP address
against the list of configured IP addresses. Each individual host IP address must be on the
corporate network for the endpoint to be considered connected to the corporate network.
Domain names must not contain wildcard characters and should be simple suffixes; for example,
symantec.com.
IP addresses may contain wildcard characters in place of a single block. For example,
192.168.*.*.
See “About Endpoint Prevent monitoring” on page 1736.
To set the Endpoint Location setting
1 Go to System > Agents > Endpoint Location. The current endpoint location settings
are displayed. By default, the endpoint location determination is set to Automatic.
2 Click Configure.
3 Select an item to configure how the Enforce Server determines endpoint location.
■ Select Automatically to let the Endpoint Server determine whether an agent is on or
off the corporate network.

Note: You must use automatic endpoint location to identify Mac endpoint locations.
Manual endpoint location is not supported for DLP Agents running on Mac endpoints.
 Using Endpoint Prevent 1753
How to implement Endpoint Prevent

■ Select Manually and enter a list of domain names or IP addresses in the correct field.
Enter only one domain name or IP address per line.

4 Click Save.
The changes take effect after the agent reconnects to the Endpoint Server.
See “How to implement Endpoint Prevent” on page 1751.
See “Endpoint Server—basic configuration” on page 222.
See “Mac agent endpoint location” on page 1721.

About Endpoint Prevent response rules in different locales

You can create different endpoint response rule notifications that are specific to the locale of
an endpoint. A locale refers to the system locale setting in the operating system of the endpoint.
For example, you create response rule notifications in English, French, or Japanese. If a user's
locale is specified as Japanese, the Japanese-language version of the notification appears
on the user's screen. If a different user with a French locale violates the same policy, the
French-language version of the notification appears.
The Enforce Server lets you specify multiple user notifications. However, the first language
that is specified is the default language. You cannot delete the default language response
notification. You can add or delete any notification or language that is not specified as the
default language. At installation, the default language is set to whichever language is set as
the Enforce Server language. If the language you want is unsupported, the Enforce Server
tries to display the English-language notification.
For example, you have a Japanese-locale endpoint and a Vietnamese-locale endpoint. The
Vietnamese locale is not a supported locale. If a violation occurs on the Japanese-locale
computer, the Enforce Server displays the Japanese notification. If no Japanese notification
is available, the Enforce Server displays the default-language notification. If the
Vietnamese-locale computer violates a policy, the Enforce Server displays the English
notification because no Vietnamese notification is possible. If the English notification is
unavailable, the Enforce Server displays the default-language notification.
If the first language you add is not supported on the endpoint, that language cannot be
considered the default language. The endpoint must contain the specific language details to
consider a language as the default language. Although the text of the notification appears in
the unsupported language, the notification window buttons and title bar appear in the default
locale of the Enforce Server.
If you want to define an unsupported language as the default language, you must select Other
as the first language. This Other label removes all other languages in the list. Use the Endpoint
configuration options to modify the text of the pop-up window labels. You cannot specify other
language responses if you select the Other option. The Other setting displays that language
notification on every endpoint, regardless of the system locale of the endpoints.
 Using Endpoint Prevent 1754
How to implement Endpoint Prevent

See “Advanced agent settings” on page 1804.

Note: All English locales default to the English (United States) setting. All French locales default
to the French setting. For example, the French (France) setting supports all types of French
such as French (Canada) and French (France).

See “Setting Endpoint Prevent response rules for different locales” on page 1754.

Setting Endpoint Prevent response rules for different locales

You can set different response rules for different locales. The first locale that you designate
becomes your default locale. You cannot delete this locale, although you can delete additional
locals.
See “About Endpoint Prevent response rules in different locales” on page 1753.
Setting a localized response rule
1 Go to Manage > Policies > Response Rules.
See “Configuring response rules” on page 1221.
2 Create the response rule normally.
3 Click the Add Language link.
4 Select the language that you want to use.
If you want to specify an unsupported language as the default language, select Other.
5 Enter text in the display fields and the justification fields using the designated language.
6 Click Save.
 Chapter 76
Using Endpoint Discover
This chapter includes the following topics:

■ How Endpoint Discover works

■ About Endpoint Discover scanning

■ Preparing to set up Endpoint Discover

■ Setting up and configuring Endpoint Discover

■ Creating an Endpoint Discover scan

■ Managing Endpoint Discover target scans

How Endpoint Discover works

Endpoint Discover lets you examine a local drive in your organization for any data that is a
potential risk. Endpoint Discover notifies you when it finds a file that violates your policies and
it identifies where the file is located on the endpoint system. Endpoint Discover can scan any
local drive that is connected to the endpoint. It cannot scan Windows network shares, CD/DVD
drives or removable media devices such as eSATA drives, USB flash drives, or SD cards.
See “About Endpoint Discover scanning” on page 1755.

About Endpoint Discover scanning

Endpoint Discover scans the local drive of endpoints to find any currently existing files that
violate your policies. Endpoint Discover scans all local drives on your endpoints. For example,
if your computer has two physical local drives installed, Endpoint Discover scans both local
drives for any files that violate your policies. Endpoint Discover does not scan those drives
that are mounted through a network or removable media such as eSATA drives, flash drives,
or SD cards.
 Using Endpoint Discover 1756
About Endpoint Discover scanning

You can use Endpoint Discover to scan all the endpoints in an organization and scan only the
specified endpoints in an organization.

Note: From Symantec Data Loss Prevention 15.0, Two Tier Detection (TTD) is not supported.
However, even if a Two Tier Detection request is generated for DLP Agent versions earlier
than 15.0, Endpoint Server ignores these agents, and does not perform two-tier detection.

To start or stop a scan that is configured for an Endpoint Server, the DLP Agent must be
connected to the Endpoint Server. If the DLP Agent is not connected to the Endpoint Server,
the scan starts when it reconnects to the Endpoint Server. A scan is only complete when all
of the endpoints have completed the scan. If one endpoint is disconnected from the Endpoint
Server, the scan cannot complete until that endpoint reconnects or the scan times out. If an
endpoint is disconnected after a scan has started, the endpoint continues the scan offline and
communicates the status after it reconnects to the Endpoint Server. If the endpoint remains
disconnected and exceeds a configured timeout period, the scan reports a timeout status.
In a load-balanced environment, select all of the Endpoint Servers that connect to a load
balancer. So that when endpoints connect to any of these Endpoint Servers, the endpoints
receive the same scan details.
All incidents are stored in the Agent Store until the computer is reconnected to the Endpoint
Server. If the Agent Store exceeds the specified size limit, the scan pauses until the Agent
reconnects to the Endpoint Server and transfers the incidents.
See “About the DLP Agent store” on page 1800.

About scanning targeted endpoints

You can use targeted Endpoint Discover scans to do the following:
■ Define an Endpoint Discover scan that uses multiple Endpoint Servers to target endpoints.
■ Define an Endpoint Discover scan that targets individual endpoints.
An Endpoint Discover Target can be configured to scan specific endpoints. You can identify
the endpoints using host name or IP address. You can also upload a file that lists endpoints
by host name and IP address. Scan policies are applied only on these specified endpoints.
See “Creating an Endpoint Discover scan” on page 1764.
You can use one of the following options as described in the following table when creating an
Endpoint Discover Target:
 Using Endpoint Discover 1757
About Endpoint Discover scanning

Table 76-1 Options for creating an Endpoint Discover target

Option Description

Specify the Endpoint In this case, the Enforce Server sends the scan details to the specified Endpoint
Servers without Servers. When the endpoints connect to the specified Endpoint Servers, then
specifying the endpoints the scan details are sent to them.

Specify the Endpoint In this case, the Enforce Server sends the scan details to the specified Endpoint
Servers and the Servers. When the specified endpoint connects to the specified Endpoint
endpoints Server, the scan details are sent to the specified endpoints. Thus, only the
specified endpoints run the scan, and optimize the network bandwidth and
save time.

About Endpoint Discover full scanning

An Endpoint Discover Target can be configured to use the full scan option. This option scans
all the files on the endpoint.
If you have changed the policy or modified the filters significantly in an existing endpoint target
and want these changes to take effect, then you may need to run a full scan instead of an
incremental scan.
See “About Endpoint Discover incremental scanning” on page 1757.
See “Using include and exclude filters” on page 1770.

About Endpoint Discover incremental scanning

By default, Endpoint Discover targets are created as incremental scan targets. In an incremental
scan, the DLP Agent scans only the files that have been added or modified since the beginning
of the previous scan. When you run the scan target for the first time, the DLP Agent scans all
files on the endpoint.

Note: With the addition of the incremental scan support for Endpoint Discover, the differential
scan option is no longer available. However, if you have endpoints with DLP Agent versions
14.6 and 15.0, and you run an Endpoint Discover incremental scan, then versions 14.6 agents
still run the differential scan. See “Scanning new or modified items with differential scans”
on page 1571. for more information on differential scan.

See “About Endpoint Discover full scanning” on page 1757.

See “Using include and exclude filters” on page 1770.
 Using Endpoint Discover 1758
About Endpoint Discover scanning

How incremental scan for Endpoint Discover works

In the incremental scan, the DLP Agent remembers the date, time, and file location of the last
file scan. This is information is called checkpoint. The DLP Agent saves the checkpoint in its
local database. So that it can use this checkpoint to resume the scan from where it left-off last
time.
Incremental scans complete in the following phases:
■ Phase 1: The DLP Agent scans the files that cannot be scanned in the previous run of the
same Endpoint Discover Target.
■ Phase 2: The DLP Agent scans only the files that are added or modified since the last
checkpoint.
The following examples outline the incremental scan sequence for two endpoints.
■ When the previous scan is incomplete on Endpoint 1 and completes on Endpoint 2. The
incremental scan scans in two phases:
For Endpoint 1:
■ Phase 1: Completes the previous incomplete scan.
■ Phase 2: Scans only the files that are added or modified since the last checkpoint.
For Endpoint 2:
■ Phase 1 is not applicable as the previous scan was complete.
■ Phase 2 is applicable and incremental scan scans only the files that are added or
modified since the last checkpoint.

The above example is summarized in the following table:

Table 76-2 Incremental scan running in two phases

Phases Previous scan is not complete Previous scan is complete on Endpoint 2

on Endpoint 1

Phase 1 Applicable Not Applicable

Phase 2 Applicable Applicable

■ Consider another example, where a new Endpoint Discover Target scan is run for the first
time with the incremental scan option, then in this case only the phase 2 is applicable. The
incremental scan scans all the files that are added or modified since January 1st 1970
(Epoch time).
 Using Endpoint Discover 1759
About Endpoint Discover scanning

Note: Symantec recommends that you run a full scan instead of an

incremental scan in the following cases:
■ You run an Endpoint Discover target scan and later modify the filter path to include a file
that was not part of this previous Endpoint Discover target scan. If this file was not modified
since the last checkpoint, then this file is not scanned if you run an incremental scan.
■ For macOS, a file’s timestamp (the timestamp when the file was created, modified, or
accessed) does not change if you copy the file from one location to some other location.
If an Endpoint Discover full scan is run, and later, if any files are locally moved into the
Endpoint Discover target folder path, but the files were last modified prior to the time of the
full scan, then the next incremental scan does not scan these files. Since the timestamp
of the files predates the time of the full scan, even though the files were added to the target
folder after the scan, they are not recognized as files to be considered for an incremental
scan.

About parallel scans on targeted endpoints

An Endpoint Server can receive multiple scans from the Enforce Server and run them in parallel
provided the specified targeted endpoints are not overlapping. In case of overlap that is if the
same endpoint is targeted in two different scans, the first scan has to complete before the
second scan begins.
Consider the following scenarios that outline the parallel scan sequence for the DLP Agents:
A, B, C, and D, all connected to the same Endpoint Server. The following Endpoint Discover
Target scans run on the specified DLP Agents:
■ Scan 1 runs on DLP Agents A and B
■ Scan 2 runs on DLP Agents C and D
■ Scan 3 runs on DLP Agents A and C
Scenario 1:
In this case, start the scan 1 and 2 one after the other. As a result, DLP Agents A and B receive
the scan 1 details and DLP Agents C and D receive the scan 2 details. Since there are no
overlapping DLP Agents on each of these scans, scan 1 and scan 2 run in parallel.
Scenario 2:
In this case, start the scan 1 first and then start scan 3. As a result, the DLP Agents A and B
receive the scan 1 details and DLP Agent C receives the scan 3 details. In this scenario, DLP
Agent A is the overlapping endpoint, and it can run only one scan at a time. So DLP Agents
A and B run the scan 1, and DLP Agent C runs the scan 3. Note that DLP Agent A does not
start running Scan 3 as soon as it finishes Scan 1. DLP Agent A waits for Scan 1 to complete
on DLP Agent B, before it can start running Scan 3.
 Using Endpoint Discover 1760
Preparing to set up Endpoint Discover

You can run parallel scans. You do not have a hard limit on how many parallel scans you can
run. However, the following are the constraining factors:
■ Size and complexity of the policy
■ DLP Agent polling interval (ServerCommunicator.CONNECT_
POLLING_INTERVAL_SECONDS.int)
See “Advanced agent settings” on page 1804.
■ Endpoint Server memory
However as an indication, in our test labs, we have been able to run over 30 parallel scans
per Endpoint Server computer that has memory of 9 GB for a medium policy complexity, and
with DLP Agent polling interval of 15 minutes.
See “Creating an Endpoint Discover scan” on page 1764.
See “Creating a new Endpoint Discover target” on page 1765.

Optimizing the scan for endpoint performance

By default, Endpoint Discover scans endpoint resources, which may minimize user activities
on the endpoint. You can optimize endpoint performance by completing the following:
■ Manage resources, such as long-term average CPU usage and minimum battery life
remaining, when Endpoint Discover scans endpoints.
See “Resource Consumption for Endpoint Discover Scans settings” on page 1799.

Note: DLP Agents running on Mac endpoints do not use CPU bandwidth management and
minimum battery life setting.

See “Endpoint Discover for Mac targets features” on page 1734.

■ Configure the DLP Agent to perform an Endpoint Discover scan while the endpoint user is
idle. You set the user idle time by adjusting the following advanced agent settings.
See “Advanced agent settings” on page 1804.
■ Discover.SCAN_ONLY_WHEN_IDLE.int
■ Discover.SECONDS_UNTIL_IDLE.int

Preparing to set up Endpoint Discover

Before you begin setting up and configuring Endpoint Discover scans, you must complete
prerequisite steps.
Table 76-3 lists the steps you must complete.
 Using Endpoint Discover 1761
Preparing to set up Endpoint Discover

Table 76-3 Endpoint Discover prerequisite steps

Step Action More information

1 Add an Endpoint Prevent Server if one is not An Endpoint Prevent Server provides monitor,
already present or modify an existing one. prevent, and scanning features for DLP Agents.

See “Endpoint Server—basic configuration”

on page 222.

2 Create a policy group. See “Creating a policy group for Endpoint Discover”
on page 1761.

3 Create a policy. See “Creating a policy for Endpoint Discover”

on page 1762.

4 Add a rule. See “Adding a rule for Endpoint Discover”

on page 1762.

See “Setting up and configuring Endpoint Discover” on page 1763.

Creating a policy group for Endpoint Discover

Creating a policy group for Endpoint Discover is exactly like creating a policy group for Network
Discover. Instead of deploying these policy groups on different nodes in your system, the policy
groups are deployed through the Symantec DLP Agents. After you have created the policy
group, you can assign specific policies to the policy group.
To create a policy group
1 Go to System > Servers and Detectors > Policy Groups.
2 On the Policy Group List screen that appears, click Add.
3 Enter a policy-group name (of up to 256 characters) and a description. Choose an
informative name because other users must access it when choosing which policy group(s)
to associate with roles, policies, and Endpoint Discover targets.
4 Choose the detection server to assign to this policy group. This is an optional step.
You can assign the policy group to all detection servers or to individual servers. Note that
Symantec Data Loss Prevention automatically assigns all policy groups to all Endpoint
Discover servers.
5 Click Save.
See “Setting up and configuring Endpoint Discover” on page 1763.
See “Creating and modifying policy groups” on page 399. for more details creating a policy
group.
 Using Endpoint Discover 1762
Preparing to set up Endpoint Discover

Creating a policy for Endpoint Discover

.
See “Guidelines for authoring Endpoint policies” on page 1716.
You can set the status of the policy as either Active or Suspend. By default, policies are set
to Active status. If you select Suspend, the policy is not applied to the DLP Agents.
The following instructions apply to creating a blank policy. You can also create policies based
on pre-existing templates. The following instructions use sample data and specific instructions
to illustrate how to create a policy.
To create a policy for Endpoint Discover
1 Go to Manage > Policies > Policy List on the Enforce Server.
2 Click Add Policy, and click Next.
3 Select Add a blank policy.
4 Enter a name to identity the policy in the Name field.
5 Enter details about the policy in the Description field of the new policy.
6 Select the policy group you want associated with this policy from the drop-down menu.
After you create the policy, you must add rules to the policy.
See “Adding a rule for Endpoint Discover” on page 1762.
See “Setting up and configuring Endpoint Discover” on page 1763.
See “Adding a new policy or policy template” on page 375. for more details on adding a new
policy.

Adding a rule for Endpoint Discover

After you have created a policy for Endpoint Discover, you must add rules to the policy. You
can add one or more rules to the policy. You must add at least one rule to the policy.
See “Creating a policy for Endpoint Discover” on page 1762.
To add a rule to a policy
1 Under the Detection tab, click Add Rule to add a rule for the policy.
2 Select an appropriate rule. For example, select the Content Matches Regular Expression
radio option.
3 Select the policy you want to use in the drop-down menu.
This procedure links the previously created list to the rule.
4 Click Next.
 Using Endpoint Discover 1763
Setting up and configuring Endpoint Discover

See “Setting up and configuring Endpoint Discover” on page 1763.

See “Adding a rule to a policy” on page 378. for more details to add a rule to a policy.

About Endpoint Quarantine

You can create an automated response rule that allows Endpoint Discover to remove files
from a local drive and place them in a secure location. If an Endpoint Discover scan finds a
file containing sensitive data, the file is quarantined and removed from the non-secure location.
The secure location can be either on the local drive or it can be a secure location on the
corporate network. You can create marker files that replace the confidential data. The marker
files alert endpoint users that the file contained confidential information and was quarantined.
You can include variables in the marker text that describe aspects of the incident such as the
file name, the violated policy, and the location of the secure folder.
The endpoint-specific response rules Endpoint Block, Endpoint Notify, and User Cancel are
not applicable for Endpoint Discover.

Note: Endpoint quarantine is not available for DLP Agents running on Mac endpoints.

The quarantine location can be either a secured folder on the local drive or a folder on a remote
file share that is accessible by the endpoint through the corporate network. You can choose
if you want to enable credentials on the secure location or allow any anonymous user to access
the location.

Note: Encrypting File Service (EFS) folders cannot support anonymous access.

Not all policy groups and policies are applicable with Endpoint response rules. If you try to
create a policy with incompatible rules and responses, you receive an error message. The
error states that the policy is incompatible with the Endpoint response rules.
See “Guidelines for authoring Endpoint policies” on page 1716.
See “How to implement Endpoint Prevent” on page 1751.
See “Configuring the Endpoint Discover: Quarantine File action” on page 1270.

Setting up and configuring Endpoint Discover

To implement Endpoint Discover, you must follow a specific set of tasks. These tasks are
similar to Network Discover, but not identical.
Complete the following configuration tasks:
 Using Endpoint Discover 1764
Creating an Endpoint Discover scan

Table 76-4 Implementing Endpoint Discover

Step Action More information

Step 1 Create an Endpoint Discover target. See “Creating an Endpoint Discover scan” on page 1764.

Step 2 Install the Symantec DLP Agent. For installation details, see the appropriate Symantec
Data Loss Prevention Installation Guide.

Step 3 Configure reports. See “About Symantec Data Loss Prevention reports”
on page 1352.

See “Preparing to set up Endpoint Discover” on page 1760.

Creating an Endpoint Discover scan

To create an Endpoint Discover scan, you set up an Endpoint Discover target. Later you
configure the target meet your scanning requirements.
The Endpoint Discover target can also be configured to scan specific locations on endpoints.
The scan can use filters to target local drives, file types, or folders to find policy violations. For
example, the fixed drive or the My Documents folder in Windows can be configured as a filter.

Table 76-5 Steps to configure scan settings for an Endpoint Discover scan target

Step Description More information

1 Configure a new Endpoint Discover target. Go to the Manage > Discover

Scanning > Discover Targets
screen and click New Target,
Endpoint File System.

See “Creating a new Endpoint

Discover target” on page 1765.

2 Configure the incremental or full scan You set this information on the
General tab when you configure
the new target.

See “About Endpoint Discover

incremental scanning”
on page 1757.

See “About Endpoint Discover full

scanning” on page 1757.
 Using Endpoint Discover 1765
Creating an Endpoint Discover scan

Table 76-5 Steps to configure scan settings for an Endpoint Discover scan target (continued)

Step Description More information

3 Configure the targeted endpoints You set this information on the

Targeting tab when you configure
the new target.

See “About scanning targeted

endpoints ” on page 1756.

4 Add location, file size, date, and file type filters to the You enter this information on the
Endpoint Discover target. Filters tab when you configure the
new target.

See “About Endpoint Discover

filters” on page 1770.

5 Configure the scan idle timeout and max scan duration You set this information on the
settings. Advanced tab when you
configure the new target.

See “Configuring Endpoint

Discover scan timeout settings”
on page 1777.

Note: You cannot schedule Endpoint Discover targeted scans. Each scan must be started
manually. You must also manually stop the scan, allow it to complete, or allow it to timeout.
You cannot pause an Endpoint Discover scan.

Creating a new Endpoint Discover target

For a new Endpoint Discover target, enter the name of the target, the policy group, and the
Endpoint Server where the scans can run.
These required fields should be set when a new target is added.
To enter the required fields for a target
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets.
2 Click New Target, and select File System under Endpoint.
 Using Endpoint Discover 1766
Creating an Endpoint Discover scan

3 Complete the following items on the General tab.

Name Enter a name for the Endpoint Discover target.

Policy Groups Select the Endpoint Discover policy group you created.

See “Creating a policy group for Endpoint Discover” on page 1761.

If no other policy group has been selected, the Default Policy group is used.
You can assign multiple policy groups to a target.

The administrator defines policy groups on the Policy Group List page. If
the policy group you want to use does not appear on the list, contact your
Symantec Data Loss Prevention administrator.

Scan Execution Select the Scan only new or modified items (incremental scan) option for
an incremental scan. This option is the default for new targets.

See “About Endpoint Discover incremental scanning” on page 1757.

See “How incremental scan for Endpoint Discover works” on page 1758.
Note: When you select this option, the date filters for Only scan files added
or modified and for Only scan files last accessed are disabled in the Filters
tab.

If you have changed the policy or other definitions in an existing scan, set up
the next scan as a full scan to ensure complete policy coverage. Select the
Always scan all items (full scan) option.

See “About Endpoint Discover full scanning” on page 1757.

Note: If you change the scan type from incremental to full scan, then the
incremental scan resets the checkpoint. The modified scan configuration is
used for the files that are scanned from that checkpoint.
 Using Endpoint Discover 1767
Creating an Endpoint Discover scan

4 Configure the following items on the Targeting tab under the Scan Server and Target
Endpoints section.

Servers Select an Endpoint Server (or multiple Endpoint

Servers) to use to run the scan.

Only the detection servers that were configured

as Endpoint Servers appear on the list. Configure
your Endpoint Servers before you configure
targets. You must specify at least one server
before you can run a scan for this target.

Target Endpoints In the Enter hostnames and IP addresses field,

enter the exact endpoint host name or the IP
address that is connected to the selected scan
servers. Two-tier detection is not performed for
the selected endpoints. Click Add to add these
specified agents to the list of target agents.
Note: Wildcard characters are not supported in
the host name.

You can create a file that has list of host names

or IP addresses of the target agents. This file
should have the host name or IP address per
line. In the Add hostnames and IP addresses
from a file field, click Browse to locate this file,
and then click Upload.

5 Configure the items in the Filters tab.

See “Filtering Discover targets by item size” on page 1545.

Include Filters Enter items to include in the Endpoint Discover

scan monitoring.

See “About Endpoint Discover filters” on page 1770.

Exclude Filters Enter items to exclude in the Endpoint Discover

scan monitoring.

See “About Endpoint Discover filters” on page 1770.

Ignore Smaller than Exclude items smaller than a particular size by

entering a number in the field next to Ignore
Smaller Than. Then select the appropriate unit
of measure (Bytes, KB, or MB) from the
drop-down list next to it.

Ignore Greater than
Only scan files added or modified...
Using Endpoint Discover 1768
Creating an Endpoint Discover scan
Exclude items larger than a particular size by
entering a number in the field next to Ignore
Larger Than. Then select the appropriate unit of
measure (Bytes, KB, or MB) from the drop-down
list next to it.
Select this option to include files based on the
added or modified date. Endpoint Discover only
scans items after the specified After date, before
the specified Before date, or between the dates
you specify.
Note: If the On or After date is later than the
Before date, then no items are scanned. If the
Before date and the On or After date are the
same, then no items are scanned. No items are
scanned because the assumed time of the
Before parameter is at zero hours, and On or
After is at 24 hours.
When you select this option, you can also select
from the following options:
■ On or After: To include the items that are
created or modified (whichever is newer) after
a particular date, type the date. You can also
click the date widget and select a date.
■ Before: To include the items that are created
or modified (whichever is older) before a
particular date, type the date. You can also
click the date widget and select a date.
See “Filtering Discover targets by date last
accessed or modified” on page 1545.
 Using Endpoint Discover 1769
Creating an Endpoint Discover scan

Only scan files last accessed... Select this option to include files based on the
last accessed date.

Endpoint Discover only scans items after the

specified After date, before the specified Before
date, or between the dates you specify.
Note: If the After date is later than the Before
date, then no items are scanned. If the Before
date and After date are the same, then no items
are scanned. No items are scanned because the
assumed time of the Before parameter is at zero
hours, and After is at 24 hours.

When you select this option, you can also select

from the following options:

■ After: To include the items that are accessed

after a particular date, enter the date. You
can also click the date widget and select a
date.
■ Before: To include the items that are
accessed before a particular date, enter the
date. You can also click the date widget and
select a date.

See “Filtering Discover targets by date last

accessed or modified” on page 1545.
 Using Endpoint Discover 1770
Creating an Endpoint Discover scan

6 Configure the items in the Advanced tab.

Scan Idle Timeout Enter the scan idle timeout in minutes or hours
to stop the Endpoint Discover scan if no
endpoints report scan status to the Enforce
Server for a specified period of time. To disable
Scan Idle Timeout, select Indefinite for the
duration of time.

See “Configuring Endpoint Discover scan timeout

settings” on page 1777.

Max Scan Duration Enter the maximum scan time duration in

minutes, hours, or days for an Endpoint Discover
scan to run. To disable Max Scan Duration,
select Indefinite for the duration of time. When
an Endpoint Discover scan exceeds the Max
Scan Duration, the Endpoint Discover scan stops
and displays timeout status.

See “Configuring Endpoint Discover scan timeout

settings” on page 1777.

7 Click Save to save all updates to the target.

About Endpoint Discover filters

Endpoint Discover filters help you to optimize the time Endpoint Discover takes to complete
a scan. You set include and exclude filters for the following:
■ File types
■ Folder paths
■ File size
■ File added or modified date
■ File last accessed date
See “Creating an Endpoint Discover scan” on page 1764.
See “Using include and exclude filters” on page 1770.
See “Setting up Endpoint Discover filters to include or exclude items from the scan” on page 1773.

Using include and exclude filters

Exclude and include filters let you reduce the number of items to scan.
 Using Endpoint Discover 1771
Creating an Endpoint Discover scan

Use the Include Filters field to specify the items that Symantec Data Loss Prevention should
process. If you leave the Include Filters field empty, Symantec Data Loss Prevention performs
matching on all items in the selected target. If you enter any values in the field, Symantec Data
Loss Prevention scans only those items that match your filter.
Use the Exclude Filters field to specify the items that Symantec Data Loss Prevention should
not process. If you leave the Exclude Filters field empty, Symantec Data Loss Prevention
performs matching on all items in the selected target. If you enter any values in the field,
Symantec Data Loss Prevention scans only those items that do not match your filter.
When both include filters and exclude filters are present, exclude filters take precedence.
Table 76-6 lists the items you can include or exclude by using filters.

Table 76-6 Items that can be filtered

Item to filter Description

Files types You can enter file extensions in the Include Filters and Exclude Filters to
include or exclude file types, respectively.

Folder paths You can enter folder paths in the Include Filters and Exclude Filters to
include or exclude folders, respectively.

You can specify a folder path filter for both Windows and Mac endpoints in
the same Include filters and Exclude filters fields.

You can use environment variables to include or exclude file locations.

See “Using environment variables in Endpoint Discover scans” on page 1774.

Whenever you change the values of the Include or Exclude filters for an Endpoint Discover
Target with the incremental scan option selected, based on the type of change, it is
recommended that you run the consecutive scan with the full scan option selected.
For example, if you run an Endpoint Discover Target with incremental scan and include filter:
*.docx, then all the files with the extension .docx that were added or modified since the previous
scan is scanned. Later if you change the value of the include filter to: *.pdf and run an
incremental scan, then only the PDF files that are modified since last scan (with include filter:
*.docx) are scanned. In case you want to scan all the PDF files, you need to run the Endpoint
Discover Target scan with the full scan option selected.
See “About Endpoint Discover incremental scanning” on page 1757.
Table 76-7 table lists the syntax you can use when you add filters.
 Using Endpoint Discover 1772
Creating an Endpoint Discover scan

Table 76-7 Syntax for the include filters and exclude filters

Syntax Description

* (asterisk) Use this wildcard to match zero or more characters.

The *.txt,*.doc pattern of an include filter matches files, documents, or folders

with the .txt or .doc extensions and ignores everything else.

A *.* pattern added at the end of the path has the same behavior as a *. For
instance a filter like $Desktop$/* or $Desktop$/*.* have the same
meaning.

If *.* separates a directory path, then Symantec Data Loss Prevention expects
a file or folder with a period (.) that matches the pattern. For example,
/Users/joe/Pack*.*son would match /Users/joe/Package.json
or /Users/joe/Pack.son, but it does not match /Users/Joe/Packson.

A */documentation/*,*/specs/* pattern filters to match on specific

subdirectories of a file share. This example filter pattern only matches the
files that are contained in the two subdirectories that are called
documentation and specs.

? (question mark) Use this wildcard to match one character in the place where it appears.

A *.?? pattern of an include filter only matches files with a two-character

extension. This example matches files, such as hello.go and hello.py,
but not hello.c or hello.cpp.

, (comma) Represents a logical OR. Delimit entries with a comma.

The forward slash (/) and These characters are equivalent. They usually represent directory separators,
backslash (\) characters although on macOS the backslash is a valid character in a file name.

Escape characters The matching process does not support escape characters, so there is no
way to match a question mark, a comma, or an asterisk explicitly. In general,
special characters in filter items are not supported.

Following are some additional examples for the Include and Exclude filters:
■ To scan the entire disk except the Windows folder and Program files on Windows, use the
Exclude filter with value: $Windows$/*,$ProgramFiles$/*
■ To scan the entire disk except Windows folder and Program files on Windows and /usr,
/sbin, /opt on Mac, use the Exclude filter with value:
$Windows$/*,$ProgramFiles$/*,/usr/*,/sbin/*,/opt/*

■ To scan only the office files on Windows and Mac computers, use the Include filter with
value: *.docx,*.doc,*.pptx,*.ppt,*.xlsx,*.xls
■ To scan only the office files on Windows and Mac computers except Windows folder and
Program files on Windows and /usr, /sbin, /opt on Mac, use the following filters:
 Using Endpoint Discover 1773
Creating an Endpoint Discover scan

Include filter with value: *.docx,*.doc,*.pptx,*.ppt,*.xlsx,*.xls

Exclude filter with value: $Windows$/*,$ProgramFiles$/*,/usr/*,/sbin/*,/opt/*
See “Setting up Endpoint Discover filters to include or exclude items from the scan” on page 1773.

Setting up Endpoint Discover filters to include or exclude items from

the scan
You use include and exclude filters to include or exclude files and locations from an Endpoint
Discover scan.
To set up include filters or exclude filters:
1 In the Enforce Server administration console, go to Manage > Discover Scanning >
Discover Targets > New Target > Endpoint > File System screen.
2 Click the name of the scan where you want to add include filters or exclude filters.
3 Click the Filters tab.
By default, the Exclude field displays the following filters:

$Windows$/*,/Applications/*,/System/*,/.Spotlight*,*.mp3,*.wma,*.wav,
*.vox,*.aac,*.3gp,*.dat,*.avi,*.mpeg,*.wmv,*.mov,*.mp4,*.dylib,*.jar,
*.dll,*.exe,$ProgramFiles$/*,/opt/*,/sbin/*,/bin/*,/usr/bin/*,
/Library/Manufacturer/*

Note: You can configure what filters display in the Exclude Filters field by updating the
VontuManager file located here on the Enforce Server host.

The listed filters apply to both Mac and Windows endpoints. Filters display in English only.
4 Enter file names or paths in the Include Filters field and the Exclude Filters field to select
a subset of items that Symantec Data Loss Prevention should process. Delimit entries
with a comma, but no spaces. The path filter is case-sensitive.
Use * (asterisk) at the end of a path to include or exclude all content in the specified folder.
For example, if you enter C:/Users/*, /Users/* in the Include Filter field, all contents
in the C:/Users folder on Windows endpoints and the /Users/ folder on Mac endpoints
are scanned.
The include filter and exclude filter file names are relative to the file system root. Specify
full paths or subdirectories, as needed. Some wildcards are allowed.
5 Click Save.
See “Creating an Endpoint Discover scan” on page 1764.
 Using Endpoint Discover 1774
Creating an Endpoint Discover scan

See “Using include and exclude filters” on page 1770.

Using environment variables in Endpoint Discover scans

You can use environment variables to include or exclude file locations regardless of the
supported Windows OS version, user profile, or platform of the endpoint. For example, you
may want to create an Endpoint Discover target that only scans the Program Files folder on
all endpoints or the Documents folder on all user profiles on all endpoints.

Note: Environment variables are not supported on DLP Agents running on Mac endpoints.

Table 76-8 lists the environment variable types you can use.

Table 76-8 Environment variable types

Variable type Element Description

Operating system % You use this variable type to scan paths specific to the endpoint operating system.
defined variable For example, you would use %TEMP% to scan the TEMP folder on all targeted
endpoints.

Symantec Data Loss $ You use this variable to scan all user profile paths on a single endpoint. For
Prevention defined example, you would use $Documents$\* to scan the Documents folder in all
variable user profiles present on the targeted endpoints.

Variables that include or exclude user profile paths (whether Symantec Data Loss Prevention
or operating system defined) are resolved to all the user profiles present on the endpoint. For
example, if two user profiles exist on an endpoint, and you specify $Documents$\* in the
include filter, Symantec Data Loss Prevention scans C:\Users\User1\Documents\ and
C:\Users\User2\Documents.

Table 76-9 lists the Symantec Data Loss Prevention defined variables.

Table 76-9 Environment variables

Symantec Data Loss Default resolved path

Prevention defined
variable

$CommonAdminTools$ %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\ Programs\Administrative Tools

$CommonOEMLinks$ %ALLUSERSPROFILE%\OEM Links

$CommonPrograms$ %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs

$CommonStartMenu$ %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu

 Using Endpoint Discover 1775
Creating an Endpoint Discover scan

Table 76-9 Environment variables (continued)

Symantec Data Loss Default resolved path

Prevention defined
variable

$CommonStartup$ %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp

$CommonTemplates$ %ALLUSERSPROFILE%\Microsoft\Windows\Templates

$Cookies$ %APPDATA%\Microsoft\Windows\Cookies

$Desktop$ %USERPROFILE%\Desktop

$Documents$ %USERPROFILE%\Documents

$Favorites$ %USERPROFILE%\Favorites

$Fonts$ %WINDIR%\Fonts

$History$ %LOCALAPPDATA%\Microsoft\Windows\History

$InternetCache$ %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files

$LocalAppData$ %LOCALAPPDATA% (or %USERPROFILE%\AppData\Local)

$LocalizedResourcesDir$ %WINDIR%\Resources\0409

$Music$ %USERPROFILE%\Music

$NetHood$ %APPDATA%\Microsoft\Windows\Network Shortcuts

$Pictures$ %USERPROFILE%\Pictures

$PrintHood$ %APPDATA%\Microsoft\Windows\Printer Shortcuts

$ProgramData$ %ProgramData% (or %SystemDrive%\ProgramData)

$ProgramFiles$ %ProgramFiles% (or %SystemDrive%\Program Files)

$ProgramFilesCommon$ %ProgramFiles%\Common Files

$ProgramFilesCommonX64$ %ProgramFiles%\Common Files

$ProgramFilesCommonX86$ %ProgramFiles%\Common Files

$ProgramFilesX64$ %ProgramFiles% (or %SystemDrive%\Program Files)

$ProgramFilesX86$ %ProgramFiles% (or %SystemDrive%\Program Files)

$Programs$ %APPDATA%\Microsoft\Windows\Start Menu\Programs

$Public$ %PUBLIC% (or %SystemDrive%\Users\Public)

 Using Endpoint Discover 1776
Creating an Endpoint Discover scan

Table 76-9 Environment variables (continued)

Symantec Data Loss Default resolved path

Prevention defined
variable

$PublicDesktop$ %PUBLIC%\Desktop

$PublicDocuments$ %PUBLIC%\Documents

$PublicDownloads$ %PUBLIC%\Downloads

$PublicGameTasks$ %ALLUSERSPROFILE%\Microsoft\Windows\GameExplorer

$PublicMusic$ %PUBLIC%\Music

$PublicPictures$ %PUBLIC%\Pictures

$PublicVideos$ %PUBLIC%\Videos

$Recent$ %APPDATA%\Microsoft\Windows\Recent

$ResourceDir$ %WINDIR%\Resources

$RoamingAppData$ %USERPROFILE%\AppData\Roaming

$SampleMusic$ %PUBLIC%\Music\Sample Music

$SamplePictures$ %PUBLIC%\Pictures\Sample Pictures

$SamplePlaylists$ %PUBLIC%\Music\Sample Playlists

$SampleVideos$ %PUBLIC%\Videos\Sample Videos

$SendTo$ %APPDATA%\Microsoft\Windows\SendTo

$StartMenu$ %APPDATA%\Microsoft\Windows\Start Menu

$Startup$ %USERSPROFILE%\Microsoft\Windows\Start Menu\Programs\StartUp

$System$ %WINDIR%\system32

$SystemX86$ %WINDIR%\system32

$Templates$ %APPDATA%\Microsoft\Windows\Templates

$UserProfiles$ %SystemDrive%\Users

$Videos$ %USERPROFILE%\Videos

$Windows$ %WINDIR%

See “Include filter examples” on page 1777.

 Using Endpoint Discover 1777
Creating an Endpoint Discover scan

Include filter examples

The following section provides an Endpoint Discover include filter example that uses
environment variables.
See “Using environment variables in Endpoint Discover scans” on page 1774.

Table 76-10 Include filter example

Filter string Explanation

*.doc, $Documents$ The Endpoint Discover scan monitors:

■ All .doc documents on all fixed drives that are

associated with the scan.
■ All files in the \My Documents\ file path.

Configuring Endpoint Discover scan timeout settings

An Endpoint Discover scan might not complete if one or more endpoints are disconnected and
cannot report to the Endpoint Server. The Scan Idle Timeout setting can be configured to
stop the Endpoint Discover scan if no endpoints report scan status to the Enforce Server for
a specified period of time.
You can configure the Max Scan Duration to define the maximum time duration for an Endpoint
Discover scan to run. When an Endpoint Discover scan exceeds the Max Scan Duration, the
Endpoint Discover scan stops and displays timeout status.
The Endpoint Discover scan history reports the Timeout scan status. To access the scan
history, select Manage > Scan History from the Enforce Server administration console.
Configuring the Scan Idle Timeout setting
1 Locate Scan Idle Timeout from the Advanced settings tab from the Manage > Discover
Scanning > Discover Targets > New Target > Endpoint > File System screen.
2 Enter the amount of time and select Minutes or Hours.
The value you enter should exceed the polling interval value
(ServerCommunicator.CONNECT_POLLING_INTERVAL_SECONDS.int).
See “Advanced agent settings” on page 1804.

Note: To disable Scan Idle Timeout, select Indefinite for the duration of time.

3 Click Save to save the settings.

 Using Endpoint Discover 1778
Managing Endpoint Discover target scans

Configuring the Max Scan Duration setting

1 Locate Max Scan Duration from the Advanced settings tab.
2 Enter the amount of time and select Minutes, Hours, or Days.

Note: To disable Max Scan Duration, select Indefinite for the duration of time.

3 Click Save to save the settings.

Managing Endpoint Discover target scans

After you create and run an Endpoint Discover scan, you can perform a number of management
tasks. These tasks can include the following:
■ Manage Endpoint Discover in-progress scans. See “About managing Endpoint Discover
scans” on page 1778.
■ Remediate Endpoint Discover incidents. See “About remediating Endpoint Discover
incidents” on page 1781.
■ Enabling rules results caching (RRC). See “About rules results caching (RRC)” on page 1747.
■ Create endpoint reports. See “About Endpoint reports” on page 1781.

About managing Endpoint Discover scans

To manage your Endpoint Discover scan targets, you can perform the following:
■ Start, stop, and pause target scans.
■ Monitor status as target scans run.
■ Select targets to view details.
■ Edit or delete targets.
■ Manage multiple targets.
■ Sort and filter targets for easier target management.
■ Specify the number of targets to display.
■ Review scan history
See “Managing Network Discover/Cloud Storage Discover scan histories ” on page 1556.
■ Manage servers
See “Managing Network Discover/Cloud Storage Discover Servers” on page 1564.
■ Review scan status
 Using Endpoint Discover 1779
Managing Endpoint Discover target scans

■ Completed: Indicates that all DLP Agents have completed the scan successfully.
■ Timeout: Indicates that one or more DLP agents included in the scan did not report
back to the Endpoint Server with a scan status within a configured timeout period.
See “Configuring Endpoint Discover scan timeout settings” on page 1777.
■ Stopped: Indicates that the administrator has stopped the scan.
■ Running: Indicates that at least one DLP Agent has started running the scan.
■ Ready: Indicates that an Endpoint Discover Target scan is configured and is ready to
run.
■ Starting: Indicates that the scan has started, and one or more DLP Agents might have
not yet received the scan details.
■ Queued: Indicates that Endpoint Server is down and the scan continues to remain in
the Queued state until this Endpoint Server is available.

■ Information about responding to scans

See “About remediating Endpoint Discover incidents” on page 1781.
■ Information about interpreting scan results and status
See “About incident reports for Network Discover/Cloud Storage Discover” on page 1330.

About Endpoint Discover targeted endpoints scan details

You can view detailed information about each Endpoint Discover targeted endpoint, a scan
report, including general scan information and scan statistics. You can also download a scan
statistics report in CSV format.
To view scan details, go to Manage > Discover Scanning > Scan History. Select the Endpoint
Discover targeted endpoint scan, then click the link in the Status column.
See “About managing Endpoint Discover scans” on page 1778.
Table 76-11 summarizes details in the General section which lists information about the scan.

Table 76-11 General scan detail

General Scan Detail Description

Target Type The type and icon of the target that was scanned.

Target Name Name of the target.

Status Status of the scan: Completed, Timeout, Stopped, or Running.

Scan Type Scan type, such as incremental or full.

Start Time The date and time the scan began.

 Using Endpoint Discover 1780
Managing Endpoint Discover target scans

Table 76-11 General scan detail (continued)

General Scan Detail Description

End Time The date and time the scan finished.

Table 76-12 summarizes details in the Scan Statistics section, which provides detailed
information about the scan.

Table 76-12 Scan Statistics

Icon Description

Processed Number of bytes that has been scanned across the DLP Agents participating
in the scans.

Run Time Amount of time that the scan took to complete. If the scan is still running, the
(dd:hh:mm:ss) amount of time that it has been running. The total does not include any time
during which the scan was paused.

Items Scanned Number of items scanned.

Bytes Scanned Number of bytes scanned.

Items Filtered Number of items that were filtered when the Include filters and Exclude filters
fields are selected.

Bytes Filtered Number of bytes filtered when the Include filters and Exclude filters fields
are selected.

Items Unprocessed Number of items that could not be scanned due to some system error.

Current Incident Count Number of incidents that were detected during the current scan, less any
deleted incidents. You can click this number to see an incident list for this scan.

Agents Starting Scan Number of DLP Agents that have received the scan details and are starting to
run the scan.

Agents Scanning Number of DLP Agents that are running the scan.

Agents Never Number of DLP Agents that have never reported to the Endpoint Server and
Reported therefore, did not receive the scan details.

Agents Not Reporting Number of DLP Agents that are not reporting to the Endpoint Server as per
the time set in the Scan Idle Timeout field on the Advanced tab on the
Manage > Discover Scanning > Discover Targets > New Target > Endpoint
> File System screen.

See “Creating a new Endpoint Discover target” on page 1765.

Agents Completed Number of DLP Agents that have completed the scan.
 Using Endpoint Discover 1781
Managing Endpoint Discover target scans

Table 76-12 Scan Statistics (continued)

Icon Description

Agents Stopped Number of DLP Agents that have stopped the scan.

Download Full Download a report with all scan statistics in CSV format.
Statistics Report

About remediating Endpoint Discover incidents

Incidents that are created for Endpoint Discover violations display under the Discover tab of
the Incidents section. Incidents are marked with an Endpoint-specific icon. You can manually
remediate Endpoint Discover incidents using Smart Response rules, use quarantine response
rules, or create a custom response using the Endpoint FlexResponse API. See the Symantec
Data Loss Prevention Endpoint FlexResponse Plug-in Developers Guide.
See “About endpoint incident lists” on page 1316.
You can use the following features to remediate Endpoint Discover incidents:
■ Smart Response rules
See “About Automated Response rules” on page 1209.
■ Quarantine response rules
See “About Endpoint Quarantine” on page 1763.
■ Endpoint FlexResponse
See “About Endpoint FlexResponse” on page 1913.
See “About Endpoint reports” on page 1781.

About Endpoint reports

Use incident reports to track and remediate incidents on your endpoints. Symantec Data Loss
Prevention reports an incident when it detects data that matches the detection parameters of
a policy rule. Such data may include specific file content, an email sender or recipient,
attachment file properties, or many other types of information. Each piece of data that matches
detection parameters is called a match, and a single incident may include any number of
individual matches.
Reporting for Endpoint Discover is found under the Discover Reporting section. Endpoint
Discover incidents are marked to distinguish them from other types of Discover incidents.
Reporting for Endpoint Prevent is found in the Reports tab of the Enforce Server.
You can view the following reports:
■ Exec. Summary - Endpoint
 Using Endpoint Discover 1782
Managing Endpoint Discover target scans

■ Incidents - All
■ Incidents - New
■ Policy Summary
■ Status Summary
■ Highest Offenders
If an incident is created that includes user justifications, those justifications are included in the
report in the Incident snapshot section. For example, if a violation occurs that requires the user
to enter the response User error, the incident report includes the text SPECIAL: User typed
response: "User error".

If the user selects a pre-generated justification, the justification appears in the report.
Justifications appear in the detailed report under the header Justifications.
Justifications and notifications are not compatible with Endpoint Discover, therefore no
justifications appear in Endpoint Discover reports.
You can also create customized reports for Endpoint Discover and Prevent. However, if the
user is not on the network at the time the justification is entered, the justification section of the
incident snapshot remains empty.
See “About Symantec Data Loss Prevention reports” on page 1352.
See “How to implement Endpoint Prevent” on page 1751.
See “Setting up and configuring Endpoint Discover” on page 1763.
 Chapter 77
Working with agent
configurations
This chapter includes the following topics:

■ About agent configurations

■ Adding and editing agent configurations

■ Applying agent configurations to an agent group

■ Configuring the agent connection status

About agent configurations

The Agent Configuration page on the Enforce Server administration console lets you configure
agent settings.
Each configuration contains monitoring and other options for your agents. These options
determine the detection types that can be used on endpoints. You can also specify filters and
resource consumption limits. You can create as many different agent configurations as you
want. Symantec Data Loss Prevention endpoint protection must contain at least one agent
configuration. You can modify the default configuration as many times as you want.
Agent groups can only use one configuration at a time. However you can associate one agent
configuration to multiple agent groups. You can also clone agent configurations.
See “Adding and editing agent configurations” on page 1784.
See “About cloning agent configurations” on page 1784.
See “Viewing and managing agent groups” on page 1856.
See “Applying agent configurations to an agent group” on page 1848.
 Working with agent configurations 1784
Adding and editing agent configurations

About cloning agent configurations

You can clone agent configurations. Cloned configurations are identical to the configurations
from which they were cloned. Clone agent configurations when you want to keep most of the
entity details the same, but need to make small changes. Click the clone icon next to the edit
icon to clone a configuration. When you clone a configuration, you see an editable version of
that cloned configuration. You must rename the cloned configuration so that you can distinguish
between the original and the clone.
The agent configuration page contains information about all of the available agent configurations.
You can also click Add Configuration to create new agent configurations.
See “Adding and editing agent configurations” on page 1784.

Adding and editing agent configurations

You can add agent configurations by going to System > Agents > Agent Configuration and
clicking the Add Configuration button. Click an agent configuration to edit it.
The following table lists the tabs you use to create or edit agent configurations.

Table 77-1 Available agent configuration tabs

Tab Description

Channels Use this tab to select which aspects of the endpoint items you want
to monitor.

See “Channel settings” on page 1785.

Channel Filters Use this tab to create and edit monitoring filters.

See “Channel Filters settings” on page 1788.

Device Control Use this tab to control endpoint user access to devices and copies
to the print screen.

See “Device Control settings” on page 1797.

Settings Use this tab to set server communication settings, agent monitoring
resources, and the file recovery location.

See “Agent settings” on page 1798.

 Working with agent configurations 1785
Adding and editing agent configurations

Table 77-1 Available agent configuration tabs (continued)

Tab Description

Advanced Settings
You can also specify advanced settings for the agents. These settings
affect how the Symantec DLP Agents process information, detect
violations, and perform on endpoints.
Note: Contact Symantec Support before changing any of the
advanced settings.

See “Advanced agent settings” on page 1804.

Note: If you modify an existing agent configuration, clicking the Save button applies the changes
to all of the agent groups associated with the configuration. If you create a new configuration,
the configuration is saved and you can apply it on the Agent Groups screen.

You can apply specific monitor settings based on whether the Windows agent is on or off the
corporate network. See “Setting specific channels to monitor based on the endpoint location”
on page 1847.
See “About Symantec Data Loss Prevention administration” on page 65.
See “Server configuration—basic” on page 213.
See “Server controls” on page 211.
See “About agent configurations” on page 1783.
See “Applying agent configurations to an agent group” on page 1848.

Channel settings
Use the Enable Monitoring section on the Channels tab to select which aspects of the
endpoint items you want to monitor.
See “Enable Monitoring settings” on page 1785.

Note: You can set specific channels to monitor based on whether the Windows endpoint is
located on or off the corporate network by selecting Allow different channels for endpoints
residing on and off the corporate network. See “Setting specific channels to monitor based
on the endpoint location” on page 1847.

Enable Monitoring settings

Use the Enable Monitoring area of the Channels tab to select the endpoint applications and
destinations (channels) to monitor.
 Working with agent configurations 1786
Adding and editing agent configurations

Note: You can set specific monitor settings based on whether the Windows endpoint is located
on or off the corporate network by selecting Allow different monitoring for endpoints residing
on and off the corporate network. See “Setting specific channels to monitor based on the
endpoint location” on page 1847.

Field Description

Destinations Monitor the following destinations on Windows endpoints:

■ Removable Storage
■ CD/DVD
■ Local drive
■ Printer/Fax

You can monitor the Removable Storage channel on Mac

endpoints.

Clipboard Enable Clipboard monitoring for copy and paste operations to

and from monitored applications.

Select Copy to monitor and prevent the data copied to Clipboards

on Windows endpoints.

Select Paste to monitor and prevent the data pasted from

Clipboards on Windows and Mac endpoints.
Note: Some applications use paste operations that the endpoint
user does not initiate, which may cause false positive incidents.
Symantec advises that you test the application behavior before
you enable Clipboard, Paste monitoring. See “Clipboard features
supported on Mac agents” on page 1728.

You must also confirm that the application you want to monitor
has been added to the Application Monitoring screen.

See “About monitoring applications” on page 1896.

Email Select email applications to be monitored:

■ Outlook on Windows and Mac endpoints

■ Lotus Notes on Windows endpoints
 Working with agent configurations 1787
Adding and editing agent configurations

Field Description

Web Select web applications to be monitored.

You can monitor traffic on the following Web protocols:

■ IE (HTTPS) monitors HTTPS traffic for Internet Explorer on

supported Windows endpoints
■ Edge (HTTPS) monitors HTTPS traffic for Microsoft Edge on
supported Windows endpoints
■ Firefox (HTTPS) monitors HTTPS traffic for Firefox on
supported Windows and Mac endpoints
■ Chrome (HTTPS) monitors HTTPS traffic for Google Chrome
on supported Windows and Mac endpoints
Monitor Google Chrome running on Windows endpoints
running in Metro mode by enabling the Application File Access
feature.
Enable application file access by going to Application
Monitoring > Google Chrome, and confirming that Monitor
Application File Access is enabled. See “Changing
application monitoring settings” on page 1897.
■ Safari (HTTPS) monitors HTTPS traffic for Safari on
supported Mac endpoints.
■ HTTP monitors HTTP traffic for Internet Explorer, Windows
apps, Firefox, and Google Chrome on supported Windows
endpoints
■ FTP monitors FTP traffic, including traffic over Windows apps,
on supported Windows endpoints

Configured Applications Select applications to be monitored:

■ Application File Access to monitor Windows and Mac

applications configured on the Application Monitoring
screen.
See “About monitoring applications” on page 1896.
■ Cloud Storage to monitor supported Windows cloud storage
applications.
See “About cloud storage application monitoring” on page 1744.
 Working with agent configurations 1788
Adding and editing agent configurations

Field Description

Network Shares Select to monitor the files that are transferred to or from your
local drive and a network share.

Select Copy to Local Drive to monitor files moved from network

shares to Windows endpoint.

Select Copy to Share to monitor files moved from Windows and

Mac endpoints to network shares.

You can also create filters in the agent configuration that monitor
or ignore files by type, size, and path. The filters you create apply
to both Mac and Windows endpoints. See “Configuring file filters”
on page 1789.

Channel Filters settings

Use the Channel Filters tab to filter endpoint items you want to monitor.
The Channel Filters tab is divided into the following sections:
■ Filter by File Properties
See “Filter by File Properties settings” on page 1788.
■ Filter by Network Properties
See “Filter by Network Properties settings” on page 1793.
■ Ignore User Identities for Cloud Storage Applications
See “Ignore User Identities for Cloud Storage Applications settings” on page 1795.
■ Filter by Printer Properties
See “Filter by Printer Properties settings” on page 1796.

Note: You can set specific filters based on whether the Windows endpoint is located on or off
the corporate network by selecting Allow different filters for endpoints residing on and off
the corporate network. See “Setting specific channels to monitor based on the endpoint
location” on page 1847.

Filter by File Properties settings

You use the Filter by File Properties section to create and edit monitoring filters. Using this
option lets you optimize performance and reduce false positives by filtering files before detection
occurs. Based on the filters you set, the DLP Agent monitors or ignores data based on protocol,
destination, file size, file type, or file path. Existing filters are listed in this section. The filters
run in the order they appear in the list as determined by the Order column.
 Working with agent configurations 1789
Adding and editing agent configurations

Note: The DLP Agent installed on Mac endpoints does not filter using a file signature match
for all file types. Instead, the agent uses the file extension to apply file type filters. See “Mac
agent filter by file properties features” on page 1732.

When you filter to ignore files by type, the agent filters files based on the file extension or
signature. If files that you want to filter (for example DOC files) are contained in other files (for
example, ZIP files), the file you want to filter is still sent to the detection engine. The agent
does not extract the contents of container files like ZIP during the filtering process, so the
agent cannot read and, therefore, filter the file contents.
When you filter by file path, the drive letter is ignored and the specified path for every local
drive on the agent is filtered. For example, entering c:\temp causes c:\temp and d:\temp to
be filtered on an agent with two local drives.
You can add or modify filters:
■ To create a new filter, click Add Monitoring Filter.
■ To modify an existing filter, click on the filter in the list.
■ To delete an existing filter, click on that filter's red "X."
■ To change the order in which a filter is applied, click the filter number in the Order column.
Then select the execution order for that filter in the drop-down list. Changes are only applied
after you click Save at the top of the screen.
■ Choose either Monitor or Ignore to specify what to do with the files that do not match any
of the filters in the Filter by Network Properties section.
See “Configuring file filters” on page 1789.

Configuring file filters

You can configure DLP Agents to monitor specific file types, applications, protocols, or locations.
Configuring these items lets you potentially improve monitor performance. You configure the
DLP Agent by going to System > Agents > Agent Configuration. You then select an agent
configuration you want to configure then click Add Monitoring Filter.
The Configure Server - File Filter filters page is divided into the following three sections:
■ Filter Action
■ Endpoint Channel
■ File Attributes
The Filter Action section lets you select whether you want the filter to monitor the following
attributes or not. You can include files to be monitored or exclude files from the relevant protocol
or destination.
You can select one of the following choices:
 Working with agent configurations 1790
Adding and editing agent configurations

■ Monitor
■ Ignore (do not monitor)
The Endpoint Channel section lets you select the destinations, protocols, or applications that
you want to filter. You must select at least one option. Select the items that you want the
Endpoint Server to monitor.
You can select from the following items:

Destinations Removable Storage

CD/DVD

Local Drive

Protocols Email Attachment

HTTP/HTTPS Attachment

IM File transfer
Note: This setting only applies to 14.0.x and earlier
DLP Agent versions.

FTP transfer

Configured Applications Application File Access

Cloud Storage

Network Shares Copy to Local Drive

Copy to Share

The Application File Access option lets you monitor any applications that appear on the
Application Monitoring page.
See “About monitoring applications” on page 1896.
The File Attributes section is where you specify the filters that you want to apply. Information
you enter in this section applies to local drive and application file access monitoring. Select
Local Drive or Application File Access to edit the File Path on Destination field.
You can specify the following filter attributes:
■ Size
You can specify a minimum, maximum, or baseline size of the files you want to scan.
■ Type
Specify the exact file types that you want to filter. This section is pre-loaded with common
file types. If you specify any additional file types, enter each file type on a separate line.
 Working with agent configurations 1791
Adding and editing agent configurations

See “True file type filtering” on page 1792.

■ File Path on Destination
Specify the file-system path(s) to analyze. Enter one path per line. If you specify any paths
to include, Symantec Data Loss Prevention monitors only files in those paths. If you leave
this field blank, Symantec Data Loss Prevention monitors all files except the files that you
may have specified elsewhere. This filter applies to local drive monitoring, cloud storage
application monitoring, application file access, copy to share, and copy to local drives. You
can use environment variables to include or exclude file locations regardless of the user
profile or platform of the endpoint. For example, if you enter:
$PublicDownloads$
%TEMP%
C:\test\*
Symantec Data Loss Prevention scans the Downloads folder on all user profiles, the Temp
folder, and the test folder.
See “Using environment variables in Endpoint Discover scans” on page 1774.
Endpoint monitor filters always run in the order that they appear. If you want to rearrange the
run order of the filters, contact Symantec Support. Rearranging the endpoint monitor filter
order may cause agents to stop monitoring sensitive information.
See “About agent configurations” on page 1783.

Configure network share filters

The following content provides a list of acceptable network paths that you can use to filter file
copies to network shares and file copies from network shares to local drives. The filters you
use to monitor network share copies are not valid when used with other monitor channels, so
you must create them separately.
As a general guideline, path filters must begin with \\ and end with \*.
Add each filter to a new line in the field. If you separate filters using comas [,] or semi-colons
[;], the system ignores the filter.
The following characters invalidate filters:
■ Question marks [?]
■ Forward slash [/]
■ Double forward slashes [//]
■ Double backward slashes [\\]
Double backward slashes can only be used at the beginning of the path.
■ Less than [<]
■ Greater than [>]
 Working with agent configurations 1792
Adding and editing agent configurations

■ Vertical bar [|]

■ Quotes ["]

Table 77-2 Network share path details

Network Description Valid paths Invalid characters and

share paths

General For IP-based filters, paths and asterisks IP-based filter: \\10.211.*.*\path\\*
[*] can be used for wild-card matching. \\10.211.*.*\path\*
\\10.211.*.*\path/*
Add an asterisk for each octet.
Specific shared drive filter (in
//10.211.*.*/path/*
Paths that are specified in Windows UNC this case the c
format are handled automatically for Mac drive):\\10.211.*.*\c$\* \\10.211.201.*\path\
Endpoints.

RDP share Paths must begin with \\rdp, \\RDP, or \\rdp\e\* \\rdp\*
\\tsclient.
\\RDP\c\testshare\*

\\tsclient\e\sharedPath\*

WebDAV Web-based shares are accessible from \\10.211.*.*\DavWWWRoot\* \\10.211.*.*\*

browsers and file systems. For example,
SharePoint shares can be mounted to
drives. In these instances, the
DavWWWRoot portion is not visible in
Windows Explorer, but you must append
this string to paths to filter for the WebDAV
protocol.

True file type filtering

The DLP Agent for Windows can filter specific types of files to monitor based on file signature
data, also known as the true file type. File signature data, generally a short sequence of bytes
at the beginning of the file, is used to identify or verify the file type.

Note: Filtering on the DLP Agent for Mac occurs using the file extension only; true file type
filtering is not supported for the DLP Agent for Mac.

Because the DLP Agent for Windows can filter based on the true file type, the agent can
correctly identify and filter files that have file extensions that do not match the original file
extension. For example, if a user changes the .doc file name extension to .jpg, the agent
can identify the file based on its signature as a DOC file, and either monitor or ignore it based
on the agent configuration filter.
 Working with agent configurations 1793
Adding and editing agent configurations

Note: Text files (.txt) do not contain file signature data; consequently, the agent can only
monitor or ignore these types of files based on the file extension. True type filtering is not
possible for TXT files.

See “Filter by File Properties settings” on page 1788.

Table 77-3 lists the file types and corresponding extensions that the DLP Agent for Windows
can filter using true file type filtering.

Table 77-3 Supported files for true file type filtering on Windows endpoints

File type Filtered file extensions

Adobe Acrobat .pdf

Microsoft Office .doc, .dot, .pps, .ppt, .xla, .xls, .wiz, .db,
.msc, .msi, .mtw, .spo, .vsd, .wps, .pub

Office Open XML .docx, .pptx, .xlsx, .dotx, .potx

OpenOffice .odt, .ott, .ods, .odp, .otp, .ots, .odg, .otg

OpenOffice (created using Microsoft Office) .odt, .odp, .ods

ZIP and PKZIP .zip, .jar, .xpi

StarOffice .stw, .sxw, .sxc, .sxi, .sti, .stc, .std, .sxd

RAR archive .rar

Symantec Information Centric Encryption (ICE) .ice

Note: The ICE-encrypted files have the .html
extension. However, if you set the file filter as
.html, the DLP Agent monitors or ignores both the
ICE-encrypted files as well as the regular HTML
files.

To monitor or ignore only the ICE-encrypted files,

set the file filter as: .ice. The .ice extension is
the pseudo extension of the ICE-encrypted HTML
files.

Filter by Network Properties settings

You use the Filter by Network Properties section to create network-related filters that tell
the agent to monitor or ignore network traffic based on IP address, or domain. Enter the IP
addresses, HTTP domains, FTP domains, and HTTPS domains that you want to filter on in
the appropriate box.
 Working with agent configurations 1794
Adding and editing agent configurations

See “Mac agent filter by network properties features” on page 1732.

Filtering IP addresses
You can only filter using IP addresses on Windows endpoints. For filtering IP addresses, use
the following rules. Enter any IP-based filters that you want to use. If you leave this field blank,
Symantec Data Loss Prevention inspects all packets. The format of the IP protocol filters (found
in the protocol definitions and protocol filter definitions) is:

ip_protocol_filter
protocol_filter_multiple_entries
protocol_filter_entry
destination_subnet_description
source_subnet_description
subnet_description
:= protocol_filter_multiple_entries [; *]
:= protocol_filter_entry
[; protocol_filter_multiple_entries]
:= +|-, destination_subnet_description,
source_subnet_description
:= subnet_description
:= subnet_description
:= network_ip_address / bitmask
| *

Note: Separate each entry with a comma to correctly monitor or ignore specified items.

Each stream is evaluated in order against the filter entries until an entry matches the IP
parameters of the stream.
A minus sign (-) at the start of the entry indicates that the stream is dropped. A plus sign (+)
at the start of the entry indicates that the stream is kept.
A subnet network description of * means that any packet matches this entry.
A subnet bitmask size of 32 means that the entry must match the exact network address. For
example, a filter of +,10.67.0.0/16,*;-,*,* matches all streams going to network 10.67.x.x but
does not match any other traffic.

Note: The more specific you are when you define the recognition characteristics, the more
specific your results. For example, if you define only one specific IP address, only incidents
involved that IP address are captured. If you do not define any IP addresses, or if you define
a wide range of IP addresses, you achieve broader results. Include at least one plus sign (+)
clause and one minus sign (-) clause to be explicit about what is included and what is excluded.

Filtering domains
The Domain filters need to be applied separately for HTTP and HTTPS. To add filters for any
website that supports HTTP and HTTPS, add individual filters for HTTP and HTTPS in the
respective text boxes. The IP address filter works with all other network protocols.
 Working with agent configurations 1795
Adding and editing agent configurations

Note: You can use HTTP and HTTPS filters to monitor and ignore domains for browsers on
both Windows and Mac endpoints. See “Enable Monitoring settings” on page 1785.

For filtering HTTP/HTTPS domain names, use the following rules:

You can use filters to include (inspect) or exclude (ignore) messages from specific senders. You can
also use filters to include or exclude specific recipients. The specific filter syntax depends on the protocol.

The following is an example of domain filters

Domain Filter := <Domain Filter Entry> [,<Domain Filter Entry>]

Domain Filter Entry := {*|{-|+}<metadata value>}

You can use the following symbols:

■ You can use the wildcard symbol (*) in the domain entry.
For example, *symantec.com would match www.symantec.com, www.dlp.symantec .com, and all
domains that end with symantec.com.
■ A minus sign (-) at the start of the entry indicates that the URL is ignored.
■ A plus sign (+) at the start of the entry indicates that the URL is inspected.
■ If you add an asterisk (*) to the end of the filter expression, any URL domain not explicitly matching
any of the filter masks is ignored.

These filters are executed is from left to right until the first match occurs or the agent reaches the end
of the filter entries.

For example, if the filter is:

-sales.symantec.com,+*symantec.com,*

HTTP requests to sales.symantec.com are ignored, and all of the requests that are sent to any other
symantec.com domain are inspected. The last asterisk in the filter filters out all other domains like
www.xyz.com.
Note: If you leave the HTTP/HTTPS filter empty, all the URLs are inspected.

Ignore User Identities for Cloud Storage Applications settings

You use the Ignore User Identities for Cloud Storage Applications section to specify
corporate cloud accounts that are approved for sensitive file uploads.
Adding corporate cloud account information prevents users from uploading sensitive files to
personal Box accounts. The DLP Agent monitors and prevents these types of file uploads
through the Box Sync application and through the Box for Office add-in.

Note: Sensitive files are moved to the file recovery location and remain there until the endpoint
users deletes them. See “File Recovery Area Location settings” on page 1800.
 Working with agent configurations 1796
Adding and editing agent configurations

To enable this feature:

1. Confirm that the Cloud Storage channel in the agent configuration is enabled.
2. Enter cloud storage accounts to ignore from monitoring in the agent configuration. For
example, enter jane_doe@corporation.com to ignore the jane_doe user account in the
corporation.com domain. You can enter a wildcard (*) to specify a domain of cloud storage
accounts to ignore. For example, enter *@corporation.com to ignore all cloud storage
accounts with corporation.com in the domain.

Filter by Printer Properties settings

You use the Filter by Printer Properties section to specify the printers that are approved for
printing sensitive files. You can set the DLP Agent to ignore local printers, PDF printers, and
Network printers. You can use a wildcard character (*) to ignore a range of printers.
Adding approved printers prevents users from printing sensitive information to personal printers
or unapproved printers.

Note: Add multiple printers to ignore by adding them to new lines in the Filter by Printer
Properties field. Do not use comas [,] or semi-colons [;] to separate multiple printers; these
separators prevent printer filtering.

Specifying local printers to ignore

Enter the name of the local printer to ignore. For example, to only ignore a printer named HP
Color LaserJet CP4020, you enter HP Color LaserJet CP4020. To ignore XPS printed
documents, enter Microsoft XPS Document Writer.
You can ignore a range of printers by using a wildcard [*] in the print filter. For example, enter
HP Color LaserJet* to ignore all printers with the HP Color LaserJet prefix.

Note: To ignore a printer with an asterisk [*] in its name, you must enter an escape character
before the asterisk in the filter. For example, if the printer name is Printer*Name, enter
Printer\*Name.

Specifying PDF printers to ignore

You can enter the name of the particular PDF printer you want to ignore. For example, enter
Microsoft Print to PDF to ignore data printed from Microsoft Office applications. You can
ignore data sent to all printers with PDF in the name by entering *PDF*.
 Working with agent configurations 1797
Adding and editing agent configurations

Specifying network printers

To ignore network printers enter the server name and the printer name. For example, enter
\\printserver\HP Color LaserJet CP4020 to ignore the HP Color LaserJet CP4020 printer
located on the server named printserver.
You can ignore a range of network printers by using a wildcard [*] in the print filter.
The following are examples of network printer filters:
■ \\printerserver2\HP Color LaserJet CP4020* ignores all printers starting with HP Color
LaserJet CP4020 hosted on printerserver2.
■ \\printerserver*\HP Color LaserJet CP4020* ignores all printers starting with HP Color
LaserJet CP4020 hosted on all servers with the printerserver prefix.

Device Control settings

Use the Device Control tab to set the level of access Windows endpoint users have to network
shares and USB storage devices. Access can be set to blocked and read only. You can also
use the tab to block print screen copies.

Note: You can set different access configurations based on whether the Windows endpoint is
located on or off the corporate network. Select Allow different device controls for endpoints
residing on and off the corporate network. See “Setting specific channels to monitor based
on the endpoint location” on page 1847.

The Device Control tab provides you with the following controls:
■ USB Storage
You can set the agent to only block or provide read only access to USB storage devices.
Other non-USB storage devices (for example, eSATA drives, MTP devices, and virtual
hard disks [VHD]) are not controlled.
■ Network shares
You can set the agent to only block or provide read only access to network shares.
■ Block Print Screen
You can select this item prevent endpoint users from copying their screens using the Print
Screen key or when they hit the [Shift + Print Screen] key combination. Enabling Block
Print Screen applies to Window 7, 8 and 10 endpoints but not endpoints running in virtual
environments.
If you set access to a device, and an endpoint user exceeds the access limits, the agent
enforces access and a pop-up displays on the endpoint. The pop-up notifies the user that
access to the device is limited. The pop-up displays for the first instance that the endpoint user
exceeds access limits, but for subsequent violations no pop-ups display.
 Working with agent configurations 1798
Adding and editing agent configurations

Agent settings
The Settings tab is divided into the following sections:
■ Server Communication
See “Server Communication settings” on page 1798.
■ Resource Consumption on the Endpoint Host
See “Resource Consumption on the Endpoint Host settings” on page 1799.
■ Resource Consumption for Endpoint Discover Scans
See “Resource Consumption for Endpoint Discover Scans settings” on page 1799.
■ File Recovery Area Location
See “File Recovery Area Location settings” on page 1800.
■ Safe Mode
See “Safe Mode settings” on page 1802.
■ Cloud Storage
See “Cloud Storage settings” on page 1802.
■ Printer/Fax
See “Printer/Fax settings” on page 1803.
■ Information Centric Encryption
See “Information Centric Encryption settings for DLP Agents” on page 1804.

Server Communication settings

You use the Server Communication section to set the maximum amount of bandwidth (in
megabits or kilobits per second) that a DLP Agent can use to upload data to and download
data from the Endpoint Server during connection time.
See “About the DLP Agent store” on page 1800.
The default setting of the consumption throttle is 5 Mbps. To change the bandwidth throttle,
select either Mbps or Kbps and then enter a number in the box for the maximum per second.
If you leave a field empty, no throttling is applied for that direction of communication traffic.

Field Description

From Agent Throttle Maximum rate at which the DLP Agent uploads incidents, status, events
to the Endpoint Server.

To Agent Throttle Maximum rate at which the DLP Agent downloads policy and agent
configuration updates from the Endpoint Server.
 Working with agent configurations 1799
Adding and editing agent configurations

Resource Consumption on the Endpoint Host settings

You use the Resource Consumption on the Endpoint Host section to set the maximum
disk space for the Agent Store Size. The DLP Agent uses the Agent Store to temporarily store
incidents and other data on each endpoint host.
See “About the DLP Agent store” on page 1800.
You can specify a percentage of the hard drive, or a storage limit. Click the appropriate radio
button to choose either a percentage of disk space or a storage limit.

Field Description

% of Total Disk Space limit For percentage enter the amount in the corresponding box. The
default percentage is 5% of total disk space.

Absolute disk space size limit Select the radio button for this option, enter the particular size in the
field, and choose the unit of measurement from the drop-down list
(Bytes, KB, MB, or GB).

Resource Consumption for Endpoint Discover Scans settings

You use the Resource Consumption for Endpoint Discover Scans section to manage
resources when Endpoint Discover scans endpoints.

Note: The long-term average CPU usage and minimum battery life remaining features are not
currently supported for agents running on Mac endpoints.

Field Description

Long-Term Average CPU Usage Specify the maximum average percent of CPU
resources that can be used for Discover scans
over a length of time. If the Symantec DLP
Agent exceeds this maximum CPU limit,
Endpoint Discover detection terminates, but
Endpoint Protect detection continues as normal.
The default is 20%.
Note: Any changes you make to the CPU
resources threshold should take effect
immediately. If you make a change during a
scan, the change takes effect after the agent
resumes scanning.
 Working with agent configurations 1800
Adding and editing agent configurations

Field Description

Minimum Battery Life Remaining
Specify a minimum amount of the battery that
is needed to run your agents. If battery power
falls under this minimum, Endpoint Discover
detection stops, but Endpoint Protect detection
functions normally. The default is 30%.

About the DLP Agent store

When the DLP Agent is not connected to the Endpoint Server, the DLP Agent temporarily
stores incidents, two-tier detection requests, and response actions locally on the endpoint
host. The DLP Agent stores incident and detection metadata, and response action data and
metadata, in a small encrypted database that is installed with the DLP Agent. The DLP Agent
stores incident data and content for two-tier detection requests on the endpoint host file system.
This data is encrypted and the encryption key is stored in the agent database.
The Agent Store Size parameter limits the amount of data that the DLP Agent stores on the
endpoint host. The default agent store size is 5% of total disk space. Alternatively, you can
set an absolute storage limit. The Agent Store Size limit applies to all data stored on the
endpoint host, including data stored in the agent database and data stored on the host file
system
If the Agent Store Size limit is exceeded, the DLP Agent deletes data from the endpoint host
according to a set priority until the Agent Store Size limit is no longer exceeded. If the DLP
Agent must delete incidents, the order of eviction is as follows:
1) Two-tier detection request data (oldest first)
2) Endpoint Discover incidents (oldest first)
3) Endpoint Prevent incidents (oldest first)
See “Adding and editing agent configurations” on page 1784.

File Recovery Area Location settings

You use the File Recovery Area Location section to specify file recovery parameters. File
recovery location is where copies of the sensitive data that the DLP Agent blocked from transfer
are stored. These copies are kept until recovered by the user, or automatically deleted after
a period of time.

Note: Files recovered from cloud sync application incidents are not removed from the endpoint.
 Working with agent configurations 1801
Adding and editing agent configurations

Field Description

File Recovery Area Location Specify the path to the file recovery directory.
The default is %USERPROFILE%\My
Recovered Files on Windows endpoints.

The file recover path for Mac endpoints is

$HOME/My Recovered Files. This path is
fixed. See “Recovering sensitive files on Mac
endpoints” on page 1801.

Time To Expiration Specify the amount of time before files are

automatically deleted from the file recovery
folder. The default is 48 hours.

Recovering sensitive files on Mac endpoints

When a block response rule is implemented in a policy and a sensitive file is moved from a
Mac endpoint to an endpoint device, Symantec Data Loss Prevention moves the file to a local
path on the endpoint. The path is fixed so the endpoint user cannot change it, and the path
cannot be edited from the Enforce Server administration console.
The Mac file recover location is $HOME/My Recovered Files, where $HOME is the endpoint
user's home directory.
Recovered files are segregated by folder. Each folder is named according to the application
in which the file was moved. Also, a ReadMe.txt file is created in the same folder from where
the sensitive file was moved. This file states where the file originally resided. For example, if
a user attempts to use TextEdit to save a sensitive file to a removable storage device attached
to a Mac endpoint, Symantec Data Loss Prevention moves the file to the path $HOME/My
Recovered Files /TextEdit and creates a ReadMe.txt file with original file information.

Occasionally file recovery fails. This occurs if permissions to the recovery folder have been
changed or if user authentication failed. If this occurs, Symantec Data Loss Prevention moves
the sensitive file to the root directory folder /Alternate Recovered Files using a high privilege
account to ensure that files are recovered without being deleted.
Endpoint users can recover sensitive files from both locations ($HOME/My Recovered Files
and the root directory folder /Alternate Recovered Files), as well as recover deleted files.
Symantec Data Loss Prevention deletes files in a number of situations. If a user copies a
sensitive file from the endpoint to a removable device using the cut operation, the file is deleted.
To recover the file, the user must locate it in the recovery location and move it to its original
location. Also, a sensitive file located on a removable device is deleted when sensitive
information is added to it and the file is saved. In this scenario, the save operation is blocked
and the file is deleted. Endpoint users can recover the file at $HOME/My Recovered Files.
 Working with agent configurations 1802
Adding and editing agent configurations

Safe Mode settings

You use the Safe Mode section to enable or disable monitoring of Windows endpoints running
in Safe Mode. This setting is enabled by default.
When enabled, this setting tells the DLP Agent to monitor Windows endpoints that are running
in the following types of Safe Mode:
■ Safe Mode
■ Safe Mode with Networking
■ Safe Mode with Command Prompt
If the endpoint is running in Safe Mode or Safe Mode with Command Prompt, communication
between the DLP Agent and the Endpoint Server stop. This means, for example, that incidents
are not sent to the Endpoint Server and configurations are not sent to the agent. Communication
resumes when the agent is restarted in normal mode or Safe Mode with Networking.

Cloud Storage settings

You use the Cloud Storage section to enable cloud storage monitoring for files saved from
Microsoft Office to cloud and web locations. This setting is enabled by default.
See “About cloud storage application monitoring” on page 1744.
Files uploaded from Microsoft Office applications to Box using the Box for Office add-in are
also monitored when this setting is enabled.
You use IP filters to identify WebDAV shares to omit or include from monitoring. Enter filters
in the IP Filters area on the Channel Filters tab in the agent configuration.
You use domain filters to monitor or ignore files saved to WebDAV shares, SharePoint, and
Cloud Storage locations. Enter filters in the Domain Filters area on the Channel Filters tab
in the agent configuration.
See “Filter by Network Properties settings” on page 1793.

Note: Filters are not applied to cloud sync applications.

Table 77-4 lists example entries used to filter data saved from Microsoft Office applications to
cloud (domain) and web (IP) locations.
 Working with agent configurations 1803
Adding and editing agent configurations

Table 77-4 Filtering cloud and web locations

Destination Example Result

Domain -*symdlp-my.sharepoint.com* The agent ignores files saved to

SharePoint (with the
symdlp-my.sharepoint.com
domain).

+*inc-powerpoint.officeapps*,* The agent monitors files saved to

URLs with the
inc-powerpoint.officeapps domain
and ignore all other URLs.

IP -,10.211.203.251/16,*;+,*,* The agent ignores all files moved

to destinations that match the IP
address 10.211.x.x.

See “About cloud storage application monitoring” on page 1744.

Printer/Fax settings
You can set DLP Agents to monitor data that is sent by Microsoft Office applications to a
printer. If sensitive data is present in the print file, the agent can stop the print job on the page
that contains sensitive data or prevent the entire document from printing.
Select one of the following options in the Printer/Fax area.
■ Monitor only pages that are being printed/faxed
The default setting monitors printed and faxed data in page-by-page sequence. If the agent
detects sensitive data, it blocks the print job on the page where sensitive data resides, as
well as subsequent pages. For example, if an endpoint user prints a 10-page document
and sensitive data resides on page 9, then the agent allows pages 1-8 to print and prevents
page nine and 10 from printing, then the agent logs an incident.

Note: If you enable Monitor only pages that are being printed/faxed, (including if a Limit
Incident Data Retention response rule is used), the print buffer file (a plain text file) is
retained in the incident snapshot when there is a policy violation.

■ Monitor entire file

This setting blocks the entire print job (from Word, PowerPoint, and Excel) if a page contains
sensitive data. For example, if an endpoint user prints a 10-page document and sensitive
data resides on page ten, the agent prevents all ten pages from printing, then the agent
logs an incident.
 Working with agent configurations 1804
Adding and editing agent configurations

Note: If you use a Limit Incident Data Retention response rule, and enable Monitor entire
file, the original file is retained in the incident snapshot when there is a policy violation.

Information Centric Encryption settings for DLP Agents

You use the Information Centric Encryption section to enable Information Centric Encryption
monitoring for the sensitive files that are transferred to a removable storage device.
When Enable Information Centric Encryption is enabled, the DLP Agent monitors and blocks
the sensitive files that a user attempts to transfer from a local drive to a removable storage
device. When the user transfers a sensitive file, depending on the policy and response rule,
either the file copy is blocked or the user is prompted to click Encrypt on the Encrypt response
rule pop-up, and then the file gets encrypted on the removable storage device.

Note: Apply the Endpoint Prevent ICE license to use this feature.

For information about how Symantec Data Loss Prevention interacts with Symantec ICE, refer
to the Symantec Information Centric Encryption Deployment Guide at:
https://support.symantec.com/en_US/article.DOC9707.html
See “Configuring the Enforce Server to connect to the Symantec ICE Cloud” on page 204.

Advanced agent settings

The following settings affect only the DLP Agent. These settings should not be modified without
the assistance of Symantec Support. If you want to make modifications to this screen, contact
Symantec Support before making any changes.
Table 77-5 provides a list of agent settings, along with the default value and description of
each setting.

Note: If you change advanced agent settings and the agents connect to Endpoint Servers in
a load-balanced environment, you must apply the same changes to all Endpoint Servers in
the load-balanced environment.

See “Endpoint Prevent for Mac agent advanced agent settings features” on page 1733.
See “Endpoint Discover for Mac advanced agent settings support” on page 1735.
 Working with agent configurations 1805
Adding and editing agent configurations

Table 77-5 Agent advanced settings

Name of Setting Default values Description

AgentManagement.DISABLE_ENABLE_ 300 The amount of time, in

TASK_TIMEOUT_SECONDS.int seconds, the Disable or
Enable agent
troubleshooting task waits
before it sends the Agent
Requires Restart system
event.

AgentTamperProtection.ENABLE_AGENT_ 7 This setting enables tamper

TAMPER_PROTECTION.int protection on the Symantec
Data Loss Prevention
Endpoint agent.

A setting of 0 disables all

tamper protection.

A setting of 1 prevents the

agent and the watchdog files
from being deleted or
modified.

A setting of 2 prevents the

agent and the watchdog
services from being
stopped.

A setting of 3 prevents the

agent and the watchdog files
and services from being
deleted, modified or
stopped.

A setting of 4 prevents the

agent and the watchdog
services from being deleted
from the operating-system
registry.

A setting of 7 enables file,

service, and registry
protection.

AgentThreadPool.IDLE_TIME_IN_SECONDS.int 60 The maximum time a thread

can be inactive before it is
removed from the thread
pool. Threads are also
known as agent tasks.
 Working with agent configurations 1806
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

AgentThreadPool.MAX_CAPACITY.int 20 The maximum number of

threads in the thread pool.
The threads can be either
active or inactive.

AgentThreadPool.MIN_CAPACITY.int 2 The minimum number of

threads that are allowed in
the thread pool. The thread
pool must always contain
this number of threads. The
threads can be either active
or inactive.

AggregatorCommunicator.ENABLE_ENDPOINT_ 1 If enabled (1), this setting

DATAFLOW_CACHING.int prevents agent from
downloading data, like
policies and configuration
files, that have already been
downloaded. Enter 0 to
disable this setting.

ApplicationConnector.KEY_LENGTH.int 64 The length of the key, in

bytes, that is used to
obfuscate communication
between the agent and the
application hooks.

ApplicationConnector.MAX_CONNECTIONS.int 255 The maximum number of

application hooks (per type
of hook) that can
simultaneously connect to
the agent.

ApplicationConnector.TEMPORARY_DIRECTORY.str %TMP% The temporary location

where application hooks
store obfuscated content.
 Working with agent configurations 1807
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

AttributeResolver.ATTRIBUTE_REFRESH_INTERVAL_IN_DAY.int 7 The number of days the

agent waits to refresh Active
Directory attribute
information. If the agent
finds the information that is
older than the number of
days indicated, then
contacts the Active Directory
server. If value is set to 0,
the agent does not contact
AD server to retrieve
attribute information.

Clipboard.ENABLE_CLIPBOARD_KEYBOARD_AND_ 1 Enables keyboard and

MOUSE_VIEWER.int mouse monitoring for
Clipboard paste operations.

If you observe unexpected

behavior in applications,
enter 0 to disable this
setting.
Note: Disabling this setting
may result in false positive
incidents in the event that
the agent blocks an
application from accessing
Clipboard data.

ClipboardViewer.SLEEP_TIME_IN_MS.int 10 The time delay, in

milliseconds, before the
agent fetches contends from
the endpoint clipboard.

CommLayer.MAX_FRAME_SIZE_KILOBYTES.int 8 The maximum size of each

outbound frame. This is the
maximum number of
kilobytes per frame read
from the applications.

Changes to this setting

apply to all new
connections. Changes do
not affect existing
connections.
 Working with agent configurations 1808
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

CommLayer.NO_TRAFFIC_TIMEOUT_SECONDS.int 300 seconds (5 minutes) The application level

heartbeat interval. To detect
idle dead connections the
agent uses an application
level heartbeat message.
Data Loss Prevention closes
the connection for which a
heartbeat has not been
received in the specified
timeout interval. The agent
does not send heartbeats
and relies on the TCP
keepalive instead. A 0 value
indicates that the heartbeat
should be disabled. This
value is also used as an
application handshake
timeout value.

Changes to this setting

apply to existing and new
connections.

You can enter a value

between 60 and 86400
seconds.

ComponentLoaderSettings.MAX_ 60000 The maximum amount of

COMPONENT_SHUTDOWN_TIME.int time, in milliseconds, that
the agent waits for a
component to shut down.

ComponentLoaderSettings.PROCESS_PRIORITY.str NORMAL The priority level that

dictates what priority the
DLP Agent runs on the
endpoint. You can also enter
NORMAL and
ABOVE_NORMAL.
 Working with agent configurations 1809
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

CrashDump.ENABLE_CRASH_DUMP_COLLECTION.int 1 The setting that allows the

system to create a dump file
when the DLP Agent
crashes. Setting this value
to 1 enables the crash dump
file to be created. Enter 0 to
disable the file.

CrashDump.MAX_DAYS_TO_KEEP_DUMP.int 2 The maximum time, in days,

that the crash dump file is
stored.

CrashDump.MAX_NUMBER_OF_FILES_IN_DUMP_FOLDER.int 3 The maximum number of

files to keep in the crash
dump folder.

Detection.CHUNK_OVERLAP.int 45 The number of characters

each chunk borrows from
the end of the previous
chunk.

Detection.CHUNK_SIZE.int 65536 The text chunk size in bytes.

Detection.DAR_KVOOP_PRIORITY.str BELOW_NORMAL The priority of the external

kvoop process while it
extracts text for Endpoint
Discover scans.
 Working with agent configurations 1810
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

Detection.ENABLE_METADATA.str off Allows detection on file

metadata when a user
attempts to transfer or print
a file. If the setting is turned
on, you can detect metadata
for Microsoft Office and PDF
files. For Microsoft Office
files, OLE metadata is
supported, which includes
the fields Title, Subject,
Author, and Keywords. For
PDF files, only Document
Information Dictionary
metadata is supported,
which includes fields such
as Author, Title, Subject,
Creation, and Update dates.
Extensible Metadata
Platform (XMP) content is
not detected. Enabling this
option can cause false
positives.

Detection.FILE_HEADER_KB_TO_READ.int 1 The maximum amount of

bytes read for custom file
type detection.

Set this value to 37KB or

greater to enable detection
on the DLP Agent to
determine the ISO file type.

Detection.FILTER_TIMEOUT.int 420000 The time limit, in

milliseconds, for filtering
text.

Detection.LOCAL_DRIVE_KVOOP_PRIORITY.str BELOW_NORMAL The priority of the external

kvoop process while it
extracts text for local drive
events.

Detection.MARKUP_AS_TEXT.str off Stops the detection on any

text that has XML or HTML
tags associated with it.
 Working with agent configurations 1811
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

Detection.MAX_DETECTION_TIME.int 900000 The maximum amount of

time to complete endpoint
detection in milliseconds.

Detection.MAX_FILTER_FILE_SIZE.int 31457280 Maximum file size for text

filtering in bytes.

Detection.MAX_IDM_FILE_SIZE 30000000 Maximum file size for IDM

content extraction.

Detection.MAX_NUM_MATCHES.int 300 Maximum number of

matches for a given
matcher.

Detection.MAX_QUEUE_SIZE.int 10000 The maximum number of

items that simultaneously
wait for detection.

Detection.MIN_EXTRACTED_CHARS_FOR_TEXT_IDM_MATCH 30 Minimum size of the

normalized content before
the cracked content will be
indexed, otherwise an exact
match will be performed
against the raw (binary)
content. Must match the
min_normalized_size
parameter in the
Indexer.properties file.

Detection.NEWLINE_ELIMINATION.str on Sets whether newlines are

eliminated before detection.

Detection.RULESRESULTSCACHE_ENABLED.str on Rules results caching (RRC)

is a way to cache the results
of content on a DLP Agent
that does not violate a
policy.

See “About rules results

caching (RRC)” on page 1747.

By default, RRC is set to on.

If you do not want to use
RRC, set this parameter to
off.
 Working with agent configurations 1812
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

Detection.RULESRESULTSCACHE_FAST_CACHE_SIZE.int 2048 The size of the rules results

caching first-level database,
the Level 1 database. Rules
results caching sends new
entries of recorded,
non-violating files to the
Level 1 database. After the
Level 1 database is full,
entries are flushed to the
Level 2 database to
maintain the space of the
Level 1 database.

Detection.SHORT_DAR_DETECTION_TIME.int 2000 The amount of time, in

milliseconds, taken to detect
on a file before the file is
considered too large.

Detection.TRACKED.CHANGES.str off Allows the detection of

content that has changed
over time (Track Changes
content) in Microsoft Office
documents. Using this
option might reduce the
accuracy rate for IDM and
data identifiers.

Detection.TWO_TIER_IDM_ENABLED.str See description Enables two-tier detection

for IDM for the DLP Agent.
Set to "off" to use IDM on
the endpoint. Set to "on" to
use two-tier detection.

For new installations the

default is set to "off" so that
by default the DLP Agent
uses IDM on the endpoint.

For upgrades the default is

set to "off" so that there is
no change in functionality
for existing IDM policies
deployed to the endpoint.
 Working with agent configurations 1813
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

Detection.UNICODE_NORMALIZATION.str on Transforms the specific

characters to UNICODE
before detection. This
transformation is necessary
for matching policies
containing data in many
Asian languages.

DeviceControl.SHOW_NOTIFICATION.int 1 This setting displays

pop-ups when an endpoint
user exceeds device access
limits. Enter 0 to disable
pop-ups.

Discover.CRAWLER_THREAD_PRIORITY.str BELOW_NORMAL The priority of the Discover

threads while drives are
scanned.

Discover.SCAN_ONLY_WHEN_IDLE.int 2 Sets whether the agent

performs an Endpoint
Discover scan while the
endpoint user is idle.

If set to 1, the agent only

performs Endpoint Discover
scanning while the endpoint
user is idle.

If set to 2, the agent only

scans small files while the
endpoint is active and larger
files while the endpoint user
is idle. Files taking longer
than the
Detection.SHORT_DAR_
DETECTION_TIME value
are considered large.

If set to 0, the scan runs

regardless of user activity.
 Working with agent configurations 1814
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

Discover.SECONDS_UNTIL_IDLE.int 120 If the agent does not detect

any user activity in this
amount of time, in seconds,
the user is considered to be
idle. Very small amounts of
time, less than 60 seconds,
may not be precisely
adhered to.

Discover.STANDARD_REPORT_INTERVAL.int 900000 The interval of time between

two Endpoint Discover scan
status reports, in
milliseconds.

To create a transient
connection between the
agent and Endpoint Server,
enter an interval greater
than the
EndpointCommunications.
IDLE_TIMEOUT_IN_SECONDS.int
value.

EncryptionDriver.FORCE_UNLOAD_TIMEOUT.int 10 The time interval in seconds

that the DLP Agent waits to
shut down the Encryption
driver after timeout.

EncryptionDriver.LISTENER_THREADS_COUNT.int 1 This is a performance tuning

setting. If many encrypted
files are accessed and many
files are encrypted, then
increasing the listener
thread count improves the
responsiveness of the file
encryption and access.
Generally, for single user
endpoints, one listener
thread provides good
performance. Multi-user
endpoints may need more
listener threads.
 Working with agent configurations 1815
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

EncryptionDriver.MESSAGE_HANDLER_THREADS_COUNT.int 10 This is a performance tuning

setting. This setting controls
the maximum number of the
threads that handle
responsiveness when the
files get encrypted or when
the encrypted files are
accessed.
 Working with agent configurations 1816
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

EndpointCommunications.HEARTBEAT_INTERVAL_IN_ 270
SECONDS.int
 Working with agent configurations 1817
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

Time interval in seconds

between heartbeat
messages.

The Endpoint Server sends

heartbeat messages to
detect dead connections to
individual agents when no
other traffic is being sent or
received. The Endpoint
Server measures the time
between when the last data
traffic was sent to or
received by the agent until
the current time.

Data traffic is defined as any

bytes sent or received by
the Endpoint Server,
including heartbeat
message bytes. When the
specified duration is
exceeded, the Endpoint
Server sends a heartbeat
message to the agent. If the
value of the setting in the
agent configuration
changes, the new value is
applied immediately to any
connections that are open
to agents for which the
configuration applies, and to
any subsequent
connections.
Note: Application-defined
heartbeat messages are
treated by network
appliances as actual traffic
and, unlike TCP keepalives,
are never ignored.
Heartbeat messages do not
count as normal messages
for the purpose of
 Working with agent configurations 1818
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

determining whether the

connection is idle. Sending
or receiving a heartbeat
message does not reset the
idle timer.

Enter a value between 0 and

1000000000. Enter 0 to
disable the agent heartbeat.

EndpointCommunications.IDLE_TIMEOUT_IN_SECONDS.int 30 The maximum time to keep

an idle connection open.

The connection is closed

when the specified number
of seconds has passed.

This timeout only applies

during the normal operation
phase of a connection. This
occurs after the SSL
handshake and application
handshake phases.

Enter a value between 0 and

1000000000. Enter 0 to
prevent idle connections
from closing.
 Working with agent configurations 1819
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

EndpointLocation.MATCHES_ALL_INTERFACES_FOR_MANUAL 1 The value, based on the

_SETTING.int network interface, that
defines whether the
endpoint is considered on or
off the corporate network.
This setting applies when
the Manually setting on the
Endpoint Location is
selected.

When the value is 1, the

Enforce Server considers
the agent on the corporate
network if the endpoint IP
matches all of the IP
addresses entered in the IP
field on Endpoint Location
screen.

When the value is 0, the

Enforce Server considers
the agent on the corporate
network if the Endpoint IP
matches at least one of the
IP addresses entered in the
IP field on Endpoint
Location screen.

FileService.MAX_CACHE_SIZE.int 250 The maximum number of

recently opened file paths
that have been recorded for
each endpoint process.
 Working with agent configurations 1820
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

FileSystem.APPS_LIST_USES_TRUNCATE_FILE_FOR_ ■ TextEdit This setting helps to prevent

BLOCK_RULE ■ Microsoft PowerPoint duplicate incidents and
minimizes application
TextEdit
pop-ups, crashes, and
hangs when an endpoint
user edits a sensitive file
located on a Mac removable
storage device using
TextEdit and Microsoft
PowerPoint. When this
setting is enabled,
temporary files that contain
sensitive information are
truncated instead of deleted.
This setting removes
content from temporary files.

If you observe unexpected

behavior in applications, you
can also ignore the
application from being
monitored. See “Ignoring
macOS applications”
on page 1909.

FileSystem.DRIVER_FILE_OPEN_REQUEST_TIMEOUT.int 10 Lets you configure the

timeout value, in seconds,
for a file open request that
is sent from a driver to the
agent. This setting is helpful
in case the file system
connector is slow in
responding to the driver. If
the connection is slow, the
system performs badly.
Each file open request is
postponed by the driver
waiting for the agent to
respond. You cannot leave
this setting blank and a
value of 0 is not allowed.
 Working with agent configurations 1821
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

FileSystem.ENABLE_FILE_RESTORATION.int 1 This setting provides the

ability to turn on or turn off
file restoration. File
restoration is the ability to
restore the original file in
case it is overwritten with a
newer file containing
confidential data. File
restoration is enabled by
default. Enter 0 to disable
this setting.
 Working with agent configurations 1822
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

FileSystem.ENABLE_VEP_FILE_ELIMINATION.int 3
 Working with agent configurations 1823
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

This setting provides the

ability to select for which
detection channel a .vep is
created. This process also
runs detection on the
original file and resolves any
sharing violations for
EDPA.exe and KVOOP.exe,
when needed.
Note: You can make
changes to this setting if
your environment does not
contain any of the following:

■ Data retention policies

■ Two-tier detection
policies
You can use the following
values:

■ 0 creates a .vep file for

all channels.
■ 1 runs detection on the
original file. A .vep file
is created for scanned
files that are moved to
removable drives.
■ 2 runs detection on files
moving through the
application file access
and cloud storage
channels, and through
CD/DVD applications. A
.vep file is created for
all other scanned files.
■ 3 runs detection on files
moving through the
application file access,
cloud storage, and
removable storage
channels. A .vep file is
created for all other
 Working with agent configurations 1824
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

scanned files.
■ 5 runs detection on files
moving removable
storage channels. A
.vep file is created for
all other scanned files.
■ 6 runs detection on files
moving through
application file access
and cloud storage
channels. A .vep file is
created for all other
scanned files.
■ 7 runs detection on files
moving through
removable storage,
application file access,
and cloud storage
channels. A .vep file is
created for all other
scanned files.
 Working with agent configurations 1825
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

FileSystem.IGNORE_STORAGE_BUS_TYPE.str None This setting controls which

storage devices Symantec
Data Loss Prevention
ignores. You typically adjust
this setting when you want
to allow the copying of
sensitive information to
company-provided external
devices like USB drives and
SD cards.

Enter All to ignore

removable devices attached
to Windows endpoints. USB
and FireWire devices are
monitored.

Enter None to monitor all

storage devices, whether
attached to Windows or Mac
endpoints.

You can set Symantec Data

Loss Prevention to ignore
storage devices attached to
Mac endpoints by entering
the BUS type of the device
you want to ignore. You can
generate the BUS type for a
device using the DeviceID
tool. See “About the Device
ID utilities” on page 1930.

You can enter the following

Mac removable device BUS
types:

■ USB
■ Secure Digital
■ FireWire

Note: If you enter more

than one storage device to
ignore, use a semi-colon (;)
to separate each setting.
 Working with agent configurations 1826
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

FileSystem.MAX_BACKLOG 20 The maximum number of

snapshot files that are
created when removable
storage is monitored.

FileSystem.MONITOR_ APPLICATION_CHILD_ 1 This setting allows the user

PROCESS_FILE_ACCESS.INT to enable or disable the
Application File Access
feature that monitors child
processes. Enter 1 to enable
or enter 0 to disable.

FileSystem.MONITOR_READ_ONLY_VOLUMES.int 1 Controls whether DLP

monitoring is done in the
case of an Explorer copy if
the destination volume is a
read-only volume. Enter 1
to continue monitoring
read-only volumes in an
Explorer copy operation.
Enter 0 to stop monitoring
of read-only volumes in an
Explorer copy operation.

FileSystem.NUM_OF_LISTENER_THREADS 1 The number of listener

threads that listen to file
system driver requests. You
can enter any positive
integer value.

FileSystem.NUM_TIMES_TO_OVERWRITE_FILE.int 2 This setting indicates how

many times a file is
overwritten with a secure
pattern before it is deleted
during prevention. A value
of 0 indicates that the file
cannot be overwritten.

FileSystem.THREAD_POOL_MAX_CAPACITY 20 The maximum number of

threads that the filesystem
threadpool can use to serve
file system requests.
 Working with agent configurations 1827
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

FileSystem.USE_CDDVD_DEFAULT_EXCLUDE_PATHS.int 1 This setting allows user to

exclude any file that is
opened by a CD/DVD
application from the
following directories:

■ Installed directory of the

application; for example,
if the application is
Roxio, then
c:\program
files\roxio
■ System directories; for
example,
%windir%\system32
■ Program
Files\Common Files

It is enabled by default.

FlexResponse.MAX_INCIDENT_FILE_SIZE.int 31457280 Reserved for future use.

FlexResponse.PLUGIN_HOST_LOG_MAXFILE_SIZE.long 5120000 The maximum size of a

plug-in log file. The default
number is in bytes.

FlexResponse.PLUGIN_HOST_LOG_MAX_NUMBER_OF_FILES.long 1 The maximum number of

plug-in log files that can be
kept.

FlexResponse.PLUGIN_HOST_MESSAGE_TIMEOUT.long 180000 The amount of time that the

plug-in host can process
messages. The default time
is in milliseconds.

FlexResponse.PLUGIN_HOST_STARTUP_TIMEOUT.long 30000 The amount of time that the

plug-in host can take to start
up. The default time is in
milliseconds. If the plug-in
host does not start in the
specified amount of time,
the plug-in host sends a fail
event to the log.
 Working with agent configurations 1828
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

FlexResponse.PLUGIN_QUEUE_LIMIT 100 The number of

FlexResponse plugin
invocation requests placed
in queue.

GroupResolution.DAYS_DATA_STALING.int 7 The amount of time, in days,

that the agent retains Active
Directory (AD) user group
information. Information that
is older than this limit
causes the agent to contact
the AD server.

Hooking.APPLICATION_LOAD_TIMEOUT.int 300000 Specifies the time, in

milliseconds, that the agent
tries to hook into an
application if that application
takes a long time to load.

Hooking.CLOUD_STORAGE_HOOKING.int 0 Enter 1 to allow the DLP

Agent to block files being
moved to cloud storage
applications.

This setting applies to

Microsoft Office 2010 and
2013 applications that save
data to the Box cloud
storage application.

This setting only applies to

14.0.x agents.

Hooking.EXPLORER_APPLICATION_HOOKING.int 1 Allows the DLP Agent to

monitor when a user
performs a right-click print
through Windows Explorer.
To turn off right-click print
monitoring, change this
setting to 0.

Hooking.EXPLORER_HOOKING.int 7 Allows the DLP Agent to

monitor Microsoft Windows
Explorer traffic.
 Working with agent configurations 1829
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

Hooking.SIP_Agent_OSX_VERSION_COMPATABILITY.str For a new installation: Allows the DLP Agent to

monitor applications that are
14.5.0:10.11.6; protected by System
14.6.0:10.11.6; Integrity Protection (SIP).
15.0.0:10.11.6; For the latest supported
15.0.0:10.12.5 macOS versions and
information on adding
For upgraded systems,
monitoring for updated
previous entries are
macOS, see
appended to the default
symantec.com/docs/TECH235226
settings.
at the Symantec Support
Center.

Hooking.USE_LOADLIBRARYW_FROM_IMAGE.int 0 The method to find the

LoadLibraryW function
address. You can specify a
value of either 0 or 1.

0 uses the GetProcAddress

API to find the library.

1 reads the exports table of

kernel32.dll to find the
library.

IncidentHandler.CACHE_SIZE_THRESHOLD.int 30 The percentage of used

endpoint database cache
space that triggers Endpoint
Discover to pause.

IncidentHandler.MAX_BACKOFF.int 3600000 Maximum time, in

milliseconds, to wait before
it retries to send an incident
to the server if the first
attempt fails.

IncidentHandler.MAX_INCIDENT_FILE_SIZE 31457280 Size, in bytes, of the largest

file to be sent from the agent
as part of an incident.

IncidentHandler.MAX_TTD_FILE_SIZE 31457280 Size, in bytes, of the largest

file to be sent from agent for
two-tier detection.
 Working with agent configurations 1830
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

IncidentHandler.MIN_BACKOFF.int 30000 Minimum time, in

milliseconds, to wait before
the agent re-sends an
incident to the Endpoint
Server after the first attempt
fails.

IncidentHandler.PERSISTER_MAX_DAR_ENTRIES.int 5 The maximum number of

persisted Endpoint Discover
incidents that are kept in
queue.

IncidentHandler.PERSISTER_MAX_ENTRIES.int 25 The maximum limit of

incidents in the Agent Store
before the agent starts
evicting incidents.

IncidentHandler.SENDER_CHUNK_SIZE.int 65536 Size, in bytes, of chunks to

read from the database as
it sends files.

LocalizationManager.LOCALE_RECEIVING_DELAY_ON_ 2 The number of seconds the

NEWUSER_LOGON_IN_SECONDS.int agent waits before fetching
the user locale. You can
enter between 1 and 20
seconds.

Logging.OperationLogFileSize.long 5120000 The size of the operational

log file. This setting specifies
how large, in bytes, each
operational log can be. Logs
that exceed this setting are
not retained.
 Working with agent configurations 1831
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

Logging.OperationLogMaxFiles.int 30 The maximum number of

operation logs, per scan,
that are retained at any one
time. If this number is
exceeded, operational log
files are purged from the
folder until the limit is
reached. Log files are
purged according to the date
that they were created. The
oldest log files are purged
first. This setting is not
applicable to the entire
directory.

Logging.OperationLogTTL.int 90 The number of days that

operational logs are kept in
the directory. If the
operational log is not
accessed or modified in the
specified number of days,
the file is deleted.

MonitorSystemUsers.CLIPBOARD.int 0 Enables system user

monitoring for Clipboard
feature. Set to inactive by
default. Set to 1 to enable.

MonitorSystemUsers.LOCAL_DRIVE.int 0 Enables system user

monitoring for the local drive
feature. Set to inactive by
default. Set to 1 to enable.

MonitorSystemUsers.NETWORK.int 0 Enables system user

monitoring for network
protocols in the driver
(HTTP, FTP). Set to inactive
by default. Set to 1 to
enable.
 Working with agent configurations 1832
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

MonitorSystemUsers.PRINT_FAX.int 0 Enables system user

monitoring for print/fax
feature. By default, this
feature is set to inactive. Set
to 1 to enable.
 Working with agent configurations 1833
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

NetworkMonitor.APPLY_TYPE_PREFILTERS_TO_FPR.int 0
 Working with agent configurations 1834
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

Enables ignoring of File

Path Resolution (FPR). The
DLP Agent uses FPR to
define the path to files a
user uploads from the
endpoint—whether from an
application or from the
endpoint
filesystem—through a
browser, and when the
browser opens a file in the
background. The detection
engine uses the full path
when scanning each file for
sensitive data.

Set to 1 if the browser

performance is degraded.
This setting prevents the
agent from defining a full
path for each file that is
moved through a browser.
Also, the agent does not
monitor temporary file
locations that the browser
uses and predefined file
paths.

To ensure that browser

performance is optimized,
add a monitoring filter that
ignores temporary files that
browsers commonly use.
Use the following settings
for the ignore filter:

■ Select Ignore (do not

monitor).
■ Select HTTP/HTTPS
Attachment.
■ Enter file types to ignore
in the Type field. For
example, enter INI and
TMP to filter the
 Working with agent configurations 1835
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

temporary files that

browsers commonly use
during file upload.

See “Configuring file filters”

on page 1789.

NetworkMonitor.DISABLE_SPDY_PROTOCOL 1 The default setting (1)

enables SPDY and HTTP2
protocol monitoring for
Internet Explorer and Firefox
running on endpoints.

Set to 0 to disable. Disabling

this setting allows endpoint
users to enable the SPDY
and HTTP2 protocols. When
endpoint users enable
SPDY, monitoring for data
loss can be affected.

NetworkMonitor.ENABLE_HTTP_GET_MONITORING.int 0 Enables HTTP/HTTPS GET

request monitoring. By
default, this setting is
disabled. Set to 1 to enable.

NetworkMonitor.HTTP_DETECTION_TIMEOUT.int 120 The length of time, in

seconds, that the agent
waits during a scan of HTTP
and HTTPS data.

NetworkMonitor.IM_DETECTION_SESSION_TIMEOUT.int 120 The duration, in seconds, of

the detection session
window for all instant
messaging clients.

NetworkMonitor.MIN_BYTE_COUNT_TO_IDENTIFY_PROTOCOL.int 200 The number of bytes in

packet that the agent
ignores in a given network
session before detection
begins.

NetworkMonitor.THREAD_POOL_MAX_CAPACITY 20 The number of listener

threads running that listen
for network driver requests.
 Working with agent configurations 1836
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

NetworkMonitor.NUM_OF_LISTENER_THREADS.int 60000 The maximum number of

threads that can be used by
the network thread pool to
serve network detection
requests.

PluginInstaller.TAMPERPROOFING_ 15000 Lets you specify a time, in

IGNORE_PROCESS_TIMEOUT.int milliseconds, to ignore any
short-lived processes that
do not load plug-ins. If the
process ends before this
time limit is reached, the
plug-in installer does not
start.

PostProcessor.ENABLE_FLEXRESPONSE.int 0 Lets you enable or disable

Endpoint FlexResponse
capability. By default,
Endpoint FlexResponse is
turned off. Change the
setting to 1 to enable
Endpoint FlexResponse.

PostProcessor.ENCRYPT_WITH_CANCEL_DEFAULT_ACTION.int 1 The default setting 1 blocks

the file move if the endpoint
user does not select an
action in the Encrypt
pop-up within the specified
period of time. Enter 2 to
allow the action.

PostProcessor.FILE_SYSTEM_USER_RESPONSE_TIMEOUT.int 60 The amount of time, in

seconds, that endpoint
users have to select a
response action to the User
Cancel pop-up notification.
This setting only applies to
events that are generated
by attempting to transfer
files that violate a policy.
 Working with agent configurations 1837
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

PostProcessor.NETWORK_USER_RESPONSE_TIMEOUT.int 60 The amount of time, in

seconds, that endpoint
users have to select a
response action to the User
Cancel pop-up notification.
This setting applies to HTTP
and FTP events only.

PostProcessor.NOTIFY_ON_FIXED_DRIVE.int 0 Enables the response

notifications for fixed-drive
incidents. The default is set
to disable notifications. Set
to 1 to enable.

PostProcessor.NOTIFY_WITH_CANCEL_DEFAULT_ACTION 1 The default action to take if

an endpoint user does not
select the action from the
User Cancel pop-up
notification within the
specified time. Enter 1 to
block the action or enter 0
to allow the action.

PostProcessor.OTHER_USER_RESPONSE_TIMEOUT 60 The amount of time, in

seconds, that endpoint
users have to select a
response action to the User
Cancel pop-up notification.
This setting only applies to
Clipboard, Print, Email, and
HTTPS events.

Quarantine.MAX_QUEUE_SIZE.int 100 The maximum number of

quarantine requests that can
be in the queue at any one
time. Requests that exceed
this number are dropped
and are not quarantined.
 Working with agent configurations 1838
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

ResponseCache.AFAC_TIMEOUT 10000 The amount of time, in

milliseconds, that an
application file access
incident is cached. Duplicate
incidents that occur during
this time period are not
generated and do not trigger
response rule messages.

ResponseCache.CD_TIMEOUT.int 2000 The amount of time, in

milliseconds, that a CD/DVD
incident is cached. Duplicate
incidents within this time
period are not generated or
cause Prevent pop-up
notifications.

ResponseCache.FTP_TIMEOUT.int 60000 The amount of time, in

milliseconds, that an FTP
incident is cached. Duplicate
incidents within this time
period are not generated or
cause Prevent pop-up
notifications.
 Working with agent configurations 1839
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

ResponseCache.HTTP_TIMEOUT.int 60000 The amount of time, in

milliseconds, that an
HTTP/HTTPS incident is
cached. Duplicate incidents
within this time period are
not generated or cause
Prevent pop-up notifications.

You adjust this setting if

multiple incidents and Block
pop-ups occur. This occurs
when a Block response rule
is implemented, any of the
HTTPS channels are
enabled, and users upload
folders that contain sensitive
data from a web browser to
web applications.

Set this value to 120000

milliseconds or greater to
prevent multiple incidents
and Block pop-ups.

ResponseCache.MAX_SIZE.int 100 The maximum number of

incidents that are cached at
any time.

ServerCommunicator.CONNECT_ 2 The factor by which each

BACKOFF_DURATION_MULTIPLIER.int the last backoff period is
multiplied.
 Working with agent configurations 1840
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

ServerCommunicator.CONNECT_ 900 The amount of time, in

POLLING_INTERVAL_SECONDS.int seconds, that the agent
waits before it initiates
connections.

The minimum value you

enter depends on the
minimum time difference
between when the Enforce
Server and Endpoint Server
communicate. Entering 10
is the minimum value you
can enter to maintain a
persistent connection. You
can enter a value between
60 and 86400 seconds to
maintain a non-persistent
connection.

ServerCommunicator.INITIAL_ 30 The duration of time, in

CONNECT_BACKOFF_DURATION_SECONDS.int seconds, that the agent
should back off after the first
back off error.

Enter a value less than the

ServerCommunicator.MAX_
CONNECT_BACKOFF
_DURATION_SECONDS.int
value.

ServerCommunicator.MAX_ 1800 The maximum duration of

CONNECT_BACKOFF_DURATION_SECONDS.int time, in seconds, that an
agent should spend in back
off before it fails over to the
next server.

You can enter a value

between 60 and 86400
seconds.
 Working with agent configurations 1841
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

ServerRedundancy.FAILOVER_INTERVAL.long 3600 Interval of time, in seconds,

an agent spends trying to
connect to an Endpoint
Server before it tries to
failover to a new Endpoint
Server.

ServerRedundancy.MAX_TIME_ 600 The maximum amount of

BETWEEN_CONNECTION_ATTEMPTS.long time, in seconds, the agent
waits between connection
retries to the same Endpoint
Server.

Transport.ALLOW_EXPIRED_CERTIFICATES.int 1 Controls whether or not

expired certificates are
accepted.

This setting applied to all

new agent connections.

Transport.AUTO_FLUSH_LIMIT_KILOBYTES.int 16 The maximum amount of

outbound data, in kilobytes,
to enqueue for a connection
before auto-flushing.

Enter a value less than the

Transport.MAX_OUTBOUND_
KILOBYTES_TO_BUFFER.int
value.

Transport.DNS_HOST_CACHE_TIMEOUT_SECONDS.int 86,400 The timeout in seconds for

DNS host cache. Name
resolves are kept in memory
for this number of seconds.
Set to zero to completely
disable caching, or set to -1
to save all cached entries.

This setting applies to all

new agent connections.

You can enter a value

between -1 and 604800
seconds.
 Working with agent configurations 1842
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

Transport.MAX_CONNECT_WAIT_SECONDS.int 30 The time in seconds to wait

for the connect call to
succeed.

This setting applies to all

new agent connections.

You can enter a value

between 1 and 300
seconds.

Transport.MAX_INBOUND_KILOBYTES_TO_BUFFER.int 100 The maximum of inbound

data, in kilobytes, to
enqueue for a connection.

You can enter a value

between 16 and 2048.

Transport.MAX_OUTBOUND_KILOBYTES_TO_BUFFER.int 100 The maximum amount of

outbound data, in kilobytes,
to queue for a connection.

You can enter a value

between 16 and 2048.

Enter a value greater than

the
CommLayer.MAX_FRAME
_SIZE_KILOBYTES.int
value.

Transport.MAX_SSL_SESSION_LIFETIME_SECONDS.int 86,400 The time duration in

seconds for which agent
re-uses an SSL session ID.
When the duration equal to
the configured value
elapses, the SSL session ID
is discarded by the agent
and a new SSL session is
established on the
subsequent connection with
the Endpoint Server.

This setting applies to new

agent connections.

Enter 0 to disable SSL

re-use.
 Working with agent configurations 1843
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

Transport.VERIFY_SERVER_HOSTNAME.int 0 Controls whether the

Endpoint Server certificate
(server
distinguished/common
name) is checked on the
client during the SSL
handshake process.

This setting applies to new

connections.

Enter 1 to enable the

setting.

UI.BUTTON_ENCRYPT_ALLOW.str Blank Controls the text on the

Encrypt button for the
Encrypt response rule
pop-up notification. Change
this setting if you use a
locale that is not supported.
The default language is
English.

UI.BUTTON_OK.str OK Controls the text on the OK

button on the user-facing
notification message.
Change this setting if you
use a locale that is not
supported. The default
language is English.

UI.BUTTON_OKTOALL.str OK To All Controls the text on the OK

To All button on the
user-facing notification
message. Change this
setting if you use a locale
that is not supported. The
default language is English.

UI.CONSECUTIVE_TRANSACTION_TIME.str 10 Maximum time, in seconds,

between two file operations
to be considered as a single
transaction.
 Working with agent configurations 1844
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

UI.ENCRYPT_CANCEL_MSG_TITLE.str Blank Enter text to customize the

Encrypt response rule
message title.

UI.ENCRYPT_CANCEL_TITLEBAR.str Blank Enter text to customize the

Encrypt response rule
dialog title.

UI.MONITOR_MSG_TITLE.str The message title for a

notification pop-up
message.

UI.MONITOR_TITLEBAR.str Warning Controls the static title

message in the title bar for
the Endpoint Notify
notification pop-up
message. Change this
setting if you use a locale
that is not supported. The
default setting is Warning.

UI.NOTIFY_CANCEL_MSG_TITLE Blank Enter text here to customize

the User Cancel response
rule message title.

UI.NOTIFY_CANCEL_TITLEBAR Blank Enter text here to customize

the User Cancel response
rule dialog title.

UI.NO_SCAN.int 0 If any number other than

zero, the scan dialog does
not display.

UI.NWC_EVENT_LIMIT_FS.int 5 The maximum number of

events that can be queued
before a default action for
further incidents is accepted.
This setting applies to File
System events only.
 Working with agent configurations 1845
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

UI.NWC_EVENT_LIMIT_NW.int 2 The maximum number of

events that can be queued
before a default action for
further incidents is accepted.
This setting applies to
Network events only.

UI.POPUP_QUEUE_LIMIT.int 100 The limit of pop-up

notifications that a user sees
in a single session. These
pop-up notifications require
a user justification for the
validation. If the limit is
exceeded, any pop-up
notifications past the limit
automatically contain a Not
Applicable (N/A) justification.

UI.PREVENT_MSG_TITLE.str Message title for a block

pop-up message.

UI.PREVENT_TIMEOUT.int 300 Timeout value, in seconds,

before the incident is
generated. If this limit is
exceeded, the incident is
created regardless of what
the user chooses from the
pop-up window.

UI.PREVENT_TITLEBAR.str Blocked Controls the static title

message in the title bar for
the Endpoint block
notification pop-up dialog
box.

UI.PREVENT_WINPOSITION.int 0 Start position of the Prevent

dialog window.

UI.QUARANTINE_PROMPT.str The file is quarantined at: Controls the text that

specifies where the
quarantined data is located.
 Working with agent configurations 1846
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

UI.SCAN_BAR.str (blank) This setting lets you change

the text in the body of the
scan window. This text is
static and appears
regardless of the locale of
the endpoint.

UI.SCAN_DELAY.int 0 The amount of time, in

seconds, that occurs before
the scan dialog window is
displayed.

UI.SCAN_EMAIL.int 0 This setting activates the

toggle for email scanning. If
this setting is set to 0, users
cannot select email
monitoring.

UI.SCAN_FTP.int 0 This setting activates the

toggle for FTP scanning. If
this setting is set to 0, users
cannot select FTP
monitoring.

UI.SCAN_HTTP.int 0 This setting activates the

toggle for HTTP monitoring.
If this setting is set to 0,
users cannot select HTTP
monitoring.

UI.SCAN_PRINTFAX.int 0 This setting activates the

toggle for Print/Fax
scanning. If this setting is
set to 0, users cannot select
Print/Fax monitoring.

UI.SCAN_REMOVABLEMEDIA.int 1 This setting activates the

toggle for removable media
scanning. If this setting is
set to 0, users do not have
the option of selecting
removable media
monitoring.
 Working with agent configurations 1847
Adding and editing agent configurations

Table 77-5 Agent advanced settings (continued)

Name of Setting Default values Description

UI.SCAN_SHOWTIME.int 2 Minimum time, in seconds,

for the scan dialog to remain
on the screen.

UI.SCAN_TITLE.str (blank) This setting lets you enter

the title of the scan window
that appears for the user.
This title is a static message
that appears regardless of
the locale of the endpoint.

UI.USERINPUT_PROMPT.str Others: Controls the prompt that

appears in the block and
notify pop-up messages at
the user input field. Change
this prompt if you use a
locale that is not supported.
The default setting is in
English.

UninstallPassword.RETRY_LIMIT.int 3 Defines the number of times

a user can attempt to
uninstall the DLP Agent
without entering the correct
uninstall password.

Setting specific channels to monitor based on the endpoint location

You can set specific monitor settings based on where the endpoint is located, whether on or
off the corporate network. For example, you can set DLP Agents to monitor copies to network
shares only when the endpoint is off the corporate network where there is a significant possibility
for data loss.
This feature applies to version 15.0 agents (and later). Version 14.6.x and older agents apply
On Corporate Network configuration settings.

Note: DLP Agents running on Mac endpoints support this feature when the Endpoint Location
is set to Automatic. If Manual is used for the Endpoint Location, all Mac agents are identified
as Off the Corporate Network.

See “Setting the endpoint location” on page 1751.

 Working with agent configurations 1848
Applying agent configurations to an agent group

Applying agent configurations to an agent group

You can apply any agent configuration to any agent group. Use the Apply Configuration
page to assign agent configurations to your agent groups.
See “About agent configurations” on page 1783.
Applying an agent configuration to an agent group
1 Go to the System > Agents > Agent Configuration screen.
2 Click the Apply Configuration button
The Agent Groups screen displays. When this screen displays, you assign the agent
configuration to an agent group to finish applying the agent configuration.
See “Updating outdated agent configurations” on page 1858.
See “Adding and editing agent configurations” on page 1784.
See “Endpoint Server—basic configuration” on page 222.

Configuring the agent connection status

You can set the connection period for agents to specify how long they report. Settings you
make on this screen apply to all registered Endpoint Servers. The default setting is 18 hours.

Note: The setting you enter should be 5 minutes greater than the agent polling interval
(ServerCommunicator.CONNECT_POLLING_INTERVAL_SECONDS.int). See “Advanced
agent settings” on page 1804.

To configure the agent connection status

1 Go to System >Settings >General
2 Click Configure.
3 Locate the Agent Connection Status Configuration area.
4 Enter hours and minutes to specify how much time passes before an agent displays as
not reporting.
5 Save your changes.
 Chapter 78
Working with Agent Groups
This chapter includes the following topics:

■ About agent groups

■ Developing a strategy for deploying Agent Groups

■ Overview of the agent group deployment process

■ Creating and managing agent attributes

■ Viewing and managing agent groups

■ Viewing group conflicts

■ Changing groups

About agent groups

Agent Groups enable you to group and configure agents according to user-specific or
machine-specific characteristics, such as country, location, or department name. These
characteristics are called agent attributes. You can use attributes to create groups and assign
specific configurations to the groups based on your business needs. Agent Groups can be
used to deploy and manage a large number of agents. You can also use Agent Groups to
temporarily exempt certain agents, based on attributes, from policies that affect other
configurations, for testing purposes.
One Endpoint Server can support multiple Agent Groups. An Endpoint Server can dynamically
discover to which agent group a particular agent belongs, based on agent group definitions
and agent attributes, and assign the configuration to an agent belonging to the appropriate
agent group. Assigning one agent configuration per Endpoint Server is also supported by
having a group for the Endpoint Server.
With Agent Groups, attributes of logged-in users and endpoint computers can be used to
create group conditions. Symantec Data Loss Prevention provides six predefined attributes.
 Working with Agent Groups 1850
Developing a strategy for deploying Agent Groups

You can create other user-defined attributes based on Active Directory attributes. For example,
you can create a group condition based on a location attribute, such as all users (agents)
located in New York, and a department attribute, such all users who are part of the Human
Resources department. For that group you can deploy a configuration in which removable
storage is monitored. In this example, the Agent Group definition has two conditions: location(s)
and department name(s).
Agent groups simplify the management of agent configuration exceptions by allowing a logical
grouping of endpoint agents based on conditions. For example, if you have Instant Messenger
monitoring enabled for US employees, except for those US employees in the state of Texas,
you can have a group named "United States Texas," and disable IM monitoring for that group.
Every new agent that is added in the "United States Texas" group automatically gets a
configuration with IM monitoring disabled.
You can roll out configuration changes in stages using Agent Groups. In addition, you can
create groups for exceptions to monitor particular computers or sets of computers differently.
For example, you can create an Executive Staff group for cases when the executive staff is
not subject to configurations that apply to the rest of the organization
The ability to change an agent group action is useful when you need to troubleshoot problems
in Symantec Data Loss Prevention. For example, you can create a temporary group that
disables certain monitoring and configurations for employees (printing with a specific application,
for example) to get around a security issue, then change the employees back to the old group
when the printing problem is resolved
See “Developing a strategy for deploying Agent Groups” on page 1850.

Developing a strategy for deploying Agent Groups

Before you begin implementing Agent Groups, think about the agent configurations that you
need in your environment. Here's a high-level checklist of planning tasks:
1. Identify the unique agent configurations that you need in your environment. Think about
all of your agents and how you want them grouped.
2. Document who (which agents) gets which configurations.
3. Document the Active Directory attributes that you use to create the groups.
4. Design the groups so that no user belongs to more than one group. In other words, design
groups so that there are no overlapping groups.
 Working with Agent Groups 1851
Overview of the agent group deployment process

See “Overview of the agent group deployment process” on page 1851.

Overview of the agent group deployment process

Defining and managing user-attribute-based groups involves several tasks and steps, from
defining the attributes, creating groups, assigning configurations to deploy the groups, and
resolving group conflicts. Table 78-1 provides an overview of the process of deploying agent
groups, with cross references to more detailed procedures.

Table 78-1 Implementing your Agent Group Strategy

Step Action For more information

Step 1 Define attributes to use for See “Creating and managing

creating groups. agent attributes” on page 1852.

Step 2 Verify that the attribute definitions See “Verifying attribute queries
are correct using the attribute with the Attribute Query Resolver
verification tool. tool” on page 1854.

Step 3 Push attributes to the agents. The See “Applying a new attribute or
agent receives agent attribute changed attribute to agents”
queries and the attribute result set on page 1855.
is generated and saved on the
agent.

Step 4 View the attribute values that are

reported by the agents to verify
that they return the expected
attribute values.

Step 5 Create the groups you want using See “Creating a new agent group”
the defined attributes. on page 1858.

Step 6 Assign an agent configuration to See “Assigning configurations to

the group. deploy groups” on page 1859.

Step 7 Verify that assignments are See “Viewing and managing

correct by confirming that each agent groups” on page 1856.
group contains the expected
number of agents.
 Working with Agent Groups 1852
Creating and managing agent attributes

Table 78-1 Implementing your Agent Group Strategy (continued)

Step Action For more information

Step 8 Periodically check if there are any See “Viewing group conflicts”
agent group conflicts. If there are on page 1860.
conflicts, resolve them.

Creating and managing agent attributes

To navigate to the Agent Attributes screen from the System > Agents > Agent Groups
screen, click the Manage Agent Attributes link.
Agent Groups are defined using agent attributes. On the Agent Attributes screen, you can
see a list of predefined and user-defined attributes. Notice that if the list contains only predefined
attributes, the Export, Apply Changes, and Undo Changes buttons are not disabled; these
actions can only be taken on user-defined attributes.
From this screen you can use the buttons to
■ Create new attributes - See “Creating a new agent attribute” on page 1853.
■ Export attributes - See “Verifying attribute queries with the Attribute Query Resolver tool”
on page 1854.
■ Apply attribute changes. Note that attribute's values are not fetched from Active Directory
until you click Apply - See “Applying a new attribute or changed attribute to agents”
on page 1855.
■ Undo attributes changes - See “Undoing changes to agent attributes” on page 1856.
Use the Filters button to filter the list of attributes by any of the headings.
There are two types of agent attributes, predefined and user-defined. Predefined attributes
cannot be deleted or modified. Symantec Data Loss Prevention provides six predefined
attributes:

Table 78-2 Predefined attributes

Attribute Definition

Agent Host Domain Domain to which the agent host computer is joined

Logged in User Domain Current logged-in user domain

Agent Host Name Computer name of endpoint where the agent is

installed

Agent Host Type Operating system architecture; for example x86 or

x64
 Working with Agent Groups 1853
Creating and managing agent attributes

Table 78-2 Predefined attributes (continued)

Attribute Definition

Agent Host Version Operating system; for example, macOS, Windows

7

Logged in User Current logged-in user

User-defined attributes are created by the administrator for the purpose of creating groups.
You can create user-defined attributes based on Active Directory (AD) attributes. User-defined
attributes can be deleted or modified.

Note: User-defined attributes are not supported for computers running macOS.

See “Creating a new agent attribute” on page 1853.

See “Mac agent groups features” on page 1721.

Creating a new agent attribute

You can create a logical grouping of endpoint agents based on conditions based on user-defined
agent attributes. For user-defined attributes, the agent executes an Active Directory query that
can resolve the attribute values. When an agent starts up, queries are executed and the
attribute results are cached.
To create user-defined attributes, follow these steps:
1. Choose Agent Groups from the System > Agents menu. Then, click the Manage Agent
Attributes link.
2. On the Agent Attributes screen, click New to begin the attribute creation process.
A Configure Agent Attribute screen appears.
3. Add the name of the attribute. Names can contain 1 to 100 characters.
4. Add a description of attribute. Descriptions must contain only alpha and numeric characters.
5. Select a domain, either User Domain or Machine Domain.
There are two types of attributes for user-defined agent groups:
■ User Domain - Attributes related to the logged-in user; for example, the domain attribute
"department."
■ Computer domain - Attributes related to the computer; for example, computer attribute
"location."

6. Add a search filter. You can select from existing applied attributes to define a search filter.
 Working with Agent Groups 1854
Creating and managing agent attributes

7. Specify an Active Directory attribute.

Only Active Directory attributes are supported for user-defined agent group attributes.
8. Click Save. Clicking Save saves your attribute but does not apply it.
9. Test the attribute and fix any issues you find in testing.
To test, export the attribute(s) from the Attribute List screen and review the attribute.
Then, use the Attribute Query Resolver test tool that runs on the Windows host where the
endpoint is installed, to test the attribute.
See “Verifying attribute queries with the Attribute Query Resolver tool” on page 1854.
10. Apply the tested attributes. Agents start reporting attribute values as soon as the agents
resolves the attributes on Active Directory.
See “Applying a new attribute or changed attribute to agents” on page 1855.
11. Verify that agents are reporting attribute values. Go to the System > Agents > Overview
> Agent List screen and verify that the agents are reporting attribute values. You can
select a particular agent entry and see the Preview Pane. The Preview Pane lists all
predefined and user-defined attributes and their values, conflicts, and alerts.
See “Using the Agent List screen” on page 1865.
See “Defining a search filter for creating user-defined attributes” on page 1854.

Defining a search filter for creating user-defined attributes

You can use both Predefined and applied user-defined attributes. The typical syntax for a
search filter is
(&(objectCategory=Person)

(objectClass=User)(uid=$LoggedinUser$))

The value embedded in dollar ($ $) signs represents the agent attribute that you can choose
when you click the Select from existing attributes drop down on the Configure Agent
Attribute screen.
See “Verifying attribute queries with the Attribute Query Resolver tool” on page 1854.

Verifying attribute queries with the Attribute Query Resolver tool

You can verify if the attribute definitions are correct with the Attribute Query Resolver tool.
First, export the attributes to an XML file:
1. Go to the System > Agents > Agent Groups > Agent Attributes screen.
2. Click Export to export the attributes data to an XML file.
3. Click Save File in the Opening agent-attributes.xml dialog.
 Working with Agent Groups 1855
Creating and managing agent attributes

4. Click OK to complete the export task.

Note: Attribute Query Resolver tool only fetches the attributes of the currently logged in user.

Next, use this XML file to test your attributes with the Attribute Query Resolver tool.

Note: You must have administrator privileges to run this tool.

1. Copy AttributeQueryResolver.exe and aqp.dll from the agent distributable tools folder
on the endpoint into the same folder.
2. Run the command (for example)
c:\AttributeQueryResolver.exe -aq=agent-attributes.xml

3. Attributes with errors display in the output with blank values. For example, if the attribute
User Email had an error, it displays as User Email= with no value. Errors can occur if a
user provides an incorrect search filter, if a specified attribute does not exist in Active
Directory, or if Active Directory is not reachable.
You can go to the AttributeQueryResolver.log log file to view details for the attribute
errors. In this attribute error log, files with no errors display an Error code : 0 (no errors).
Attributes with errors display an error code and error description. For example, the User
Email attribute with a blank attribute in the output (indicating an error) displays an error
message that reads:
2014-01-21 20:41:48 | AttributeQueryResolver | SEVERE | Attribute : User
Email Error code: -2147463161 Error description : E_ADS_PROPERTY_INVALID

If you provide an invalid XML file as a parameter to the Attribute Query Resolver tool, or if you
do not have appropriate rights to run the tool, the following SEVERE error is logged:
AttributeQueryResolver | SEVERE | Query store is not open.

If the attribute definitions are correct, you can deploy the attributes to agents. If there are errors,
edit the attributes reporting errors, export the attributes, and run them through the Attribute
Query Resolver tool. Repeat this process until there are no errors.
See “Applying a new attribute or changed attribute to agents” on page 1855.

Applying a new attribute or changed attribute to agents

Newly created agent attributes appear on the Agent Attributes screen labeled as New. After
you edit an agent attribute, the attribute is in a Modified state. In both cases, you must apply
the attributes to the agents before they can take effect. To apply the changes to the agents:
1. Click Apply Changes on the Agent Attributes page.
 Working with Agent Groups 1856
Viewing and managing agent groups

2. Verify the changes that appear on the Apply Changes pop-up and click Apply Changes.
If you see any discrepancies, click Cancel and go back to previous screens to correct
your errors.
3. Review the updated Agent Attributes screen. The Status of your recently applied agent
attributes should now read Up-to-date.
See “Undoing changes to agent attributes” on page 1856.

Undoing changes to agent attributes

After you have modified certain attributes and tested them with the Attribute Query Resolver
tool, you may find issues with the modified attributes. You can undo changes to go back to
the original state of the attributes. To undo changes, follow these steps:
1. Click Undo Changes.
2. In the Undo Changes dialog, review the list of changed attributes.
3. Click Undo Changes to reverse the most recent changes you made.
See “Editing user-defined agent attributes” on page 1856.

Editing user-defined agent attributes

You can edit user-defined agent attributes from the System > Agent > >Agent Groups >
Agent Attributes screen:
1. Click the attribute in the Name column. User-defined attributes are all of the Type User
Defined.
2. Edit the attribute fields on the System > Agents > Agent Groups > Edit Agent Attribute
screen.
3. Click Save.

Note: You cannot edit Predefined agent attributes.

See “Viewing and managing agent groups” on page 1856.

Viewing and managing agent groups

You can use agent groups to enable logical grouping of your endpoint computers based on
conditions. Agent groups can be based on
■ Agent attributes
■ Endpoint Server names
 Working with Agent Groups 1857
Viewing and managing agent groups

■ Endpoint host names

Agents are evaluated and included in particular groups based on a priority ordering of conditions.
The conditions are, from highest priority to lowest:
1. An agent host name that is in the "Always include" list in the agent group definition.
2. An agent that connects to an Endpoint Server group, when a corresponding Endpoint
Server group exists.
3. An agent group with a user-defined attribute, where the agent satisfies its group condition.
For example, if an agent can belong to both the "Endpoint host name group" and the "Agent
attribute" based group, since the Endpoint host name group has highest priority among all
three types of groups, the agent belongs to Endpoint host name group.
Check agent group status and manage agent groups from the System > Agents > Agent
Groups screen. To view agent group conflicts, click View Agent Group Conflicts on the
right-hand side of the screen.
Information about agent groups is divided into several columns on this page. You can click
any column header to sort entries alphanumerically in that column. Click the column header
again to sort in reverse order.
Use these buttons to perform the following actions:
■ New - Create a new agent group.
■ Delete - Delete the selected agent groups.
■ Enable - Enable the selected agent groups.
■ Disable - Disable the selected agent groups.
■ Assign Configuration - Assign a configuration to created or updated agent groups.
■ Update Configuration - Update a configuration for the selected agent groups.
■ Filters - Reorganize this list of agent groups for easier viewing.
See “About agent groups” on page 1849.
See “Overview of the agent group deployment process” on page 1851.
See “Agent group conditions” on page 1857.

Agent group conditions

An agent group definition can have multiple conditions. In addition, the following operators are
supported for group conditions:
■ Implicit AND conditions
■ OR is supported for a condition by specifying multiple values for the condition
 Working with Agent Groups 1858
Viewing and managing agent groups

■ Equal _TO clause

■ Wildcard character (*) to specify multiple values. For example, "Fin*" matches both "Finance"
and "Fincon"
You can navigate to the main Agent Groups screen in the Enforce Server administration
console at System > Agents > Agent Groups.
See “Creating a new agent group” on page 1858.

Creating a new agent group

To create an agent group:
1. Go to the System > Overview > Agent List screen.
2. Click New to create a new group. This action takes you to the Create New Agent Group
screen.
3. Enter the name of the group in the Name field. The name is a required field and must
contain from 1 to 100 characters.
4. Add an optional description.
5. Click a button to define the group condition as either User Attributes or Endpoint Server.
6. Select attributes for the condition from the Select Agent Attributes list and assign values
to match, to create the condition.
7. Add agent host names to the Always include these agents box if you have agents that
you want to always include in this group.
8. Click Save when you are done, or Cancel to start over.
9. Assign the configuration to deploy the group. See “Assigning configurations to deploy
groups” on page 1859.

Note: Assigning a configuration to the group activates the group.

See “Overview of the agent group deployment process” on page 1851.

See “Assigning configurations to deploy groups” on page 1859.

Updating outdated agent configurations

When an agent configuration is updated, but before the changes have been applied to an
agent group, the agent group has an outdated configuration. Outdated agent configurations
appear in the System > Agents > Agent Groups list with their name flagged with a red
exclamation mark. To update an outdated group configuration:
 Working with Agent Groups 1859
Viewing and managing agent groups

1. Choose an agent group to update the configuration on the System > Agents > Agent
Groups screen.
2. Click the check box for the agent group with the outdated configuration you want to update.
3. Click Update Configurations.
4. Verify the name and status for the group in the Update Configurations dialog and click
OK.
5. Verify that each configuration for the group has been updated by assuring that there is
no longer a red exclamation mark following the names of the agent configurations.

Note: If an agent is offline, it does not receive an updated configuration until the agent comes
online again.

See “Verify that group assignments are correct” on page 1859.

Assigning configurations to deploy groups

To deploy created or updated groups, you need to assign configurations to the groups. To
assign a configuration to a group or set of groups:
1. Select the groups on the System > Agents > Agent Groups screen by clicking the check
boxes to the left of each group.
2. Click Assign Configuration in the action bar.
3. Choose a configuration from the Assign Configuration dialog.
4. Click OK in the Assign Configuration dialog box.
5. When the Agent Groups page refreshes, the Assigned Configuration names are
displayed for the groups.
See “Updating outdated agent configurations” on page 1858.

Verify that group assignments are correct

Confirm that you have the expected number of agents in each of the groups:
1. Go to System > Agents> Overview > Summary Reports.
2. Click Advanced Filters & Summarization and choose Summarize By : Agent Groups.
3. Verify that you have the expected number of agents reporting in each of the groups.
 Working with Agent Groups 1860
Viewing group conflicts

See “Viewing group conflicts” on page 1860.

Viewing group conflicts

As the Endpoint administrator, you determine the correct agent group for each endpoint
computer based on the attribute values that the agent on the endpoint reports to the Endpoint
Server. You can avoid group conflicts by carefully planning your implementation. You should
also periodically check to see if there are group conflicts.
You can see conflicts on the View Conflicts screen by clicking View Agent Group Conflicts
link on the System > Agents > Agent Groups screen. On the View Conflicts screen, under
the Conflicting Groups heading, you see the names of the conflicting groups.
If a particular agent can qualify to be a part of more than one group, a conflict arises. For
simple conflicts, where group 2 is a subset of group 1, Symantec Data Loss Prevention
automatically resolves the conflict in favor of the subset group 2. For example, if you have
these two groups:
1. Group US={Country=US}
2. Group Texas={Country=US & State=Texas}
the conflict between group "US" and group "Texas" is resolved to group "Texas" because
group "Texas" is a subset of group "US."
No automatic group conflict resolution mechanism exists for non-subset groups that are in
conflict. For example, if you have a group called US_HR in which the Country=US and the
Department=HR, and a Group US_VP in which the Country=US and the Designation=VP,
agents that belong to VPs in the HR department will result in a conflict. Since Department=HR
is not a subset of Designation=VP (or vice versa), the conflict cannot be resolved and the
agents with conflicts are placed in a warning state and continue to belong to whatever group
they belonged to before the conflict arose. For these more complex conflicts, Symantec Data
Loss Prevention reports conflicts and you must edit the group definitions to resolve the group
conflicts.
See “Changing groups” on page 1860.

Changing groups
You can change groups for agents to have a different configuration on the System > Agents
> Overview > View All Groups page. The ability to change an agent configuration from one
group to another is useful in many situations, especially when you need to troubleshoot a
problem with Symantec Data Loss Prevention.
For example, say that your employees in the group Trading Group Texas have problems
printing with the stock trading application. This issue causes a major problem for your business,
as traders are not able to work without the ability to print. You can move the agents in Trading
 Working with Agent Groups 1861
Changing groups

Group Texas to a temporary group, called Troubleshoot Trading Group, with print monitoring
disabled, until you can troubleshoot the agent endpoints and fix the issue. After the problem
is solved, you can change the group back to Trading Group Texas to enable print monitoring.
To change groups for agent configurations:
1. Click the checkboxes for the agent entries that you want to move.
2. Click Change Group.
3. Choose a new group from the System > Agents > Agent List > Agent Group menu.
4. Click OK.
See “About Symantec DLP Agent administration” on page 1862.
 Chapter 79
Managing Symantec DLP
Agents
This chapter includes the following topics:

■ About Symantec DLP Agent administration

■ About DLP Agent logs

■ About agent password management

About Symantec DLP Agent administration

After you have installed Symantec DLP Agents, you can administer them from the Enforce
Server. The Enforce Server provides an interface which can be used to:
■ View Symantec DLP Agent information.
■ View the status of your deployed Symantec DLP Agents.
■ View events for Symantec DLP Agents.
■ Generate reports for your deployed Symantec DLP Agents.
■ Troubleshoot your deployed Symantec DLP Agents.
To view and manage your Symantec DLP Agents, log on to your Symantec Data Loss
Prevention Enforce Server; then, click System > Agents.
See “Agent Overview screen” on page 1863.
See “About agent events” on page 1881.
 Managing Symantec DLP Agents 1863
About Symantec DLP Agent administration

Agent Overview screen

The Agent Overview screen provides a summarized view of all deployed DLP Agents. You
can use this screen to view the DLP Agent health status and to begin troubleshooting any
agents which might report an alert. The DLP Agents are grouped by status and then they are
categorized by alert type. Alert types with the highest number of affected agents are listed first
and alert types with the fewest number of affected agents are listed last.

Figure 79-1 Agent Health Dashboard

You can begin troubleshooting an alert by clicking a status icon or by clicking on a link to the
left of an alert type. After you click a status icon or link the Agent List screen displays. See
“Using the Agent List screen” on page 1865.
The DLP Agents are grouped into the following statuses:
 Managing Symantec DLP Agents 1864
About Symantec DLP Agent administration

Table 79-1 DLP Agent statuses

DLP Agent Status description

status

An OK status indicates that the DLP Agents in this state are operating under normal conditions. This
status indicates:

■ Services and the file-system drivers for the DLP Agent are running
OK ■ The DLP Agent cache is created and available
■ The DLP Agent is reporting to the Endpoint Server as expected

A Warning status indicates that the DLP Agents in this state have experienced conditions which
may require attention.

Warning agent alerts generally include the following:

Warning
■ Downlevel DLP Agent version
■ Active Directory group resolution failure
■ A plug-in error has occurred
■ The DLP Agent needs to be restarted

The following section provides a comprehensive list of Warning statuses.

See “Troubleshooting agent alerts” on page 1883.

A Critical status indicates that the DLP Agents in this state have experienced conditions that require
immediate attention:

Critical agent alerts generally include the following:

Critical
■ A driver is not running
■ The DLP Agent version is not compatible with the Endpoint Server
■ Active Directory permissions conflict with Symantec Data Loss Prevention permissions
■ The DLP Agent cannot report to the Endpoint Server
■ The DLP Agent is unable to monitor macOS applications protected by System Integrity Protection
(SIP)

The following section provides a comprehensive list of Critical statuses.

See “Troubleshooting agent alerts” on page 1883.

The Agent Overview screen lets you quickly access agent summary reports, agent
configurations, and agent groups.

Table 79-2 Agent management features

Section Description

Agent Summary Reports Agent summary reports let you summarize agent information and create reports.

See “Using the Summary Reports screen” on page 1871.

 Managing Symantec DLP Agents 1865
About Symantec DLP Agent administration

Table 79-2 Agent management features (continued)

Section Description

Agent Configurations You can configure agent settings on the Agent Configurations screen.
See “About agent configurations” on page 1783.

Agent Groups You can view existing agent groups and resolve agent group conflicts.

See “About agent groups” on page 1849.

See “Viewing group conflicts” on page 1860.

See “Using the Agent List screen” on page 1865.

See “About agent events” on page 1881.

Using the Agent List screen

You access the Agents List screen by clicking an agent status or alert type link on the System
> Agents > Overview screen. The Agents List screen helps you manage agents by displaying
agent details and status. Select an agent to display information about it, like status, agent
group conflicts (if they exist), and the agent host name. You can also use this screen to modify
agents.
See “About agent status” on page 1867.
You can use the Agents List screen to perform agent management tasks.

Note: Use the Filters feature to execute or remove filters you select. See “Agent filtering”
on page 1870.
 Managing Symantec DLP Agents 1866
About Symantec DLP Agent administration

Table 79-3 Agent management tasks

Agent management task Description

Troubleshoot This menu lets you perform the following troubleshooting tasks:
■ Enable
Enables the disabled agents.
Enabled agents automatically reconnect with the Endpoint Server and obtain
the most current policies. Enabling an agent enables monitoring on that endpoint.
Enabled agents can log events on the Endpoint Server.
■ Disable
Stops monitoring and any active scans on agents.
■ Set Log Level
Sets the logging level for the specified agent. Symantec Technical Support uses
agent logs for troubleshooting purposes.
Note: It is recommended to contact Symantec Technical Support before you
change the log level for an agent.
See “About DLP Agent logs” on page 1891.
■ Reset Log Level
Resets the logging level for the specified agent to the default INFO level.
Symantec Technical Support uses agent logs for troubleshooting purposes.
See “About DLP Agent logs” on page 1891.
■ Set Under Investigation
Set if you believe there is some sort of issue with the agent. You can set this
status regardless of whether the agent is running, disabled, or shut down. An
additional icon, a flag, appears next to the main status icon of the agent.
■ Remove Under Investigation
Removes the Set Under Investigation status from the selected agents.

Delete Deletes the agent.

When you delete an agent, you remove that agent and all associated events from
the Endpoint Server. It is no longer visible in the Enforce Server administration
console. Deleting an agent from the Endpoint Server does not mean that it has
been uninstalled from the endpoint.

Change Server Lets you change the Endpoint Server to which the agent connects.

You can specify the primary Endpoint Server as well as secondary Endpoint Servers
in case the primary server fails and the agent must switch connections.

See “Changing the Endpoint Prevent Server” on page 1880.

Change Group Lets you assign the selected agent to an agent group that you select.

See “Agent task confirmation screen” on page 1878.

Restart Restarts the selected agent.

 Managing Symantec DLP Agents 1867
About Symantec DLP Agent administration

Table 79-3 Agent management tasks (continued)

Agent management task Description

Shut Down Shuts down the selected agent.

See “About agent events” on page 1881.

Pull Logs Lets you pull agent logs and operational logs for the agent. You can pull either the
agent logs, or the operational logs, or both sets of logs.

Pulling agent logs is a two-step process:

■ Click the Pull Logs button to download the agent logs from the endpoint to the
Endpoint Server.
■ Download the agent logs from the Endpoint Server through the Enforce Server.
You complete this action on the System > Servers and Detectors > Logs >
Collection screen.

See “Collecting server logs and configuration files” on page 306.

When the logs are pulled from the endpoint, they are stored on the Endpoint Server
in an unencrypted format. After you collect the logs from the Endpoint Server, the
logs are deleted from the Endpoint Server and are stored only on the Enforce
Server. You can only collect logs from one endpoint at a time.

Enable Uninstall Password Prevents the agent running on Windows endpoints from being uninstalled unless
you enter the agent uninstall password during the uninstall process.

See “About agent password management” on page 1893.

Disable Uninstall Password Allows the agent running on Windows endpoints to be uninstalled without entering
the agent uninstall password.
Note: The DLP Agent goes into a Warning state when the uninstall password is
disabled.

See “Agent Overview screen” on page 1863.

See “About filters and summary options for reports” on page 1388.
See “About agent events” on page 1881.
See “Using the Summary Reports screen” on page 1871.

About agent status

The Agent List screen displays current agent information. You can use this information to
review agent status, last update time, agent operating system, and version. Table 79-4 provides
a list of agent statuses and details.
 Managing Symantec DLP Agents 1868
About Symantec DLP Agent administration

Table 79-4 Agent status

Section Description

Status Displays the current agent status.

Agent status includes the following:

■ OK
Indicates the agent service and file-system driver are running, that the cache is
created and available, and that the connection functions as expected.
■ Warning
Indicates the agent may need attention. For example, Symantec Data Loss
Prevention assigns this status when the endpoint data share nears its storage limit.
■ Critical
Indicates that the agent is experiencing transitory connection problems. The agent
may have been down for a period of time. Policy and configuration may be out of
date. The agent may not be compatible with the Enforce Server.
■ Investigating
Indicates that the agent in question is under investigation. Agents may be under
investigation for a number of reasons. These reasons include sending too many
false positive incidents, and being unable to connect to the Endpoint Server.
■ Not Investigating
You select this item to remove an agent from investigation.
■ Log Level Changed
Indicates that the log level for the agent has been changed or reset.
See “About DLP Agent logs” on page 1891.
■ Default Log Level
You select this item to change the log level.
See “About DLP Agent logs” on page 1891.

Alerts Displays the number of Warning and Critical alerts that occur on an agent. To see a
list of alerts for a particular agent, click on the relevant agent entry to display the
Events screen.

See “About agent events” on page 1881.

Machine Name Displays the endpoint name.

User Name Displays the user name of the logged in endpoint user. If multiple users are logged in
to the endpoint, multiple displays.

Agent Group Displays the agent group name.

 Managing Symantec DLP Agents 1869
About Symantec DLP Agent administration

Table 79-4 Agent status (continued)

Section Description

Agent Displays the current agent configuration used:

Configuration
■ Other Configurations (Not Current)
Indicates that a custom configuration is applied.
■ Current Configuration
Indicates that the latest configuration is applied.
■ Outdated Configuration
Indicates that the configuration is obsolete.
■ Unknown/Deleted Configuration
Indicates that the configuration was deleted. Agents display this configuration status
until they receive an updated configuration from an Endpoint Server.
■ Default Configuration
Indicates that the default configuration is applied. The default configuration is
applied during install.

Connection Displays the current agent connection status.

Status Agent connection status includes the following:

■ Unknown
Agents with unknown status.
■ Reporting
DLP Agents that are currently connected to the corporate network.
■ Not Reporting
DLP Agents that are not currently connected to the corporate network.

See “Setting the endpoint location” on page 1751.

Last Update Displays the date and time on the Enforce Server when the agent was last updated.
Time

OS Displays the agent operating system.

Platform Displays the agent processor type.

Endpoint Lists the Endpoint Server to which the agent is registered.

Server

IP Address Displays the endpoint IP address.

Version Displays the endpoint version.

See “Agent Overview screen” on page 1863.

See “About filters and summary options for reports” on page 1388.
 Managing Symantec DLP Agents 1870
About Symantec DLP Agent administration

Agent filtering
You can filter what agents display on the Agent List screen by clicking Filters. After you are
done selecting filter criteria, click the check box.
Click a column header to sort entries alpha-numerically. Click the column header a second
time to sort in reverse order. By default, Symantec Data Loss Prevention lists agents by the
endpoint name. Select items in the column headers to only display agents containing the
selected data.
You can filter the agents that display by a number of criteria including agent configuration,
server name, and agent IP address. Additionally, you can filter the agent events by specific
sets of criteria relating to the Symantec DLP Agent. Summarizing and filtering the agents lets
you view agents by specific criteria, and in the order that you want. For example, you can
display the agents that have the Default Configuration associated and then display the agents
that were updated in the last 7 days. You can click a column to the agents by the date they
were last updated.

Note: Click Select all to select all agents that meet the filter criteria regardless of what agents
currently display on the grid. This selection is useful when agents flow across more than one
page. Click the box at the top left of the grid to select all agents that display on the grid.

You can filter the agents that display in the grid by using the following items:

Table 79-5 Filtering agents

Item to filter Description

Alert Category Lets you filter on each of the agent alert categories.

Status Select an agent alert status.

Machine Name Enter the name of an endpoint you want to display. The alphanumeric
value you enter displays all endpoints that contain the value string. For
example, to display endpoints with 123 anywhere in the name, enter
123.

User Name Enter the user name of a user that is associated with an endpoint you
want to display.

Agent Group Select an agent group to display all the agents that are contained in
the group.

Agent Configuration Select an agent configuration.

Connection Status Select a connection status.

 Managing Symantec DLP Agents 1871
About Symantec DLP Agent administration

Table 79-5 Filtering agents (continued)

Item to filter Description

Last Update Time Select an update time. This value represents the last time the Enforce
Server received data from agent.

OS Enter the name of the OS you want to display. The alphanumeric value
you enter displays all endpoints that contain the value string. For
example, to display endpoints with Mac anywhere in the name, enter
Mac.

Platform Select 32bit or 64bit.

Endpoint Server Click the Endpoint Server name to display the agent associated with
that server. You can also select Deleted to display agents currently
reporting to deleted Endpoint Servers.

IP Address Enter an IP address associated with an agent.

Version Enter the agent version you want to display.

See “Using the Agent List screen” on page 1865.

Using the Summary Reports screen

You use the Summary Reports screen (System > Agents > Overview > Summary > Reports)
to summarize agent information and create reports.

Note: You complete agent management tasks on the Agent List screen. See “Using the Agent
List screen” on page 1865.

You can select which DLP Agents display in a report by filtering the agent events by specific
sets of criteria. For example, you can summarize the agents by the associated agent
configuration and then filter those configurations by the most recently updated agents.
You can generate a filtered report by specifying a number of criteria, including agent
configuration, server name, and agent IP address. Summary reports take their name from the
summary criterion. If you rerun a report with new criteria, the report name changes accordingly.
To create a DLP Agent summary report:
1 Select an item in the Date list to display agents by last connection time.
2 Click Advanced Filters and Summarization.
3 Select an item in the Summarize By list to select on which criteria you want to summarize.
See Table 79-6 on page 1872.
 Managing Symantec DLP Agents 1872
About Symantec DLP Agent administration

You can summarize by the following items:

■ Agent Configuration
■ Agent Group
■ Agent IP
■ Agent Status
■ Agent Version
■ Alerts
■ Connection Status
■ Endpoint Server
■ Investigating State
■ Log Level
■ OS
■ Platform
■ State Category
■ State Sub Category
■ Uninstall Password

4 Click Add filter if you want to add additional filters. Table 79-6 lists advanced filters.
5 Click Apply to generate the report using the specified filters.
6 Click Save > Save As to save the report you created.
7 Click Send to email the report.
8 Click Export > All: CSV to download a CSV file of the report.

Table 79-6 Advanced filters and summarization

Primary filter Available conditions Secondary filter

Agent Configuration ■ Is Any Of Agent Configuration: Select the DLP Agent

■ Is None Of Configuration that you want to include or
exclude from the report.
 Managing Symantec DLP Agents 1873
About Symantec DLP Agent administration

Table 79-6 Advanced filters and summarization (continued)

Primary filter Available conditions Secondary filter

Agent Configuration ■ Is Any Of ■ Current Configuration: The number of

Status ■ Is None Of agents that are running the most current
version of the agent configuration.
■ Outdated Configuration: The number
of agents that are running an older
version of the agent configuration.
■ Unknown/deleted Configuration: The
number of agents that are running an
unknown version of the agent
configuration.

Agent Group ■ Is Any Of Select an agent group from the list.

■ Is None Of

Agent Group Status ■ Is Any Of ■ Deleted: The agent groups that have
■ Is None Of been deleted.
■ Disabled: The agent groups that have
been disabled.
■ Enabled: The agent groups currently in
use.

Agent IP ■ Contains Ignore Case Agent IP: Enter the IP address you want to
■ Does Not Contain Ignore filter.
Case
■ Matches Exactly
■ Does Not Match Exactly
■ Matches Exactly Ignore
Case
■ Starts With
■ Ends with

Agent Status ■ Is Any Of ■ Critical: Filter DLP Agents which report

a Critical status.
■ Is None Of
■ OK: Filter DLP Agents which report an
OK status.
■ Warning: Filter DLP Agents which report
a Warning status.
 Managing Symantec DLP Agents 1874
About Symantec DLP Agent administration

Table 79-6 Advanced filters and summarization (continued)

Primary filter Available conditions Secondary filter

Agent Version ■ Contains Ignore Case Agent Version: Enter the DLP Agent
■ Does Not Contain Ignore version number which you want filtered.
Case
■ Matches Exactly
■ Does Not Match Exactly
■ Matches Exactly Ignore
Case
■ Starts With
■ Ends With

Alerts ■ Is Any Of Alerts: Enter the DLP Agent alert you want
filtered.
■ Is None Of

Connection Status ■ Is Any Of ■ Not Reporting: Filter DLP Agents that

■ Is None Of are not currently connected to the
corporate network.
■ Reporting: Filter DLP Agents that are
currently connected to the corporate
network.
■ Unknown: Filter DLP Agents that have
an unknown connection status.

Endpoint Server ■ Is Any Of Endpoint Prevent Server: Select the

■ Is None Of Endpoint Prevent Server you want to filter.
The DLP Agents that report to this server
are filtered.

Selecting Deleted displays all endpoints that

report to deleted Endpoint Servers.

Investigating State ■ Is Any Of ■ Investigating

■ Is None Of ■ Not Investigating

Log Level ■ Is Any Of ■ Custom: Select all DLP Agents with log
■ Is None Of levels set to a value other than the INFO
level.
■ Default: Select all DLP Agents with log
levels set to the default INFO level.
 Managing Symantec DLP Agents 1875
About Symantec DLP Agent administration

Table 79-6 Advanced filters and summarization (continued)

Primary filter Available conditions Secondary filter

Machine Name ■ Contains Ignore Case Machine name: Enter the computer name
■ Does Not Contain Ignore that you want to use as a filter.
Case
■ Matches Exactly
■ Does Not Match Exactly
■ Matches Exactly Ignore
Case
■ Starts with
■ End with

OS ■ Contains Ignore Case OS: Enter the operating system name that
■ Does Not Contain Ignore you want to use as a filter.
Case
■ Matches Exactly
■ Does Not Match Exactly
■ Matches Exactly Ignore
Case
■ Starts with
■ End with

Platform ■ Is Any Of ■ 32-bit

■ Is None Of ■ 64-bit

State Category ■ Is Any Of ■ AD User Group Resolution

■ Is None Of ■ Agent Configuration Change Status
■ Agent Group Change Status
■ Agent Monitoring Status
■ AIM Plugin Status
■ Crash Dump Status
■ File System Drive
■ Lotus Notes Plugin Status
■ Outlook Plugin Status
■ Reporting Status
■ Software Compatibility
 Managing Symantec DLP Agents 1876
About Symantec DLP Agent administration

Table 79-6 Advanced filters and summarization (continued)

Primary filter Available conditions Secondary filter

State Sub Category ■ AD User Group Resolution: Filter DLP

Agent by successful or failed Active
Directory Group resolution.
■ Agent Configuration Change Status:
Filter DLP Agent by date the agent
configuration was last updated.
■ Agent Group Change Status: Filter
DLP Agent by date the agent group was
last updated.
■ Agent Monitoring Status: Filter DLP
Agents by their monitored status.
■ AIM Plugin Status: Filter DLP Agents
which have AOL Instant Messenger
plug-ins that have failed installation,
been repaired, or tampered with.
■ Crash Dump Status: Filter DLP Agents
that have crash dumps available or DLP
Agents that do not have a crash dump.
■ File System Driver: Filter DLP Agents
using the status of the file system drivers
on the agents.
■ Lotus Notes Plugin Status: Filter DLP
Agents which have Lotus Notes plug-ins
that have failed installation, been
repaired, or tampered with.
■ Outlook Plugin Status: Filter DLP
Agents which have Microsoft Outlook
plug-ins that have failed installation,
been repaired, or tampered with.
■ Reporting Status: Filter DLP Agents
that are either reporting or not.
■ Software Compatibility: Filter DLP
Agents according to their compatibility
with Endpoint Servers.

Uninstall Password ■ Is Any Of ■ Disabled: Filter DLP Agent on which the

■ Is None Of uninstall password is disabled.
■ Enabled: Filter DLP Agent on which the
uninstall password is enabled.
 Managing Symantec DLP Agents 1877
About Symantec DLP Agent administration

Table 79-6 Advanced filters and summarization (continued)

Primary filter Available conditions Secondary filter

User Name ■ Contains Ignore Case Enter the user name or search term that you
■ Does Not Contain Ignore want to use as a filter.
Case
■ Matches Exactly
■ Does Not Match Exactly
■ Matches Exactly Ignore
Case
■ Starts with
■ End with

Summary reports take their name from the summary criterion. If you rerun a report with new
criteria, the report name changes accordingly.
Table 79-7describes the columns that display in the summary report you create.

Table 79-7 Summary Reports details

Item Description

Summary criterion Identifies the items on which the report summarizes.

Total Lists the total number of agents that are associated

with the summary criteria.

Connection Status Lists the number of agents currently connected to

the network.

Health Status Lists the number of agents that are marked with an
OK, Warning, or Critical health status.

Configuration Status Lists the number of agents that are running a

current, outdated, or unknown version of the agent
configuration.

See “Agent Overview screen” on page 1863.

See “Using the Agent List screen” on page 1865.
See “About agent configurations” on page 1783.
See “About agent events” on page 1881.
 Managing Symantec DLP Agents 1878
About Symantec DLP Agent administration

Agent task confirmation screen

Depending on the agent task you selected, you may see one of the following confirmation
pages. Some of the confirmation pages request that you enter more information to complete
the task. Other confirmation pages only require you to confirm the task. The following table
describes the different agent overview task confirmation pages:

Table 79-8 Agent task confirmation pages

Task Page details

Delete Confirm that you want to delete the Symantec DLP

Agent.

Click OK to confirm the deletion.

Change Endpoint Server Enter the IP address or host name and port number
to change the Endpoint Servers your DLP Agents
report to.

See “Changing the Endpoint Prevent Server”

on page 1880.

Change Group Select an agent group to where you want to move

the selected agent.

The agent is moved to the selected group after the

agent connects to the Endpoint Server.

Restart Click OK to confirm that you want to restart the

Symantec DLP Agent.

Shut Down Confirm that you want to shut down the selected
agents. You must select one of the following
options:

■ Shut down the DLP Agent and do not restart

Agent if the endpoint computer restarts.
The Symantec DLP Agent remains shut down
if the endpoint computer restarts.
■ Shut down the DLP Agent and restart Agent if
the endpoint computer restarts.
The Symantec DLP Agent is shut down but
automatically restarts when the endpoint
computer restarts.

After the agent shuts down, you cannot restart it

from the Enforce Server administration console.

Select the shutdown option and then click OK.

 Managing Symantec DLP Agents 1879
About Symantec DLP Agent administration

Table 79-8 Agent task confirmation pages (continued)

Task Page details

Pull Logs Select the type of agent logs that you want, then
click OK. You can select one of the following types
of logs:

■ Service Logs
■ Operational Logs

You must select at least one type of log.

Disable Confirm that you want to disable the Symantec DLP

Agent. Disabling the agent does not delete it.

Click OK to confirm.
Note: After you disable an agent, configuration
updates and Endpoint Discover requests from the
Endpoint Server are not received.

Enable Confirm that you want to enable the Symantec DLP

Agent.

Click OK to confirm.
Note: After you enable the agent, restart it.
Restarting the agent ensures that you have the
latest policy, configuration updates, and Endpoint
Discover requests.

Reset Log Level Reset the logging level for a Symantec Data Loss
Prevention agent to the default INFO level.
Symantec Technical Support uses agent logs for
troubleshooting purposes.

Set Log Level Set the logging level for a Symantec Data Loss
Prevention agent. Symantec Technical Support
uses agent logs for troubleshooting purposes.
Note: It is recommended to contact Symantec
Technical Support before you change the log level
for an agent.

Set Under Investigation No confirmation page for this task.

Remove Under Investigation No confirmation page for this task.

Enable Uninstall Password Confirm that you want to enable the uninstall
password for the selected agent or agents.
 Managing Symantec DLP Agents 1880
About Symantec DLP Agent administration

Table 79-8 Agent task confirmation pages (continued)

Task Page details

Disable Uninstall Password Confirm that you want to disable the uninstall
password for the selected agent or agents. When
selected, the agent or agents status turns to
Warning.

Changing the Endpoint Prevent Server

The Change Endpoint Server task lets you change which Endpoint Prevent Servers your
DLP Agents report to. While performing this task, you can also define alternate Endpoint
Prevent Servers that the DLP Agents can connect to. The ability to define alternate Endpoint
Prevent Servers enables:
■ Redundancy in cases where the primary Endpoint Prevent Server goes offline.
■ DLP Agents to connect to other Endpoint Prevent Servers when the endpoint is located in
another geographic location or is moved to another policy group.
■ DLP Agents to connect to alternate Endpoint Prevent Servers if the maximum number of
DLP Agents are already connected to the primary Endpoint Prevent Server.
To change the Endpoint Prevent Servers that the DLP Agent reports to:
1 Enter the IP address or host name for the primary Endpoint Prevent Server.
2 Enter the port number for the primary Endpoint Prevent Server.

Note: Port values must be between 1 and 65535.

3 If you want to add an alternate Endpoint Prevent Server, click the plus sign (+) to add
another entry.
4 Enter the IP address or the host name for the alternate Endpoint Prevent Server.
5 Enter the port number for the alternate Endpoint Prevent Server.

Note: Port values must be between 1 and 65535.

6 If you want to add an additional alternate Endpoint Prevent Server, repeat step 3.
7 If you have added too many Endpoint Prevent Server entries, you can delete an entry by
clicking the minus sign (-) next to the entry.
8 If you are finished adding or changing the Endpoint Prevent Servers, click OK to submit
your changes.
 Managing Symantec DLP Agents 1881
About Symantec DLP Agent administration

About agent events

The Agent Events screen (Systems > Agents > Events) lists the events that have occurred
on agents. These events can include changes in the database file, connection, file-system
driver, and service. You can filter and summarize the event list and click on individual event
entries to see more details.
Event information is divided into several columns. Click any column header to sort entries
alpha-numerically in that column. To sort in reverse order, click the column header a second
time. By default, Symantec Data Loss Prevention lists events in order of the time they occurred.

Table 79-9 Agent Management Event screen

Entry Description

Type Displays the event type, which includes the following possible values:

■ Severe
■ Agent Information
■ OK

Time Displays the event date and time.

Machine Name Displays the endpoint IP address or host name.

Category Lists the event category, such as Agent Service Status, Connection Status,
File-System Driver, or data store.

Sub-Category Displays the event sub-category, such as Connection Active or Connection Closed.

You can click any event to display the agent event detail screen for that event.
See “Agent Event Detail screen” on page 1882.
You can summarize how items display on the Events screen based on the items listed in
Table 79-9. You can also filter the information that displays on the Events screen using a
number of criteria, including computer name, agent sub categories, information from the event
summary, and event type. Summarizing and filtering the events lets you view the agent data
in the order that you want. For example, you can summarize the agents by computer name
and then filter by the most recently updated agents.
You can delete agent events by selecting an event and clicking Delete.
See “About filters and summary options for reports” on page 1388.
See “Troubleshooting agent alerts” on page 1883.
 Managing Symantec DLP Agents 1882
About Symantec DLP Agent administration

Summarizing agent events

After you select and apply filtering and sorting criteria on the Events screen (System > Agents
> Events), the Events screen displays a summary that matches your selections.
You can click each column to sort agents. Click a number to display agents that fit the criteria.
The far left column displays the sort option you selected in the Summarize By list.

Table 79-10 Agent event summary

Column Description

Machine Name Displays the computer names.

Total Lists the number of connected agents.

Severe Lists the number of agents with a warning status.

Warning Lists the number of agents with a warning status.

Info Lists the number of events associated with the agent. Click this number
to display more information about the event or events.

Agent Event Detail screen

The Agent Event Detail screen displays all of the information available for the selected event.
This screen is not editable.

Table 79-11 Agent Event Detail screen

Section Title Options

General Type Indicates the general type of event that has occurred. The types
possible events include:

■ Severe
Indicates an error that requires immediate attention.
■ Warning
Indicates a problem that is not severe enough to generate an
error.
■ Info
Lists agent information.
■ Time
Provides the time the event occurred.
■ Machine Name
Provides the endpoint name.
 Managing Symantec DLP Agents 1883
About Symantec DLP Agent administration

Table 79-11 Agent Event Detail screen (continued)

Section Title Options

Message Provides details about the event.

■ Summary
A brief description of the event.
■ Detail
More description about the event.
■ Category
An event category such as Data Share, Connection Status,
File-System Driver, or Agent Service Status.
■ Sub-Category
The event sub-category such as Connection Active or Lost
Connection.
■ Extended Value
Any additional information about the event. For example, if a file
has been evicted from the data share, the file's metadata appears
in this field.

See “About agent events” on page 1881.

Troubleshooting agent alerts

The following section provides information on resolving agent alerts. You review agent alerts
on the Agent Overview screen.
See “Agent Overview screen” on page 1863.
■ Warning
See Table 79-12 on page 1884.
■ Critical
See Table 79-13 on page 1887.
Table 79-12 lists agent alert details and provides information to troubleshoot and resolve agent
issues that occur on Mac endpoints.
 Managing Symantec DLP Agents 1884
About Symantec DLP Agent administration

Table 79-12 Troubleshooting agents with Warning agent alert

Agent alert Cause Fix

DLP Outlook The Outlook plug-in was modified, To fix the issue:
plug-in disabled, or deleted.
■ Restart Outlook.
tampered with
■ Verify that the Outlook plug-in Outlook2k3 Addin is
enabled in Outlook.
■ Run Outlook for at least 15 seconds, then restart
Outlook.
■ Confirm that the Outlook plug-in Outlook2k3 Addin
is enabled.

DLP Outlook The Outlook plug-in installation failed. Run the AgentInstaller.msi manually to repair
plug-in the agent installation.
installation
failed

DLP Lotus The Lotus Notes plug-in was modified. To fix the issue:
Notes plug-in
■ Restart Lotus Notes.
tampered with
■ Uninstall the agent.
■ Restart the endpoint and install the agent.

DLP Lotus The Lotus Notes plug-in installation failed. Run the AgentInstaller.msi manually to repair
Notes plug-in the agent installation.
installation
failed

DLP AIM plug-in The AIM plug-in was modified or the plug-in To fix the issue:
tampered with installation failed.
■ Restart AIM.
■ Uninstall the agent.
■ Restart the endpoint and install the agent.

DLP AIM plug-in The AIM plug-in installation failed. Run the AgentInstaller.msi manually to repair
installation the agent installation.
failed

Active Directory Active Directory permissions conflict with Verify that the credentials that are passed to the agent
user group Symantec Data Loss Prevention have necessary permissions to extract logged-in user
resolution failed permissions. Also, Active Directory may information from Active Directory.
be missing attributes.
 Managing Symantec DLP Agents 1885
About Symantec DLP Agent administration

Table 79-12 Troubleshooting agents with Warning agent alert (continued)

Agent alert Cause Fix

Agent is The agent was disabled by the Start the Windows agent using the Agent List screen.
disabled by administrator who executed the Disable You can also start the agent by using the sc command.
enforce user troubleshooting task on the Agent List
See “Using the Agent List screen” on page 1865.
screen.
For Mac agents, you must use the agent_start tool to
start the agent.

See “Starting DLP Agents that run on Mac endpoints”

on page 1933.

Agent requires The administrator can either disable or Restart the agent on the Agent List screen.
restart enable data loss monitoring on endpoints
See “Using the Agent List screen” on page 1865.
by executing the Disable or Enable
troubleshooting task on the Agent List
screen. Monitoring is enabled by default
after the agent installation. However, when
the administrator executes the Enable or
Disable tasks and the agent is busy, the
agent status may not update, so the agent
remains in a Warning state.

Agent crash If the agent crashes, the Enforce Server To fix the issue:
dump available displays the Warning agent alert type. In
■ Shut down the agent on the Agent List screen.
on endpoint for this scenario, a log file is created that
See “Using the Agent List screen” on page 1865.
analysis Symantec Support can use to troubleshoot
■ Collect the crash dump files (*.dmp) from the path
why the agent crashed.
/AgentInstallDirectory/_MemDumpFiles/
Agent crashes can be caused by the on the respective endpoint.
following: ■ Delete the crash dump files.
■ Temporary environment issues ■ Restart the agent on the Agent List screen.
■ Unknown agent issues

If the agent crashes often, contact

Symantec support and provide the crash
dump files available at the path
/AgentInstallDirectory/_MemDumpFiles/
on the endpoint.
 Managing Symantec DLP Agents 1886
About Symantec DLP Agent administration

Table 79-12 Troubleshooting agents with Warning agent alert (continued)

Agent alert Cause Fix

Agent version is The agent is one or more versions older Upgrade the agent to the latest version.
older than than the Endpoint Server version to which
Enforce Server it connects. For example, if the Endpoint
version Server is version 15.0 and the agent is
version 14.6.x, that agent displays a
Warning agent alert. If the Endpoint Server
is version 14.6 and the agent is version
14.x, the agent displays an OK agent
status.

The features available in the Enforce and

Endpoint Server are not available for
agents with a Warning agent alert.

Agent group This alert occurs if the agent cannot collect To fix the issue:
attribute required data from Active Directory, which
■ Verify Active Directory attribute query syntax.
discovery failure prevents the Enforce Server from moving
■ Use AttributeQueryResolver.exe to test
the agent into an agent group. The agent
Active Directory queries that are defined in the
cannot collect data if there is an issue with
Enforce Server.
Active Directory permissions or if required
attributes are missing from Active See “About agent groups” on page 1849.
Directory.

Agent group The Endpoint Server automatically assigns To fix the issue:
conflicts the agent to an Agent Group depending
■ Review Agent Group settings.
on the endpoint attributes set during the
See “About agent groups” on page 1849.
Agent Group setup. If the endpoint meets
■ Re-create the agent group and use attributes that
multiple Agent Group conditions, the
satisfy the conditions of the agent.
Warning alert is thrown.

Agent Uninstall This alert occurs when the administrator To fix the issue, enable the agent uninstall password
Password is disables the agent uninstall password by by running the Enable Uninstall Password task on
Disabled running the Disable Uninstall Password the Agent List screen.
task the Agent List screen.
See “Using the Agent List screen” on page 1865.
 Managing Symantec DLP Agents 1887
About Symantec DLP Agent administration

Table 79-13 Troubleshooting agents with Critical agent alert

Agent alert Cause Fix

Agent is not The agent has not reported to an Endpoint To fix the issue:
reporting Server within the specified period of time.
■ Verify that the endpoint where the agent is installed
If the agent does not report after 18 hours,
exists. If it does not exist, you can delete the agent
then Symantec Data Loss Prevention
from the Enforce Server.
identifies the agent as not-reporting.
See “Using the Agent List screen” on page 1865.
Not-reporting agents do not receive the
■ Verify that the agent is running on the endpoint.
latest policies and configuration
information, so they are marked with a ■ Verify the network connection between the Endpoint
Critical agent alert. Server and the endpoint.

Agent version is The agent is two versions older than the Upgrade the agent to the latest version.
not supported Endpoint Server version to which it
connects. For example, if the Endpoint
Server is version 15.0 and the agent is
12.0.x, a Critical agent alert displays. The
features available in Enforce and Endpoint
Server are not available for these agents.
Symantec Data Loss Prevention identifies
these agents with a Critical alert because
these agents do not provide current
Symantec Data Loss Prevention features
and may not operate as designed.

File system The agent service cannot communicate To fix the issue:
driver is down with the Symantec Data Loss Prevention
■ Restart the endpoint.
driver installed on the endpoint.
■ Reinstall the agent.
Communication may not occur for the
following reasons:

■ The file system drivers have been

deleted.
■ Symantec Data Loss Prevention
identifies the driver as invalid. This
sometimes occurs when the driver has
been modified.
■ Communication between Symantec
Data Loss Prevention and the agent
driver is broken due to attack.
 Managing Symantec DLP Agents 1888
About Symantec DLP Agent administration

Table 79-13 Troubleshooting agents with Critical agent alert (continued)

Agent alert Cause Fix

Mac OS The DLP Agent monitors macOS Refer to http://www.symantec.com/docs/TECH235226

application is applications protected by System Integrity for information on monitoring SIP-protected
not monitored Protection (SIP) on macOS 10.11 through applications.
10.12. Updating the macOS version
beyond the supported version causes the
agent to no longer monitor applications
protected by SIP. The agent continues to
monitor all other channels.

About Symantec DLP Agent removal

You may need to uninstall the Symantec DLP Agent from your endpoints. You can uninstall
Symantec DLP Agents in the following ways:

Table 79-14 Removing the Symantec DLP Agent

Removing a DLP Agent from a Windows endpoint

Removing DLP Agents from Windows endpoints using system management software

Removing DLP Agents from Mac endpoints using system management software

Removing a DLP Agent from a Mac endpoint

Removing DLP Agents from Windows endpoints using system

management software
Follow this procedure if you elected to hide the Symantec Data Loss Prevention service from
the Add or Remove Programs list (ARP) during installation. Because the Symantec DLP Agent
does not appear in the ARP, you cannot use the ARP list for the uninstallation process. You
must use the MSI command to remove the Symantec DLP Agent. Only use the MSI command
uninstallation if you have hidden the Symantec DLP Agent from the ARP during installation.
 Managing Symantec DLP Agents 1889
About Symantec DLP Agent administration

To remove the agent with the MSI command

1 Open the command prompt window.
2 Enter the string:

msiexec /x AgentInstall_15_0.msi

You can add several different options to this command prompt.

3 Click OK.
The Symantec DLP Agent uninstalls.
To remove the agent manually if the agent does not appear in the ARP
1 Open the command prompt window.
2 Enter the following command where [guid] is the product code. You can locate the GUID
from the Windows registry or in the uninstall_agent.bat file.
You can add several other options to this command prompt:

msiexec /x {guid}

3 Enter any optional commands to the end of the command:

msiexec /x AgentInstall_15_0.msi

4 Click OK.
You can add options to the uninstall command such as SilentMode or Logname.
SilentMode allows the Symantec DLP Agent to uninstall without displaying a user interface
on the desktop. The installation takes place in the background of the workstation and is
not visible to the user. Logname Lets you set any log file you want. However, this option
is only available if you have the original installer present. If you do not have the original
installer, you must use the product code.
The code for a silent install is:

/QN:silentmode

The code for Logname is:

/L*V _logname

msi.exe has several other options. For further options, see your MSI guide.

See “About Symantec DLP Agent removal” on page 1888.

 Managing Symantec DLP Agents 1890
About Symantec DLP Agent administration

Removing DLP Agents from a Windows 7 endpoint

If you uninstall the agents from an endpoint that runs Windows 7, you must run the command
prompt in Elevated Command Prompt mode. This step is required because of the nature of
the Windows operating system. You cannot install the agent using the install_agent.bat
script without first using the Elevated Command Prompt mode.
To initiate the Elevated Command Prompt mode on Windows 7
1 Click the Start menu.
2 In the Search programs and files field, type command prompt.
The Command Prompt program appears in the results list.
3 Hold the Shift key and right-click the Command Prompt entry in the results list. Select
either Run as Administrator or Run as different user.
4 If you selected Run as different user, enter the credentials for a user that has administrator
privileges.
5 The command prompt starts in Elevated Command Prompt mode. Install the Symantec
DLP Agents on the endpoint using this command prompt.
See “About Symantec DLP Agent removal” on page 1888.

Removing a DLP Agent from a Windows endpoint

You can uninstall Symantec DLP Agents manually. Manual uninstallation is only possible if
you configured the Symantec DLP Agent to appear in the endpoint Add or Remove Programs
list during deployment.

Note: You uninstall Windows 7/8/8.1 agents in Elevated Command Prompt mode.

To uninstall the agent manually

1 Go to Start > Control Panel and double-click Add or Remove Programs.
2 Select Agent Install.
3 Click Remove.
See “About Symantec DLP Agent removal” on page 1888.

Removing DLP Agents from Mac endpoints using system management

software
Use the following steps to remove DLP Agents from Mac endpoints using your system
management software (SMS).
 Managing Symantec DLP Agents 1891
About DLP Agent logs

To remove the agent

1 Locate the uninstall_agent command and copy it to a temporary location on the endpoint.
This tool is located in the Symantec_DLP_15.0_Agent_Mac-IN.zip file.
2 Add the uninstall command to your SMS.
sudo / /tmp/uninstall_agent -prompt=n

/rm -f /tmp/uninstall_agent

Replace /tmp with the location where the uninstall_agent command is located.
3 Identify agents to be uninstalled and run the uninstallation.

Removing a DLP Agent from a Mac endpoint

You can uninstall the Mac DLP Agent by running the uninstaller tool from the default agent
installation location: /Library/Manufacturer/Endpoint Agent.
To uninstall the DLP Agent from Mac endpoints
1 Open the Terminal app.
2 Run this command:
$sudo ./uninstall_agent

Note: You can review uninstall logs on the Terminal application by running this command:
sudo ./uninstall_agent -prompt=no -log=console. By default, logs are saved to the
uninstall_agent.log file

About DLP Agent logs

DLP Agent logs contain service and operational data for every DLP Agent. Each DLP Agent
has multiple components that are logged. The amount of information that is logged can be
configured by setting the log level for each DLP Agent component. After the log level for an
DLP Agent component has been configured, the log can be collected and sent to Symantec
Support. Symantec Support can use the log to troubleshoot a problem or to improve
performance for a Symantec Data Loss Prevention Endpoint installation.
See “Setting the log levels for an Endpoint Agent” on page 1892.
See “Collecting server logs and configuration files” on page 306.
 Managing Symantec DLP Agents 1892
About DLP Agent logs

Setting the log levels for an Endpoint Agent

You can configure the amount of data that is logged for an agent by specifying the log level
for each agent component. Symantec Technical Support can use this data to troubleshoot or
improve performance for a Symantec Data Loss Prevention Endpoint installation.
See “About DLP Agent logs” on page 1891.

Note: Symantec recommends that you contact Support before changing a log level for an
agent.

To set the log levels for an agent

1 From the Enforce Server administration console, navigate to System > Agents >
Overview.
2 Click an agent status.
3 Select an agent.
4 Select Troubleshoot > Set Log Level for current DLP Agents.
5 Select a log level from the Log level pull-down list.
6 If you want to change the log level for all of the components for this agent, select All Agent
Logger Components.
7 If you change the log level for specific components of this agent, enter each component
name into the provided field. When entering multiple component names, use a comma
to separate each component name. Component names cannot exceed 255 characters.
8 Click OK to save your changes.
The Agent List screen displays an icon next to the agent to indicate the log level change.
It is recommended that you reset the agent log levels to the default settings after troubleshooting
completes. Only general information about the agent is logged after the log levels are reset.
To reset the log levels for all the components of an Endpoint Agent to the default logging level
1 From the Enforce Server administration console, navigate to System > Agents >
Overview.
2 Click an agent status.
3 Select an agent.
4 Select Troubleshoot > Reset Log Level.
The Agents Overview screen displays an icon next to the agent to indicate the updated
the log level.
 Managing Symantec DLP Agents 1893
About agent password management

About agent password management

You use the Agent Password Management screen (System > Agents > Agent Passwords)
to add or change the DLP Agent uninstallation password and Endpoint tools password. The
uninstallation password prevents unauthorized users from removing the Symantec DLP Agent.
The Endpoint tools password grants access to various agent management tools.

Note: Only administrators with the Server Administrator role can use the Agent Password
Management screen. See “Manage and add roles” on page 110.

When you create or change a password, the password is applied to the agents when they
connect to the Endpoint Server. Likewise, uninstall passwords or Endpoint tools passwords
that are created during the agent packaging process are retained until the agents connect to
the Endpoint Server.
You can disable the uninstall password for select agents on the Agent List screen. See “Using
the Agent List screen” on page 1865.
You can use the Agent Password Management screen to complete the following agent
password-related tasks:
■ Create a new uninstall or Endpoint tools password if one was not created during the agent
packaging process.
See “Create a new agent uninstall or Endpoint tools password” on page 1893.
■ Change an existing uninstall password or Endpoint tools password.
See “Change an existing agent uninstall or Endpoint tools password” on page 1894.
■ Retain a password created during the agent packaging process. You can choose whether
or not to publish an uninstall password or Endpoint tools password to newly added agents
by de-selecting the checkbox for each password.
See “Retain existing agent uninstall or Endpoint tools passwords” on page 1894.
See “About agent password management”on page 1923 on page 1923.

Create a new agent uninstall or Endpoint tools password

You create a new agent uninstall or Endpoint tools password using the Agent Password
Management screen. The new password is applied to all agents, including those subsequently
installed.

Note: The process overwrites all previously applied passwords.

 Managing Symantec DLP Agents 1894
About agent password management

Complete the following steps to create a new password:

1. Click Configure on the Agent Password Management screen.
2. Select a checkbox corresponding with the password you want to change:
■ Apply New Uninstall Password
■ Apply New Tools Password
You can select both check boxes to change both passwords simultaneously.

3. Enter and confirm the password.

4. Click Save to apply the new password.
See “About agent password management” on page 1893.
See “About agent password management”on page 1923 on page 1923.

Change an existing agent uninstall or Endpoint tools password

You can change the agent uninstall or Endpoint tools passwords at any time. When you change
a password using the Agent Password Management screen, you overwrite all passwords
that were previously applied. You also overwrite passwords for newly added agents. The
password is applied to all agents.

Complete the following steps to change an existing password:

1. Click Configure on the Agent Password Management screen.
2. Enter and confirm the new password.
3. Click Save to apply the new password.
See “About agent password management” on page 1893.
See “About agent password management”on page 1923 on page 1923.

Retain existing agent uninstall or Endpoint tools passwords

You can retain existing agent uninstall or Endpoint tools passwords to fit your business needs.
You can retain passwords that were applied during the agent packaging process by preventing
the Agent Password Management screen from apply passwords to all agents.
When you retain existing passwords, agents use the passwords added during the agent
packaging process. If an uninstallation password was not used during the agent packaging
process, the agents remain without an uninstallation password. Passwords previously added
using the Agent Password Management screen remain in effect.

Complete the following steps to retain passwords:

1. Click Configure on the Agent Password Management screen.
 Managing Symantec DLP Agents 1895
About agent password management

2. Clear the checkbox corresponding with the password you want to retain:
■ Apply New Uninstall Password
■ Apply New Tools Password
You can select both check boxes to retain both passwords.

3. Click Save.
See “About agent password management” on page 1893.
See “About agent password management”on page 1923 on page 1923.
 Chapter 80
Using application
monitoring
This chapter includes the following topics:

■ About monitoring applications

■ About adding applications

■ Adding a Windows application

■ Adding a macOS application

■ Ignoring macOS applications

■ About Application File Access monitoring

■ Implementing Application File Access monitoring

About monitoring applications

Symantec Data Loss Prevention enables you to monitor applications for CD/DVD burning, IM,
email, or HTTP/S clients. By default, Symantec Data Loss Prevention monitors applications
such as Apple iTunes, Microsoft Outlook, or Mozilla Firefox. You use the Application Monitoring
screen (System > Agents > Application Monitoring) to review and change application
monitoring settings.
You can use monitor settings to control how and if the DLP Agent monitors the following
activities:
■ Data moving across the network
■ Data being printed or faxed
■ Data moving to and from an endpoint Clipboard
 Using application monitoring 1897
About monitoring applications

■ Data moving to applications

■ Data moving to the cloud using cloud sync applications
■ Data being written to a CD or DVD
■ Data moving between USB, network share, and local disks and an application
You can add applications your company uses that are not listed on the Application Monitoring
page. For example, if you want to monitor Trillian, you can add the application to the Application
Monitoring page. After you add Trillian, Symantec Data Loss Prevention monitors the files sent
by the client over the network.

Note: You can remove any application that you add, but you cannot remove a system-provided
application.

See “Adding a Windows application” on page 1902.

See “Adding a macOS application” on page 1906.
See “List of CD/DVD applications” on page 1900.
See “Implementing Application File Access monitoring” on page 1911.
See “Mac agent Application Monitoring features” on page 1730.

Changing application monitoring settings

You can configure global changes to the applications that display by default on the Application
Monitoring screen. You can associate blacklist or whitelist metadata to network monitoring,
CD/DVD applications, and the applications that use print/fax or Clipboard functions. You can
also specify if you do not want Symantec Data Loss Prevention to monitor applications for
network, print/fax, Clipboard, or file system activities. For example, you may want to exclude
Clipboard activities on Microsoft Outlook. You would edit the settings for Microsoft Outlook to
exclude Clipboard activity on the Application Information screen.
To change application monitoring settings:
1 Locate and click the application for which you want to change settings.
2 Select an item in the Application Type section.
■ Generic
■ CD/DVD
■ Cloud Storage
You can only make changes to this selection if you are modifying a user-defined application.
 Using application monitoring 1898
About monitoring applications

3 Select items in the Application Monitoring Configuration section:

Destinations Removable Monitors data moving between removable storage

Storage devices and the application.

Print/Fax Monitors data that is printed or faxed.

Local Drives Monitors data moving between local disks and an

application.

Clipboard Clipboard, Monitors data that is copied to the endpoint

Copy Clipboard.
Note: If you have enabled HTTPS monitoring for
Google Chrome, it is recommended that you leave
Paste monitoring disabled to prevent duplicate
incidents. Enabling HTTPS monitoring for Google
Chrome automatically enables Clipboard Paste
monitoring.

Clipboard, Monitors data pasted from the Clipboard.

Paste

Web HTTP Monitors data moved over the network via HTTP.

FTP Monitors data moved over the network via FTP

 Using application monitoring 1899
About monitoring applications

Application file access
Application Select Application file access, Open to monitor
file access, the files that the application opens.
Open
Select the File Open option only if the application
hangs or crashes.

When this option is selected, the application does

not open a file if it contains sensitive information.
However, Symantec Data Loss Prevention scans
the file regardless of whether the application reads
the content, which decreases performance.
Note: If you have enabled HTTPS monitoring for
Google Chrome, it is recommended that you leave
this setting disabled to prevent duplicate incidents.
Enabling HTTPS monitoring for Google Chrome
automatically enables application monitoring.

See “About Application File Access monitoring”

on page 1910.

Application Select the Application file access, Read option

file access, to monitor file contents when the application reads
Read the file. This selection is recommended because
it provides better performance.

Network Shares Copy to Select to monitor the files copied between a

Network network share and an application.
Shares

4 Select Provide this application encrypted content when reading ICE files in the
Information Centric Encryption section to allow the application to read encrypted files
copied to a removable storage device.

Note: This option only applies to Windows applications.

If this option is disabled for an application, and the application is used to download a
pre-encrypted file to a removable storage device, then the application appends an additional
.html extension to this file name. In this scenario, you manually remove the additional
HTML extension from the file name. As a best practice, Symantec recommends that you
select the Provide this application encrypted content when reading ICE files option
for all the applications.
5 Save your changes.
6 Restart the application to be monitored. Restarting the application ensures that application
monitoring is not interrupted.
 Using application monitoring 1900
About monitoring applications

See “About monitoring applications” on page 1896.

Monitoring instant messenger applications on Mac endpoints

Symantec Data Loss Prevention can monitor data pasted to IMs and files uploaded through
IM applications.
The Skype and Cisco Jabber macOS instant messenger applications are provided on the
Application Monitoring screen by default. You can add additional instant messenger
applications. See “Adding a macOS application” on page 1906.
To monitor instant messenger applications
1 Enable the Paste channel to monitor on the Agent Configuration screen.
See “Enable Monitoring settings” on page 1785.
2 Select Clipboard, and select Paste for the instant messenger application you want to
monitor on the Application Monitoring screen.
See “Changing application monitoring settings” on page 1897.

List of CD/DVD applications

The following table lists the CD/DVD burning applications that are provided on the Application
Monitoring screen by default. You cannot delete any of the default burning applications. If
you have a CD/DVD burning software application not listed on this screen, you can add it. See
“Adding a Windows application” on page 1902.
The table contains a list of the brand names of the third-party CD/DVD burning software as
well as the binary name of the specific versions.

Table 80-1 Brand names and binary names of CD/DVD burning software

Brand name Binary name

BsCLIP BsCLiP.exe

B's Recorder GOLD BSGOLD.exe

BurnAware burnaware_data.exe

CheetahBurner CheetahBurner.exe

CommandBurner CmdBurn.exe

CopyToDVD c2cman.exe

CopyToDVD DVD copytocd.exe

Creator 10 Creator10.exe
 Using application monitoring 1901
About adding applications

Table 80-1 Brand names and binary names of CD/DVD burning software (continued)

Brand name Binary name

DeepBurner DeepBurner.exe

GEAR for Windows gear.exe

Mkisofs mkisofs.exe

Nero nero.exe

NeroStartSmart NeroStartSmart.exe

RecordNow RecordNow.exe

Roxio Creator.exe

Roxio_Central Roxio_Central.exe

Roxio5 Creatr50.exe

Roxio Mediahub Mediahub.exe

SilentNight Microburner microburner.exe

StarBurn StarBurn.exe

Note: When you use a CD/DVD writer, small text files of less than 64 bytes are not detected
during a burn to ISO. Text files over 64 bytes in size are detected normally.

About adding applications

You can use the Application Information screen to add applications to monitoring policies.
By default, DLP Agents monitor Clipboard, print, network (HTTP and FTP), and file system
(removable disc, local drive, and network share) activity on all applications. You add applications
when you want DLP Agents to monitor files that applications open or read. You can also add
applications when you want to prevent Symantec Data Loss Prevention from monitoring the
application.
The following table lists the types of applications you can add:

Table 80-2 Application types you can add

Application type Example

CD/DVD InfraRecorder
 Using application monitoring 1902
Adding a Windows application

Table 80-2 Application types you can add (continued)

Application type Example

Internet browsers Opera

IM Viber

SMTP Mozilla Thunderbird

Cloud sync SpiderOak

See “Adding a Windows application” on page 1902.

See “Adding a macOS application” on page 1906.

Adding a Windows application

You can add Windows applications to be monitored that are not already listed on the
Application Monitoring screen.
See “About adding applications” on page 1901.
Adding an application
1 Go to System > Agents > Application Monitoring.
2 Click Add Application, Windows to display the Application Information screen.
 Using application monitoring 1903
Adding a Windows application

3 Enter information.
In addition to the Name field, you must enter information in at least one of either the Binary
Name, Internal Name, or Original Filename fields.

Note: If you plan to add a Windows 10 (Windows apps) application, you enter the
application package ID in the Internal Name and leave the Binary Name, Original
Filename, and Publisher Name fields blank. Entering details in these fields may cause
the DLP Agent to stop monitoring the application after a system upgrade.

See “Using the GetAppInfo tool” on page 1905.

Name Enter the application name. You must enter information in this field.

Binary Name Enter the binary file name. Include an escape character (\) between the application
name and the file extension. For example, if you want to add Firefox, you enter
firefox\.exe.

Internal Enter the application name.

Name

Original Enter the application file name. Include an escape character (\) between the
Filename application name and the file extension. For example, if you plan to add Firefox,
you enter firefox\.exe.

Publisher Enter a publisher name. This field is optional.

Name
If you enter the Publisher Name, you can choose to select the Verify publisher
name option. This option ensures that the publisher name of the application is
correct. Using the Verify publisher name option may affect performance as it
increases system resources.

Additionally, you can add details about the publisher name for the application. The
publisher name details the maker of the software. Adding the publisher name lets
Symantec Data Loss Prevention verify the application even if the binary name has
been changed. Primarily, the publisher name is used for identifying Symantec
processes. However, you can add the publisher name for any of your applications.
Adding the publisher name is optional.

4 Select an item in the Application Type section.

■ Generic
■ CD/DVD
■ Cloud Storage
 Using application monitoring 1904
Adding a Windows application

5 Select items in the Application Monitoring Configuration section:

Destinations Removable Monitors data moving between removable storage

Storage devices and the application.

Print/Fax Monitors data that is printed or faxed.

Local Drives Monitors data moving between local disks and an

application.

Clipboard Clipboard, Monitors data that is copied to the endpoint

Copy Clipboard.
Note: If you have enabled HTTPS monitoring for
Google Chrome, it is recommended that you leave
Paste monitoring disabled to prevent duplicate
incidents. Enabling HTTPS monitoring for Google
Chrome automatically enables Clipboard Paste
monitoring.

Clipboard, Monitors data pasted from the Clipboard.

Paste

Web HTTP Monitors data moved over the network via HTTP.

FTP Monitors data moved over the network via FTP

 Using application monitoring 1905
Adding a Windows application

Application file access
Application Select Application file access, Open to monitor
file access, the files that the application opens.
Open
Select the File Open option only if the application
hangs or crashes.

When this option is selected, the application does

not open a file if it contains sensitive information.
However, Symantec Data Loss Prevention scans
the file regardless of whether the application reads
the content, which decreases performance.
Note: If you have enabled HTTPS monitoring for
Google Chrome, it is recommended that you leave
this setting disabled to prevent duplicate incidents.
Enabling HTTPS monitoring for Google Chrome
automatically enables application monitoring.

See “About Application File Access monitoring”

on page 1910.

Application Select the Application file access, Read option

file access, to monitor file contents when the application reads
Read the file. This selection is recommended because
it provides better performance.

Network Shares Copy to Select to monitor the files copied between a

Network network share and an application.
Shares

6 Save your changes.

7 Restart the application to be monitored. Restarting the application ensures that application
monitoring is not interrupted.
See “About monitoring applications” on page 1896.

Using the GetAppInfo tool

You can use the GetAppInfo.exe tool to generate application information. You use this tool
when you add applications and use the Application Monitoring feature. The Application
Monitoring feature monitors data that users move to applications.
Locate this application in the SymantecDLPWinAgentTools_14.0.zip in the
DLP\Symantec_DLP_14_Win\14.0_Win\Endpoint\x86 or \x64 directory.
 Using application monitoring 1906
Adding a macOS application

To use the GetAppInfo tool:

1 Launch GetAppInfo.exe.
2 Enter the path to the application or click Browse and navigate to it.
3 Click Get Info.
The tool displays the following application information:
■ Comments
■ InternalName
■ CompanyName
■ LegalCopyright
■ ProductVersion
■ FileDescription
■ LegalTrademarks
■ PrivateBuild
■ FileVersion
■ OriginalFilename
■ SpecialBuild
■ PublisherName

4 Retain the application information the tool displays. You use the application information
when you add an application on the Application Monitoring screen.
See “Adding a Windows application” on page 1902.
See “About Application File Access monitoring” on page 1910.

Adding a macOS application

You can add macOS 64-bit applications to be monitored that are not already listed on the
Application Monitoring screen.
See “About adding applications” on page 1901.
Adding an application
1 Go to System > Agents > Application Monitoring.
2 Click Add Application, Mac to display the Application Information screen.
3 Enter information.
 Using application monitoring 1907
Adding a macOS application

In addition to the Name field, you must enter information in the Binary Name field. You
do not enter information in the Internal Name or Original Filename fields for macOS
applications.
■ Name
■ Binary Name
See “Defining macOS application binary names” on page 1909.

4 Select Generic in the Application Type section.

 Using application monitoring 1908
Adding a macOS application

5 Select items in the Application Monitoring Configuration section:

Note: Only the items listed in the table are supported for application monitoring on Mac
endpoints.

Destinations Removable Storage Monitors data moving between

removable storage devices and
the application.

Clipboard Clipboard, Paste Monitors data pasted from the

Clipboard.

Application file access Application file access, Open Select Application file access,
Open to monitor the files that
the application opens.

Select the File Open option only

if the application hangs or
crashes.

When this option is selected, the

application does not open a file
if it contains sensitive
information. However, Symantec
Data Loss Prevention scans the
file regardless of whether the
application reads the content,
which decreases performance.
Note: If you have enabled
HTTPS monitoring for Google
Chrome, it is recommended that
you leave this setting disabled
to prevent duplicate incidents.
Enabling HTTPS monitoring for
Google Chrome automatically
enables application monitoring.

See “About Application File

Access monitoring” on page 1910.

Network Shares Copy to Network Shares Select to monitor the files copied
between a network share and
an application.
 Using application monitoring 1909
Ignoring macOS applications

6 Save your changes.

7 Restart the application to be monitored. Restarting the application ensures that application
monitoring is not interrupted.

Defining macOS application binary names

When you want to monitor macOS applications, you add them to the Application monitoring
screen using the application binary names.

Note: Review support information for a summary of Clipboard monitoring features and support.
See “Clipboard features supported on Mac agents” on page 1728.

To define the application binary names for a macOS application:

1. Run the application to be monitored.
2. Launch the Activity Monitor application.
3. Enter the application name to be monitored in the search field at the top right.

Note: The DLP Agent only monitors Clipboard Paste operations for 64-bit macOS
applications. Confirm that the application you plan to add displays 64 bit in the Kind
column if you plan to monitor the Clipboard Paste channel.

4. Double click the application in the Process Name column to display a dialog. The dialog
provides memory, statistics, and open files and ports information for the application.
5. Click the Open Files and Ports tab to display details about the application.
6. Locate the line that display the complete path for the application. For example, the path
for Safari is /Applications/Safari.app/Contents/MacOS/Safari.
7. Locate and note the binary name following /MacOS/.
8. Enter the binary name in the Binary Name field on the System > Agents > Application
Monitoring screen.
See “Adding a macOS application” on page 1906.

Ignoring macOS applications

You can set Symantec Data Loss Prevention to ignore the macOS applications that hang or
crash as a result of being monitored. Usually you would only set Symantec Data Loss Prevention
to ignore the applications that your company identifies as business critical. Ignoring these
 Using application monitoring 1910
About Application File Access monitoring

types of applications ensures that they function properly. However, ignoring applications allows
for potential data leaks as well.

Note: By default, Microsoft Excel and Adobe Reader are ignored from monitoring on Mac
endpoints.

To ignore macOS applications from being monitored:

1 Record the application name and the binary name of the application you want Symantec
Data Loss Prevention to ignore.
To obtain this information, open the application on a Mac endpoint and locate the required
information on the Activity Monitor screen.
2 Go to System > Agents > Application Monitoring.
3 Click Add Application.
4 Enter the application name in the Name field.
5 Enter the binary name in the Binary Name field.
6 Select Generic in the Application Type list. You do not make any other selections.
7 Leave all other selections disabled.
8 Save your changes.
Symantec Data Loss Prevention ignores the specified application immediately after you
save your changes.

About Application File Access monitoring

When you enable the Application File Access feature, the DLP Agent monitors data leaving
applications on endpoints. You enable this feature by adding the protocol that is labeled Protocol
or Endpoint Monitoring protocol and setting response rules in a policy. You then enable the
Application File Access feature in the agent configuration.

Note: You cannot use the Application File Access feature to monitor inline data transfers using
browsers (HTTPS) or instant messenger.

You can enable default applications on the Application Monitoring screen. You can also set
Symantec Data Loss Prevention to monitor the applications not found on the Application
Monitoring screen by adding them.
If a user transfers a file containing sensitive information, a notification displays on the endpoint.
Depending on your policies and Endpoint Prevent response, access to the file will be denied.
You can review Application File Access incidents on the Incidents > Endpoint screen.
 Using application monitoring 1911
Implementing Application File Access monitoring

See “Implementing Application File Access monitoring” on page 1911.

See “Adding and editing agent configurations” on page 1784.
See “Adding a Windows application” on page 1902.

Implementing Application File Access monitoring

You complete a number of steps to implement the Application File Access feature. See
Table 80-3 on page 1911.
Enabling the feature potentially affects application performance on endpoints. You can use
environment variables in path filters to specify file locations to monitor, which helps application
performance.
See “Using environment variables in Endpoint Discover scans” on page 1774.

Table 80-3 Implementing Application File Access

Step Action Description

1 Create a new policy or update an existing policy. You enable the Protocol or Endpoint
Monitoring protocol, then select
options to configure Application File
Access.

See “Configuring policy rules”

on page 380.

2 Set response rules for the policy. See “Manage response rules”
on page 1219.

3 Create a policy group that is deployed to an Endpoint Server. See “Policy groups” on page 331.

4 Enable the Application File Access feature in the endpoint Use environment, file, and folder filters
configuration. to optimize file monitoring
performance. The Application File
Access feature monitors every file that
an application opens or reads, which
can reduce application performance
and create false positives. You can
use environment variables to specify
locations where sensitive data is
potentially located.

See “Adding and editing agent

configurations” on page 1784.

See “Configuring file filters”

on page 1789.
 Using application monitoring 1912
Implementing Application File Access monitoring

Table 80-3 Implementing Application File Access (continued)

Step Action Description

5 Add an application to the Application Monitoring screen. Many applications are listed in the
Application Monitoring screen. If you
add an application, you must enable
the Monitor Application File Access
feature and select an activity to
monitor, either Read or Open.

See “Adding a Windows application”

on page 1902.
 Chapter 81
Working with Endpoint
FlexResponse
This chapter includes the following topics:

■ About Endpoint FlexResponse

■ Deploying Endpoint FlexResponse

■ About deploying Endpoint FlexResponse plug-ins on endpoints

■ Deploying Endpoint FlexResponse plug-ins using a silent installation process

■ About the Endpoint FlexResponse utility

■ Deploying an Endpoint FlexResponse plug-in using the Endpoint FlexResponse utility

■ Enabling Endpoint FlexResponse on the Enforce Server

■ Uninstalling an Endpoint FlexResponse plug-in using the Endpoint FlexResponse utility

■ Retrieving an Endpoint FlexResponse plug-in from a specific endpoint

■ Retrieving a list of Endpoint FlexResponse plug-ins from an endpoint

About Endpoint FlexResponse

Symantec Data Loss Prevention provides a set of response rule actions that you can specify
to remediate an incident. These provided actions include logging, sending an email, blocking
an end-user action, notifying a user, and other responses.
You can also use Endpoint FlexResponse plug-ins to provide additional response actions.
These plug-ins contain custom instructions for remediation actions that are executed on
endpoints. Endpoint FlexResponse rules are only applicable to Automated Response rules.
You cannot create Endpoint FlexResponse rule actions for Smart Response rules.
 Working with Endpoint FlexResponse 1914
About Endpoint FlexResponse

Symantec Data Loss Prevention customers can contact Symantec or Symantec partners to
obtain Endpoint FlexResponse plug-ins. In addition, developers with a knowledge of the Python
programming language can create custom Endpoint FlexResponse plug-in scripts using a
Symantec-provided API. These custom remediation actions can include encryption, applying
Digital Rights Management (DRM), or redacting confidential information.
You use the Endpoint FlexResponse utility to deploy Endpoint FlexResponse plug-ins on
endpoints in your Symantec Data Loss Prevention deployment where you require Endpoint
FlexResponse actions. You can deploy the plug-ins manually using the Endpoint FlexResponse
utility, or you can use system management software (SMS) to distribute the utility and deploy
the plug-ins. After you deploy an Endpoint FlexResponse plug-in on an endpoint, you use the
Enforce Server administration console to add an Endpoint: FlexResponse action to a response
rule, and then you add the response rule to an active policy.
Figure 81-1 shows the sequence of activities that result in an Endpoint FlexResponse action.

Figure 81-1 Endpoint FlexResponse plug-in process

Symantec DLP Agent

Python
Policy plug-in
script
Response
rule
The plug-in process calls
Detection the getMetadata()
rules and Execute() methods
Endpoint
defined in the Python
Flex-
End-user script and performs the
Response
violates a custom remediation on
action
policy the endpoint computer.

The Detection server The plug-in process

sends an incident and reports the result of
the remediation status the remediation to
to the Enforce Server. the detection server.
Enforce Server Detection server Local disk

You can use Endpoint FlexResponse rules on the following types of endpoint destinations and
protocols:
■ Endpoint Discover

Note: Endpoint FlexResponse is currently unavailable for Endpoint Discover scans that
run on Mac agents.
 Working with Endpoint FlexResponse 1915
Deploying Endpoint FlexResponse

■ Local drive monitoring

■ Removable storage devices
■ SMTP
■ HTTP(S)

Deploying Endpoint FlexResponse

Follow the steps provided here to deploy Endpoint FlexResponse plug-ins.

Table 81-1 Deploying Endpoint FlexResponse

Step Action Description

Step 1 Obtain (or create) an Endpoint Contact a Symantec partner or Symantec

FlexResponse plug-in zip file. sales representative.

Endpoint FlexResponse plug-ins are not

available with the default Symantec Data
Loss Prevention installation.

Step 2 Configure any Endpoint credentials on the See “Configuring endpoint credentials”
Enforce Server. on page 146.

This step is optional.

Step 3 Deploy the plug-in to your endpoints using See “About deploying Endpoint
the Endpoint FlexResponse utility and FlexResponse plug-ins on endpoints”
third-party systems management software on page 1915.
(SMS).

Step 4 Enable Endpoint FlexResponse actions on See “Enabling Endpoint FlexResponse on

your Enforce Server. the Enforce Server” on page 1920.

Step 5 Add Endpoint FlexResponse actions to your See “Adding a new response rule”
response rules. on page 1220.

About deploying Endpoint FlexResponse plug-ins on

endpoints
You must install Symantec DLP Agents on the endpoints before deploying Endpoint
FlexResponse plug-ins. The Agents must be connected to an active Endpoint Server.
See the Symantec Data Loss Prevention Installation Guide for information on how to install
the agents.
 Working with Endpoint FlexResponse 1916
Deploying Endpoint FlexResponse plug-ins using a silent installation process

You must deploy Endpoint FlexResponse plug-ins on each endpoint where you require Endpoint
FlexResponse actions. You can use a manual installation or a silent installation method to
deploy the plug-in. Silent installation methods involve using systems management software
(SMS), to distribute and install software on all of your endpoints. You may need to create SMS
scripts to access the installation folder.
This section assumes that you have created or otherwise obtained an Endpoint FlexResponse
plug-in that is packaged as a ZIP file.
Deploying an Endpoint FlexResponse plug-in on endpoints requires the following steps:

Step 1 Copy the Endpoint FlexResponse utility to your endpoints.

See “About the Endpoint FlexResponse utility” on page 1917.

Step 2 Copy any third-party Python modules that your plug-in requires to your endpoints.

Step 3 Enable Endpoint FlexResponse on the Enforce Server. See “Enabling Endpoint
FlexResponse on the Enforce Server” on page 1920.

Step 4 Deploy the Endpoint FlexResponse plug-in using the Endpoint FlexResponse utility.
(flrinst.exe). Use one of the following options:

■ Deploy your plug-in manually on a single endpoint. This option is most useful
when you are developing or testing an Endpoint FlexResponse plug-in.
See “Deploying an Endpoint FlexResponse plug-in using the Endpoint
FlexResponse utility” on page 1919.
■ Deploy your plug-in using a silent installation process and SMS software. This
option is most useful when you are deploying a production-ready Endpoint
FlexResponse plug-in.
See “Deploying Endpoint FlexResponse plug-ins using a silent installation
process ” on page 1916.

Step 5 Create response rules that use Endpoint: FlexResponse actions that reference
the plug-in, and add these rules to an active policy.

See "Implementing policy detection" in the Symantec Data Loss Prevention System
Administration Guide.

Deploying Endpoint FlexResponse plug-ins using a

silent installation process
You can use system management software (SMS) to deploy Endpoint FlexResponse plug-ins
on multiple endpoints. Although the details of creating installation scripts for SMS software
are beyond the scope of this document, note the following requirements:
 Working with Endpoint FlexResponse 1917
About the Endpoint FlexResponse utility

■ You must install Symantec DLP Agents on the endpoints before deploying Endpoint
FlexResponse plug-ins. The Agents must be connected to an active Endpoint Server.
■ You must install the Endpoint FlexResponse utility (flrinst.exe) on each endpoint where
you will deploy Endpoint FlexResponse plug-ins.
■ You must make the Endpoint FlexResponse package ( a .zip file) available to each
endpoint. You can copy the package to each endpoint, or you can make the package
available on a network drive that is accessible by all endpoints.
■ To deploy your plug-in, use the command-line options of the Endpoint FlexResponse utility
when creating your installation scripts. See Table 81-3 on page 1918.
■ Remove the Endpoint FlexResponse utility after deploying your plug-in. If you leave the
utility installed on the endpoints, a malicious user could use the utility to uninstall or alter
your Endpoint FlexResponse plug-in.
See “About the Endpoint FlexResponse utility” on page 1917.
See your individual SMS application documentation for more information on how to deploy
using SMS.
The Endpoint FlexResponse utility is only available through Symantec and Symantec partners.
It is not included with the Symantec Data Loss Prevention distribution.

About the Endpoint FlexResponse utility

You use the Endpoint FlexResponse utility to manage Endpoint FlexResponse plug-ins. The
Endpoint FlexResponse utility is not part of the default Symantec Data Loss Prevention
download and is only available through Symantec or Symantec partners.
Before you run the utility, package your Python scripts into a single ZIP file.

Table 81-2 Endpoint FlexResponse utility actions

Action Description

Deploy (Install) plug-ins Use the install option to deploy plug-ins on an

endpoint.

Uninstall plug-ins Use the uninstall option to uninstall plug-ins

from an endpoint.

Retrieve deployed plug-ins Use the retrieve option to retrieve a specific

plug-in that has already been deployed on an
endpoint.
 Working with Endpoint FlexResponse 1918
About the Endpoint FlexResponse utility

Table 81-2 Endpoint FlexResponse utility actions (continued)

Action Description

See a list of deployed plug-ins Use the list option to retrieve a list of all plug-ins
that are deployed on a specific endpoint. The list
contains the names of the deployed plug-ins.

The Endpoint FlexResponse utility must be run from the folder where the Symantec DLP Agent
is deployed. The location of this folder is configurable. By default, the directory is located at:
c:\Program Files\Manufacturer\Endpoint Agent\

The name of the utility is flrinst.exe. The utility uses the following syntax:
flrinst.exe -op=install|uninstall|retrieve|list -package=<package_name>
-p=<Tools_password>

Table 81-3 Endpoint FlexResponse Utility options

Option Description

-op=install|uninstall|retrieve|list Use one of the following arguments:

■ install—deploys a plug-in
■ uninstall—removes a plug-in
■ list—displays a list of deployed plug-ins
■ retrieve—retrieves a plug-in and saves it as
an editable text file. The text file is contained in
a ZIP file that is saved in the directory where the
utility was run.

-package=<package_name> When you specify the -op=install option,

specifies the path to the package (a ZIP file) that
contains the Endpoint FlexResponse plug-in. The
package name is case sensitive.

When you specify either the -op=retrieve or

-op=uninstall option, specifies the name of the
package.

-p=<tools_password> Specify the Tools password that has been

configured for your Symantec Data Loss Prevention
deployment.

If a Tools password has not been configured, use

the default password, "VontuStop".
Note: As of Symantec Data Loss Prevention version
11.1.1, the password is no longer optional.
 Working with Endpoint FlexResponse 1919
Deploying an Endpoint FlexResponse plug-in using the Endpoint FlexResponse utility

If you have created a Tools password for your Symantec Data Loss Prevention deployment,
pass this password to the Endpoint FlexResponse utility with the -p option. This password is
required to install and uninstall a plug-in. You configure a Tools password during Symantec
Data Loss Prevention installation. For more information, see the Symantec Data Loss Prevention
Installation Guide.
If you have not configured a Tools password, an end user can retrieve and modify
previously-installed plug-ins using the default password, VontuStop. Symantec recommends
that you configure a Tools password to prevent such tampering. Alternately, you can set your
SMS application to remove the Endpoint FlexResponse Utility after you have used it. Removing
the utility prevents any unauthorized modification or uninstallation of your plug-ins.

Deploying an Endpoint FlexResponse plug-in using

the Endpoint FlexResponse utility
You use the Endpoint FlexResponse utility to deploy Endpoint FlexResponse plug-ins. The
plug-ins must be in a .zip package format.
To deploy an Endpoint FlexResponse plug-in
1 On an endpoint, open a command window and navigate to the Symantec DLP Agent
installation tools directory. The default location of this directory is c:\Program
Files\Manufacturer\Endpoint Agent\

2 Enter the following command:

flrinst.exe -op=install
-package=<path_to_plug-in>
-p=<myToolsPassword>

Where:
■ <myToolsPassword> is the Tools password for your Symantec Data Loss Prevention
deployment. If you have not specified a Tools password, use the default password:
VontuStop.

■ <path_to_plug-in name> is the full path to the plug-in .zip file.

For example:
flrinst -op=install -package=c:\installs\myFlexResponse_plugin.zip
-p=myToolsPassword

See “Deploying Endpoint FlexResponse” on page 1915.

See “About the Endpoint FlexResponse utility” on page 1917.
 Working with Endpoint FlexResponse 1920
Enabling Endpoint FlexResponse on the Enforce Server

Enabling Endpoint FlexResponse on the Enforce

Server
Before you can use Endpoint FlexResponse plug-ins in your response rules, you must enable
Endpoint FlexResponse functionality through the Enforce Server. By default, Endpoint
FlexResponse functionality is not enabled. You enable Endpoint FlexResponse functionality
through the Advanced Agent Settings.
To enable Endpoint FlexResponse functionality
1 Open the Enforce Server administration console and navigate to: System > Agents >
Agent Configuration and open the Agent configuration that is currently applied to the
Endpoint Server that is connected to the Agents where you are deploying the Endpoint
FlexResponse plug-in.
2 Click the Advanced Agents Settings tab.
3 Find the PostProcessor.ENABLE_FLEXRESPONSE.int setting.
4 Change the setting to 1.
5 Click Save and Apply.
See “Adding a new response rule” on page 1220.
See “Deploying Endpoint FlexResponse” on page 1915.
See “About deploying Endpoint FlexResponse plug-ins on endpoints” on page 1915.

Uninstalling an Endpoint FlexResponse plug-in using

the Endpoint FlexResponse utility
To uninstall an Endpoint FlexResponse plug-in from an endpoint
1 On an endpoint, open a command window and navigate to the Symantec DLP Agent
installation directory. The default location of this directory is: c:\Program
Files\Manufacturer\Endpoint Agent.

2 Enter the following command:

flrinst.exe -op=uninstall
-package=<Plug-in name>
-p=<myToolsPassword>

Where:
■ <Plug-in name> is the name of the plug-in package .zip file.
 Working with Endpoint FlexResponse 1921
Retrieving an Endpoint FlexResponse plug-in from a specific endpoint

■ <myToolsPassword> is the Tools password for your Symantec Data Loss Prevention
deployment. If you have not specified a Tools password, use the default password:
VontuStop.

For example:

flrinst -op=uninstall -package=myFlexResponse_plugin.zip

-p=myToolsPassword

Retrieving an Endpoint FlexResponse plug-in from a

specific endpoint
Use the following procedure to retrieve a specific plug-in from an endpoint. You can only use
the retrieve function on a single endpoint at a time. The plug-in appears in the Symantec DLP
Agent installation directory as a .zip file. The plug-in script is a plain-text file that has a .py
extension and is located inside a .zip file.
You can edit the plug-in by editing the .py file. If you make edits, you must re-package the
ZIP file and re-deploy the plug-in to the endpoint before the edits take effect. Modified plug-ins
only affect the individual endpoints where they were modified.
To retrieve an Endpoint FlexResponse plug-in from a specific endpoint
1 On the endpoint, open a command prompt window and navigate to the Symantec DLP
Agent installation directory:
The default location of this directory is c:\Program Files\Manufacturer\Endpoint
Agent\

2 Enter the following command:

flrinst -op=retrieve -package=<Plug-in name> -p=<myToolsPassword>

Where:
■ <myToolsPassword> is the tools password for your Symantec Data Loss Prevention
deployment. If you have not specified a Tools password, use the default password:
VontuStop.

■ <plug-in name> is the name of the plug-in .zip file.

For example:
flrinst -op=retrieve -package=myFlexResponse_plugin.zip -p=myToolsPassword
 Working with Endpoint FlexResponse 1922
Retrieving a list of Endpoint FlexResponse plug-ins from an endpoint

Retrieving a list of Endpoint FlexResponse plug-ins

from an endpoint
Use the following procedure to retrieve a list of plug-ins that have been deployed on a specific
endpoint. You can only use the list function on individual endpoints. You cannot use the list
function on a set of endpoints.
The list of plug-ins contains only the name of the plug-in package. The list does not contain
any type of description about the plug-ins. Symantec recommends that you use descriptive
names for your plug-ins so that you can recognize them within the list.
To retrieve the list of Endpoint FlexResponse plug-ins from an endpoint
1 On an endpoint, open a command window and navigate to the Symantec DLP Agent
installation tools directory. The default location of this directory is c:\Program
Files\Manufacturer\Endpoint Agent\.

2 Enter the following command:

flrinst.exe -op=list -p=<myToolsPassword>

Where: <myToolsPassword> is the Tools password for your Symantec Data Loss Prevention
deployment. If you have not specified a Tools password, use the default password:
VontuStop.

For example:
flrinst -op=list -p=myToolsPassword

The list of deployed Endpoint FlexResponse plug-ins displays in the command window.
 Chapter 82
Using Endpoint tools
This chapter includes the following topics:

■ About Endpoint tools

About Endpoint tools

Symantec Data Loss Prevention provides a number of tools to help you work with Symantec
DLP Agents. See the Acquiring Symantec Data Loss Prevention Software document for
information on obtaining the files that contain these tools.
Move these tools to a secure directory. The Endpoint tools work with the keystore file that is
found in the Agent Install directory. The tools and the keystore file must be in the same folder
to function properly.

Note: Before you copy Endpoint tools to the Agent Install directory on Mac endpoints, change
the permissions for each tool to be executable. See “Using Endpoint tools with macOS”
on page 1926.

Each tool requires a password to operate. You enter the Endpoint tools password during the
agent packaging process. You can manage the Endpoint tools password using the Agent
Password Management screen.
See “About agent password management” on page 1893.
Table 82-1 lists some of the tasks that you can complete using endpoint tools:

Table 82-1
Task
Shut down the agent and the
watchdog services
Inspect database files that are
accessed by the agent
View extended log files
Generate device information
Generate third-party application
information
Using Endpoint tools 1924
About Endpoint tools
Endpoint tools task list
Tool name and location Additional information
service_shutdown See “Shutting down the agent and the
watchdog services on Windows
Available for Windows agents in the
endpoints” on page 1926.
Symantec_DLP_15.0_Agent_Win-IN.zip
file. See “Shutting down the agent service
on Mac endpoints” on page 1927.
Available for Mac agents in the
Symantec_DLP_15.0_Agent_Mac-IN.zip
file.
vontu_sqlite3 See “Inspecting the database files
accessed by the agent” on page 1927.
Available for Windows agents in the
Symantec_DLP_15.0_Agent_Win-IN.zip
file.
Available for Mac agents in
Symantec_DLP_15.0_Agent_Mac-IN.zip
file.
logdump See “Viewing extended log files”
on page 1928.
Available for Windows agents in the
.Symantec_DLP_15.0_Agent_Win-IN.zip
file.
Available for Mac agents in the
Symantec_DLP_15.0_Agent_Mac-IN.zip
file.
DeviceID.exe for Windows See “About the Device ID utilities”
removable devices. on page 1930.
Available for Windows agents in the
Symantec_DLP_15.0_Agent_Win-IN.zip
file.
DeviceID for Mac removable devices.
Available for Mac agents in the
Symantec_DLP_15.0_Agent_Mac-IN.zip
file.
GetAppInfo See “Using the GetAppInfo tool”
on page 1905.
Available for Windows agents in the
Symantec_DLP_15.0_Agent_Win-IN.zip
file.
 Using Endpoint tools 1925
About Endpoint tools

Table 82-1 Endpoint tools task list (continued)

Task Tool name and location Additional information

Start DLP Agents that are installed on start_agent See “Starting DLP Agents that run on
Mac endpoints Mac endpoints” on page 1933.
Available for Mac agents in the
AgentInstaller_Mac64.zip file.
This file is created after you complete
the agent installation package process.
Note: You must unzip this file to a
Mac endpoint. You cannot use the tool
if it is unzipped to a Windows endpoint.

See “Mac endpoint tools features” on page 1720.

Using Endpoint tools with Windows 7/8/8.1

If you use Endpoint tools on a computer that runs Windows 7/8/8.1, run the command prompt
in the Elevated Command Prompt mode. This procedure is required because of the nature of
the Windows operating system. You cannot run the Endpoint tools without using the Elevated
Command Prompt mode.
To initiate the Elevated Command Prompt mode on Windows 7
1 Click the Start menu.
2 In the Search programs and files field, enter command prompt.
The Command Prompt program appears in the results list.
3 Hold the Shift key and right-click the Command Prompt entry in the results list. Select
either Run as Administrator or Run as different user.
4 If you selected Run as different user, enter the credentials for a user that has administrator
privileges.
To initiate the Elevated Command Prompt mode on Windows 8/8.1
1 Display the Command Prompt.
■ In Desktop mode, right-click on the Windows icon and select Command Prompt
(Admin), then click the Start menu.
■ In Metro mode, enter cmd in the Search programs and files field.

2 Hold the Shift key and right-click Command Prompt in the results list.
3 Select Run as Administrator.
 Using Endpoint tools 1926
About Endpoint tools

Shutting down the agent and the watchdog services on Windows

endpoints
The Service_Shutdown.exe tool enables you to shut down the DLP Agent and watchdog
services on Windows endpoints. As a tamper-proofing measure, it is not possible for a user
to individually stop either the DLP Agent or watchdog service. This tool enables users with
administrator rights to stop both Symantec Data Loss Prevention services at the same time.
To run the Service_Shutdown.exe tool
◆ From the installation directory, run the following command:

service_shutdown [-p=password]

where the installation directory is the directory where you installed Symantec Data Loss
Prevention and [-p=password] is the password you previously specified. If you do not
enter a password, you are prompted to input a password. The default password is
VontuStop.
You must run the Service_Shutdown.exe tool from the same directory as the DLP Agent
keystore file.
See “About agent password management”on page 1923 on page 1923.

Using Endpoint tools with macOS

If you use Endpoint tools on an endpoint that runs macOS, change the permissions for each
tool to be executable. Complete this prerequisite step before you copy a tool to the agent
installation folder. The DLP Agent prevents permissions changes to files residing in the agent
installation folder. If you do not change permissions, you cannot run the Endpoint tool on
endpoints.
Complete the following to use Endpoint tools on Mac Endpoints:
1 Copy the Endpoint tool to the endpoint. For example, copy the tool to
/Users/<user-name>/Downloads/Tools/.
2 Set executable definitions by issuing a sudo command from the Terminal application.
For example, issue the following command if you want to set executable permissions for
the Service_Shutdown tool:
sudo chmod 755 service_shutdown

3 Copy the endpoint tool to the DLP Agent installation directory.

Repeat these steps for each Endpoint tool you plan to run.
See “About agent password management”on page 1923 on page 1923.
 Using Endpoint tools 1927
About Endpoint tools

Shutting down the agent service on Mac endpoints

The Service_Shutdown tool enables you to shut down the DLP Agent service on Mac endpoints.
As a tamper-proofing measure, users cannot stop the DLP Agent service on Mac endpoints.
However, an administrator with root access can use the Service_Shutdown tool to stop the
Symantec Data Loss Prevention service.
To stop the agent on Mac endpoints:
1 Set the Service_Shutdown tool permissions to be executable. See “Using Endpoint tools
with macOS” on page 1926.
2 Copy the Service_Shutdown tool to the DLP Agent installation folder on the Mac endpoint.
3 Run the following command as a root user using the Terminal application:

#sudo ./service_shutdown

-p=<tools_password>

See “About agent password management”on page 1923 on page 1923.

Inspecting the database files accessed by the agent

The vontu_sqlite3 tool enables you to inspect the database files that the DLP Agent uses.
It provides an SQL interface to query database files and update database files. Without this
tool, you cannot view the contents of a database file because it is encrypted. Use this tool
when you want to investigate or make changes to the Symantec Data Loss Prevention files.

Note: You must have administrator rights to use the tool on Windows endpoints. You must
have root or sudo access to make changes to the agent database on Mac endpoints.
 Using Endpoint tools 1928
About Endpoint tools

To run the vontu_sqlite3.exe tool on Windows endpoints

1 Run the following script from the Symantec Data Loss Prevention Agent installation
directory:

vontu_sqlite3 -db=database_file [-p=password]

where database_file is your database file and password is your specified tools password.
The Symantec Data Loss Prevention database files for Windows agents are located in
the DLP Agent installation directory and end in the *.ead extension. After you run the
command, you are prompted for your password.
2 Enter the default password VontuStop unless you have already created a unique password.
You are provided with a shell to enter SQL statements to view or update the database.
Refer to http://www.sqlite.org/sqlite.html for complete documentation about what commands
are available in this shell.
To run the vontu_sqlite3 tool on Mac endpoints
1 Set the vontu_sqlite3 tool permissions to be executable. See “Using Endpoint tools with
macOS” on page 1926.
2 Run the following script from the Symantec Data Loss Prevention Agent installation
directory:

sudo ./vontu_sqlite3 -db=database_file [-p=password]

where database_file is your database file and password is your specified tools password.
You run this command using the Terminal application. The vontu_sqlite3 tool is located
at /Library/Manufacturer/Endpoint Agent/.
3 Enter the default password VontuStop unless you have already created a unique password.
You are provided with a shell to enter SQL statements to view or update the database.
Refer to http://www.sqlite.org/sqlite.html for complete documentation about what commands
are available in this shell.
See “About agent password management”on page 1923 on page 1923.

Viewing extended log files

The logdump.exe tool enables users with administrator privileges to view the extended log
files for Symantec Data Loss Prevention Agents. Extended log files are hidden for security
reasons. Generally, you only need to view log files with Symantec Data Loss Prevention support
personnel. Without this tool, you cannot view any Symantec Data Loss Prevention Agent log
files.
 Using Endpoint tools 1929
About Endpoint tools

Note: You must have administrator rights to use the tool on Windows endpoints. You must
have root or sudo access to make changes to the agent database on Mac endpoints.

To run the log dump tool on Windows endpoints

1 Run the following script from the Symantec Data Loss Prevention Agent installation
directory:

logdump -log=log_file [-p=password]

where log_file is the log file you want to view and password is the specified tools password.
All Symantec Data Loss Prevention extended log files are present in the Symantec Data
Loss Prevention Agent installation directory. The files have names of the form
edpa_extfile_number.log. After you run this command, you can see the de-obfuscated
log.

Note: When using Windows PowerShell to run logdump.exe, quotes are required around
the log file. For example, run:
logdump "-log=log_file" [-p=password]

All Symantec Data Loss Prevention extended log files are present in the Symantec Data
Loss Prevention Agent installation directory. The files have names of the form
edpa_extfile_number.log. After you run this command, you can see the de-obfuscated
log.
2 (Optional) Print the contents of another log from this view.
To run the log dump tool on Mac endpoints
1 Set the logdump tool permissions to be executable. See “Using Endpoint tools with macOS”
on page 1926.
2 Run the following scripts from the Symantec Data Loss Prevention Agent installation
directory:

sudo ./logdump -log=log_file [-p=password]

where log_file is the log file you want to view and password is the specified tools password.
All Symantec Data Loss Prevention extended log files are present in the Symantec Data
Loss Prevention Agent installation directory. The files have names of the form
edpa_extfile_number.log. After you run this command, you can see the de-obfuscated
log.
3 (Optional) Print the contents of another log from this view.
 Using Endpoint tools 1930
About Endpoint tools

To print the contents of another log

1 From the command window, run:

logdump -log=log_file -p=password > deobfuscated_log_file_name

2 Enter the password again to print the log.

See “About agent password management”on page 1923 on page 1923.

About the Device ID utilities

Symantec Data Loss Prevention provides the DeviceID.exe for Windows removable devices
and the DeviceID for Mac removable devices to assist you with configuring endpoint devices
for detection.
See “About endpoint device detection” on page 729.
The DeviceID utilities scan the computer for all connected devices and reports the Device
Instance ID string on Windows endpoints and regex information on Mac endpoints.
You typically use the DeviceID utilities to allow the copying of sensitive information to
company-provided external devices like USB drives and SD cards.
See “Using the Windows Device ID utility” on page 1931.
See “Using the Mac Device ID utility” on page 1932.

Table 82-2 Windows Device ID utility example output

Result Description

Volume The volume or mount point that the DeviceID.exe tool found.

For example:

Volume: E:\

Dev ID The Device Instance ID for each device.

For example:

USBSTOR\DISK&VEN_UFD&PROD_USB_FLASH_DRIVE&REV_1100\5F73HF00Y9DBOG0DXJ

Regex The regular expression to detect that device instance.

For example:

USBSTOR\\DISK&VEN_UFD&PROD_USB_FLASH_DRIVE&REV_1100\\5F73HF00Y9DBOG0DXJ
 Using Endpoint tools 1931
About Endpoint tools

Table 82-3 Mac Device ID utility example output

Result Description

Vendor The vendor that the DeviceID tool found.

For example:

SanDisk&.*

Model The model that the DeviceID tool found.

For example:

SanDisk&Cruzer Blade&.*

Serial The serial number that the DeviceID tool found.

For example:

SanDisk&Cruzer Blade&DER45TG5444

Using the Windows Device ID utility

Use the Device ID utility to extract Device Instance ID strings and to determine what devices
the system can recognize for detection. You must have administrator rights to use this tool.
See “About the Device ID utilities” on page 1930.
See “About endpoint device detection” on page 729.
To use the Device ID utility
1 Obtain the DeviceID.exe utility.
This utility is available with the Endpoint Server utilities package.
See “About agent password management”on page 1923 on page 1923.
2 Copy the DeviceID.exe utility to a computer where you want to determine Device IDs.
3 Install the devices you want to examine onto the computer where you copied the
DeviceID.exe utility.

For example, plug in one or more USB devices, connect a hard drive, and so forth.
 Using Endpoint tools 1932
About Endpoint tools

4 Run the DeviceID.exe utility from the command line.

For example, if you copied the DeviceID.exe utility to the C:\temp directory, issue the
follow command:
C:\TEMP>DeviceID

To output the results to a file, issue the following command:

C:\TEMP>DeviceID > deviceids.txt

The file appears in the C:\temp directory and contains the output from the DeviceID
process.
5 View the results of the DeviceID process.
The command prompt displays the results for each volume or mount point.
See Table 82-2 on page 1930.
6 Use the DeviceID utility to evaluate the proposed regex string against a device that is
currently connected.
See Table 82-4 on page 1932.
7 Use the regular expression patterns to configure endpoint devices for detection.
See “Creating and modifying endpoint device configurations” on page 734.

Table 82-4 Device ID regex evaluation

Command Example
parameters

DeviceID.exe [-m] DeviceID.exe -m E:\

[Volume] [Regex] "USBSTOR\\DISK&VEN_UFD&PROD_USB_FLASH_DRIVE&REV_1100\\.*"
Note: The regex string needs to be inside quotation marks.

Returns Match! or Not match!

Using the Mac Device ID utility

Use the Mac Device ID utility to generate regex information. You use this feature to allow the
copying of sensitive information to company-provided external devices like USB drives and
SD cards.
See “About the Device ID utilities” on page 1930.
See “Creating and modifying endpoint device configurations” on page 734.
 Using Endpoint tools 1933
About Endpoint tools

To use the Device ID utility

1 Obtain the DeviceID utility.
This utility is available with the Mac agent tools package.
See “About agent password management”on page 1923 on page 1923.
2 Copy the DeviceID utility to a computer where you want to determine Device IDs.
3 Install the devices you want to examine onto the computer where you copied the DeviceID
utility.
For example, plug in one or more USB devices, connect a hard drive, and so on.
4 Run the DeviceID utility from the Terminal application.
For example, if you copied the DeviceID utility to the Downloads directory, issue the follow
command:
$HOME/Downloads/DeviceID where $HOME is your home directory.

The output results display information for each volume or mount point in the Terminal
application dialog.
5 Review the DeviceID process results.
6 Use the regex information to configure endpoint devices for detection.
See “Creating and modifying endpoint device configurations” on page 734.

Table 82-5
Command parameter Example

./DeviceID > deviceids.txt The tool outputs the following information to the
deviceids.txt file based on information gathered
from the attached thumb drive:

■ Volume: /Volumes/FAT_USB/
■ Type (BUS): USB
■ Device ID Regex by Vendor: JetFlash&.*
■ Device ID Regex by Model: JetFlash&Mass
Storage Device&.*
■ Device ID Regex by Serial No: JetFlash&Mass
Storage Device&79HCSMJ0RYOHT2FE

Starting DLP Agents that run on Mac endpoints

You can use the start_agent tool to start DLP Agents that run on Mac endpoints. You use the
tool if the agents have been shut down using the shutdown task on the Agent List screen.
 Using Endpoint tools 1934
About Endpoint tools

This tool is available in the AgentInstaller_Mac64.zip file. This file is created after you
complete the agent installation package process.

Note: You must unzip this file to a Mac endpoint. You cannot use the tool if it is unzipped to a
Windows endpoint.

To start agents using the start_agent tool:

1 Set the start_agentn tool permissions to be executable. See “Using Endpoint tools with
macOS” on page 1926.
2 From the Symantec Data Loss Prevention Agent installation directory, run the following
command:

sudo ./start_agent

where the installation directory is the directory where you installed Symantec Data Loss
Prevention.
3 Go to the Agent List screen and confirm that the agent is running.
See “Using the Agent List screen” on page 1865.
See “About agent password management”on page 1923 on page 1923.
 Section 10
Monitoring data loss in cloud
applications

■ Chapter 83. Working with Application Detection

 Chapter 83
Working with Application
Detection
This chapter includes the following topics:

■ About Application Detection

■ Managing Application Detection

About Application Detection

You can connect with many cloud applications through the Symantec Data Loss Prevention
Cloud Detection Service. The Cloud Detection Service integrates seamlessly with the Symantec
CloudSOC cloud access security broker (CASB).
Symantec CloudSOC includes Securlets and Gatelets with robust APIs that connect to many
software-as-a-service (SaaS) applications, such as Gmail, Google Drive, and Salesforce.
Securlets inspect sensitive data that is exposed in cloud applications. Gatelets inspect content
in files and documents as they are uploaded to or downloaded from cloud applications.
Connecting Symantec Data Loss Prevention to Symantec CloudSOC through the Cloud
Detection Service lets you incorporate Symantec's best-in-class policy detection capabilities
for any SaaS application Symantec CloudSOC supports.
Symantec Web Security Services (WSS) is a cloud proxy that lets you manage web and cloud
application access policies for your users.
You can connect to Symantec CloudSOC and WSS by deploying and configuring the Cloud
Detection Service. For detailed information about using the Cloud Detection Service, see the
Getting Started with the Symantec Data Loss Prevention Cloud Detection Service guide here:
www.symantec.com/docs/DOC9414.
You can use the API Detection for Developer Apps Appliance to connect with on-premises
applications. You must create a REST client for the applications you would like to connect.
 Working with Application Detection 1937
Managing Application Detection

For information about the REST API, see the Detection REST API reference guide here:
http://www.symantec.com/docs/DOC10653.

Note: The API Detection for Developer Apps Appliance only works with REST clients created
with the Detection REST API version 2.0.

You can configure cloud application detection on the Manage > Application Detection >
Configuration page.
See “Managing Application Detection” on page 1937.

Managing Application Detection

After you have deployed and configured your Symantec Data Loss Prevention Cloud Detection
Service or API Detection for Developer Apps Appliance, you can configure cloud application
detection on the Manage > Application Detection > Configuration page.
You can take the following actions on the Manage > Application Detection > Configuration
page:

Table 83-1 Application Detection Configuration page actions

Action Description

Configure application detection You can assign policy groups and targeting rules to CloudSOC Gatelets
and Securlets, and applications accessed through the Cloud Detection
API Service:

See “To configure Application Detection for CloudSOC Gatelets”

on page 1938.

See “To configure Application Detection for CloudSOC Securlets”

on page 1939.

See “To configure Application Detection for Cloud Web Proxies (WSS)”
on page 1941.

See “To configure Application Detection for the Cloud Detection API
Service” on page 1941.

Modify an existing application detection To modify an existing application configuration, click the edit icon for
configuration that application, edit the configuration, then click Save.

See “To modify an Application Detection configuration” on page 1941.

Delete an application detection configuration To delete an application configuration, click the delete icon for that
application.
 Working with Application Detection 1938
Managing Application Detection

Table 83-1 Application Detection Configuration page actions (continued)

Action Description

Synchronize Application Detection The Sync to CloudSOC button on the Application Configuration list
configurations with Symantec CloudSOC toolbar deletes and replaces all Application Detection configurations
on the CloudSOC side. The best practice for updating an individual
configuration is to edit the configuration and click Save.

Configuring Application Detection

You can assign policy groups and targeting rules to CloudSOC Gatelets and Securlets, and
specific applications:
To configure Application Detection for CloudSOC Gatelets
1 Navigate to the Manage > Application Detection > Configuration page.
2 Click New Configuration.
The New Configuration page appears.
3 In the Name field, enter a name for your cloud application detection configuration.
4 In the Type drop-down list, select Gatelet.
5 In the Applications field, select one of the following options:
■ Any: Selecting Any applies the policy groups and configuration rules you specify to
all applications you access through CloudSOC Gatelets.
■ Selective: Selecting Selective lets you target specific cloud application Gatelets. You
can enter the application name in the Enter application name field, or select from a
list of applications.

6 In the Policy Groups field, select the policy group or groups you want to apply to this
configuration.
7 In the Rules section, specify the Transfer Type to specify the direction of network traffic
you want to inspect. You must select at least one option, Upload or Download. You can
select both options to inspect all network traffic.
8 In the Device Properties section, specify one of the following options:
■ Any: Select this option to inspect all devices.
■ Managed: Select this option to inspect only devices managed by your organization.
If you select this option, you can select additional options for Device Ownership
Status (any device, corporate-only devices, or personal-only devices) and Device
Posture Status (any device, policy compliant devices, or policy non-compliant devices).
■ Unmanaged: Select this option to inspect only devices that are not managed by your
organization.
 Working with Application Detection 1939
Managing Application Detection

9 In the Users and Groups section, select one of the following options:
■ Any: Select this option to inspect traffic associated with any user.
If you select this option, you can also specify exceptions for specific users or groups
by clicking Add Exceptions.
■ Selective: Select this option to target specific users or user groups for inspection.

10 In the Regions section, select one of the following options:

■ Any: Select this option to inspect traffic associated with any geographical region.
If you select this option, you can also specify exceptions for specific geographical
regions by clicking Add Exceptions.
■ Selective: Select this option to target specific geographical regions for inspection.

11 In the File Properties section, select one of the following File Extensions options:
■ Any: Select this option to target all file types for inspection.
If you select this option, you can also specify exceptions for specific file types by clicking
Add Exceptions.
■ Selective: Select this option to target specific file types for inspection.

12 Optional: In the File Size section, specify one or both of the following include filters:
■ Smaller Than: Enter a file size in bytes less than which files will be included for
inspection.
■ Larger Than: Enter a file size in bytes more than which files will be included for
inspection.

13 Click Save.
To configure Application Detection for CloudSOC Securlets
1 Navigate to the Manage > Application Detection > Configuration page.
2 Click New Configuration.
The New Configuration page appears.
3 In the Name field, enter a name for your cloud application detection configuration.
4 In the Type drop-down list, select Securlet.
5 In the Applications field, select one of the following options:
■ Built In: Selecting Built In lets you select from a list of available CloudSOC Securlets
for specific applications.
■ Custom: Selecting Custom lets you target custom cloud application Securlets. You
can enter the application name in the Enter application name field.
 Working with Application Detection 1940
Managing Application Detection

6 In the Policy Groups field, select the policy group or groups you want to apply to this
configuration.
7 In the Rules section, specify the Exposure Type for the files you want to inspect:
■ Internal: Select this option to inspect files that are available to people within your
organization.
■ External: Select this option to inspect files that are available to people outside of your
organization.
■ Public: Select this option to inspect files that are available to anyone on the Internet.
■ Unexposed: Select this option to inspect files that are not available to anyone.
If you have selected some combination of Internal, External, or Public exposures, you
can additionally specify whether you want to find any file that matches one of the exposure
types, or files that match all specified exposure types. For example, if you selected both
the Internal and Public exposure types, selecting Match Any would match files that are
either internal or public. Selecting Match All would match only files that are both internally
and publically exposed.
8 In the Users and Groups section, select one of the following options:
■ Any: Select this option to inspect traffic associated with any user.
If you select this option, you can also specify exceptions for specific users or groups
by clicking Add Exceptions.
■ Selective: Select this option to target specific geographical regions for inspection.

9 In the Folder Paths section, select one of the following options:

■ Any: Select this option to inspect any available folder path.
If you select this option, you can also specify folder patch to exclude from inspection
by clicking Add Exceptions.
■ Selective: Select this option to target specific paths and folders for inspection.

10 In the File Properties section, select one of the following File Extensions options:
■ Any: Select this option to target all file types for inspection.
If you select this option, you can also specify exceptions for specific file types by clicking
Add Exceptions.
■ Selective: Select this option to target specific file types for inspection.

11 Optional: In the File Size section, specify one or both of the following include filters:
■ Smaller Than: Enter a file size in bytes less than which files will be included for
inspection.
 Working with Application Detection 1941
Managing Application Detection

■ Larger Than: Enter a file size in bytes more than which files will be included for
inspection.

12 Click Save.
To configure Application Detection for Cloud Web Proxies (WSS)
1 Navigate to the Manage > Application Detection > Configuration page.
2 Click New Configuration.
The New Configuration page appears.
3 In the Name field, enter a name for your application detection configuration.
4 In the Type drop-down list, select Cloud Web Proxy.
5 In the Policy Groups field, select the policy group or groups you want to apply to this
configuration.
6 Click Save.
To configure Application Detection for the Cloud Detection API Service
1 Navigate to the Manage > Application Detection > Configuration page.
2 Click New Configuration.
The New Configuration page appears.
3 In the Name field, enter a name for your application detection configuration.
4 In the Type drop-down list, select Cloud Detection API Service.
5 In the Application field, enter the name of the application you are accessing through the
Cloud Detection API Service.
6 In the Policy Groups field, select the policy group or groups you want to apply to this
configuration.
7 Click Save.

Modifying an Application Detection configuration

You can modify the policy group assignments of each application:
To modify an Application Detection configuration
1 Navigate to the Manage > Application Detection > Configuration page.
2 Click the edit icon for the Cloud Connector you want to modify.
The Edit Configuration page appears.
3 Edit your configuration.
4 Click Save.
 Section 11
Monitoring data loss using
DLP Appliances

■ Chapter 84. Implementing and working with DLP Appliances

■ Chapter 85. Deploying DLP Appliances

■ Chapter 86. Post-deployment tasks

 Chapter 84
Implementing and working
with DLP Appliances
This chapter includes the following topics:

■ About DLP Appliances

■ About obtaining the appliance activation file and licenses

■ About the Command Line Interface (CLI)

■ About performance tuning and sizing for appliances

About DLP Appliances

Virtual and hardware appliances for Symantec Data Loss Prevention 15.0 provide a simplified
way to deploy, upgrade, and maintain Data Loss Prevention detection servers. You activate
the appliance at the command line. When you set up a virtual appliance, you download the
image for the virtual detection software; hardware appliances come loaded with the appliance
software. Then, you enroll and manage the appliance at the Enforce Server administration
console.
The detection virtual appliances include:
■ Network Prevent for Email Appliance
■ Network Prevent for Web Appliance
■ API Detection for Developer Apps Appliance, which provides you with the flexibility to
connect to applications that you use within your organization. For specific instructions on
setting up the API Detection for Developer Apps Appliance, see Getting Started with the
Symantec Data Loss Prevention API Detection for Developer Apps Appliance at
http://www.symantec.com/docs/DOC10923.
 Implementing and working with DLP Appliances 1944
About obtaining the appliance activation file and licenses

You must create a REST client for the applications that you want to connect using the API
Detection for Developer Apps Appliance. For information about the REST API, see the
Symantec Data Loss Prevention Detection REST API 2.0 Reference Guide at:
http://www.symantec.com/docs/DOC10653.
You enroll and manage the hardware appliance at the Enforce Server administration console.
The Network Prevent for Web software is already installed on the Symantec DLP-S500 hardware
appliance.
See “About obtaining the appliance activation file and licenses” on page 1944.

About obtaining the appliance activation file and

licenses
You need two files for either the DLP Virtual Appliance or the DLP Hardware Appliance:
■ An activation file for the appliance.
■ A license file for the Data Loss Prevention detection software.
To obtain the activation file for the virtual appliance (as described later), you need to provide
an activation code. You can get the activation code from the Symantec fulfillment email for the
virtual appliance.
You need to provide a serial number for the hardware appliance. You can get the serial number
from the Symantec shipping alert email. You do not need an activation code for the hardware
appliance.
See “Obtaining activation and license files for the virtual appliance” on page 1944.
See “Obtaining license files for the DLP S500-10 Hardware Appliance” on page 1946.

Obtaining activation and license files for the virtual appliance

Follow these procedures for obtaining your activation file and your detection software license
file for the DLP Virtual Appliance. After you obtain the files, you apply the virtual appliance
activation file at the appliance command line. Then, after you download the detection software
to the virtual appliance, you can apply the detection software license at the Enforce Server
administration console.
Obtaining the appliance activation license file for the virtual appliance operating system
1 Go to https://support.symantec.com/en_US.html.
2 Go to Support Center > MySymantec > Licensing Portal and log on to your Symantec
account.
3 From the Licensing Portal choose Network Protection (Blue Coat License).
 Implementing and working with DLP Appliances 1945
About obtaining the appliance activation file and licenses

4 Enter the activation code from the fourth column in the table in your Symantec fulfillment
email from Enterprise_Efulfill@symantec.com to download the serial number. Keep a
copy of the serial number in a safe place.
5 Click Next.
6 Click I accept to accept the license and then click Next.
7 On the VA Serial Number Retrieval page, copy the Serial Number.
8 Click Download Data Loss prevention VA Serial Numbers: for future use.
9 Click License Download in the left column to continue.
10 Enter your serial number and click Submit.
11 Create a pass phrase, enter it, and click Next. Keep a copy of your pass phrase in a safe
place.
12 Choose the license that matches your serial number and click Download License File.
You need to download this bcl appliance activation file and apply it when you set up the
appliance.
Obtaining Symantec Data Loss Prevention detector license file and software for the Virtual
Appliance
1 Go back to Software Downloads (Technical Support > Downloads > Network
Protection (Blue Coat) Downloads).
2 Go to Browse My Software and Documentation > DataLossPrevention (DLP) >
DLPSYM. Here are all of the files that you need for setting up the Symantec Data Loss
Prevention Enforce Server and virtual appliance detector.
3 Click the license for the software that you purchased. The licenses are
■ DLP-EML-VA For the Symantec Data Loss Prevention Network Prevent for Email
Virtual Appliance.
The SymantecDLPEVA150_License.zip contains the slf file that you must upload to
the Enforce Server to enable the appliance detector.

■ DLP-WEB-VA For the Symantec Data Loss Prevention Network Prevent for Web
Virtual Appliance.
The SymantecDLPWHA150_License.zip contains the .slf file that you must upload
to the Enforce Server to enable the appliance detector.
■ DLP-APIC-VA For the Symantec Data Loss Prevention API Detector for Developer
Apps Virtual Appliance.
The SymantecDLPAPVA150_License.zip contains the slf file that you must upload
to the Enforce Server to enable the appliance detector.

4 Download the software for the appliance that you purchased.

 Implementing and working with DLP Appliances 1946
About obtaining the appliance activation file and licenses

See “Deployment overview for the virtual appliance” on page 1948.

Obtaining license files for the DLP S500-10 Hardware Appliance

Follow these procedures for obtaining your activation file and your detection software license
file for your DLP Hardware Appliance. After you obtain the files, you apply the activation file
for the hardware appliance at the command line. The detection software is already available
on the hardware appliance. You apply the license for the detection software at the Enforce
Server administration console.
Obtaining the appliance activation file for the DLP S500-10 Hardware Appliance operating
system
1 Go to https://support.symantec.com/en_US.html.
2 Go to Support Center > MySymantec > Licensing Portal and log on to your Symantec
account.
3 From the Licensing Portal choose Network Protection (Blue Coat) License.
4 Enter the serial number from your Symantec shipping alert email and click Submit. The
serial number can also be found on your DLP S500-10 Hardware Appliance.
5 Choose the license that matches your serial number and click Download License File.
You need to download this bcl appliance activation file and apply it when you set up the
appliance.
Obtaining the Symantec Data Loss Prevention detector license for the DLP S500-10 Hardware
Appliance
1 Go to https://support.symantec.com/en_US.html.
2 Go Licensing > Network Protection (Blue Coat) Licensing and sign into your account.
3 Go to Browse My Software and Documentation > DataLossPrevention (DLP) >
DLPSYM,S500.
4 Click Symantec Data Loss Prevention 15.0 Network Prevent for Web Hardware
Appliance S500-10. Here you can find all of the files that you need for setting up the DLP
Enforce Server and the DLP Hardware Appliance. The SymantecDLPWHA150_License.zip
contains the slf file that you must upload to the Enforce Server to enable the appliance
detector.
5 Download the license file. The Symantec Data Loss Prevention 15.0 Network Prevent for
Web software is already installed on the DLP S500-10.
See “Deployment overview for the DLP-S500 hardware appliance” on page 1952.
 Implementing and working with DLP Appliances 1947
About the Command Line Interface (CLI)

About the Command Line Interface (CLI)

You can access the command line interface through ssh or through the appliance console.
The command line has several modes, including config andenable. Most Symantec Data
Loss Prevention and licensing activities are done in enable mode.
In addition, there is an initial configuration command line that is only accessible from the
console. The initial configuration command line is used for setting the basic networking
parameters of the appliance.
The CLI includes internal help and uses autocomplete, for ease of use. Only the CLI commands
that Data Loss Prevention uses are documented and supported. See the Symantec Data Loss
Prevention Appliance Command Line Interface Reference at
www.symantec.com/DOCS/DOC10599.html for details on each supported command.
See “Deployment overview for the virtual appliance” on page 1948.

About performance tuning and sizing for appliances

Each DLP-S500-10 hardware appliance can support 10,000 Network Prevent for Web users.
The sizing guidelines that apply to the Enforce Server and the detection servers apply to the
appliances as well. You can follow the existing guidelines as presented in the Symantec Data
Loss Prevention System Requirements Guide for 15.0 at www.symantec.com/DOC10602.
 Chapter 85
Deploying DLP Appliances
This chapter includes the following topics:

■ Deployment overview for the virtual appliance

■ Setting up the virtual appliance

■ Deployment overview for the DLP-S500 hardware appliance

■ Setting up the DLP-S500 Appliance

■ Adding an appliance

■ Configuring the API Detection for Developer Apps Appliance

Deployment overview for the virtual appliance

Deploying appliances is a multi-step process. See Table 85-1 for an overview of the steps that
you must take to deploy a virtual appliance. See the cross-referenced sections for more details.

Table 85-1 Overview of virtual appliance setup

Step Action More information

Step 1 Download the zip files from See “Obtaining activation and
Symantec Software Download. license files for the virtual
These files contain the ovf appliance” on page 1944.
(virtual machine image)
compressed files for the
appliance. The zip file that
contains the ovf also contains
virtual disk files, info files, and
checksum files.
 Deploying DLP Appliances 1949
Deployment overview for the virtual appliance

Table 85-1 Overview of virtual appliance setup (continued)

Step Action More information

Step 2 Gather the information you'll need See “Setting up the virtual
for setup. appliance” on page 1950.

Step 3 Deploy the virtual machine image, See “To download and deploy the
which includes both the operating appliance virtual machine image”
system and data disk, at the on page 1951.
command line in VMware ESXi.

Step 4 Enter the (10-digit) serial number See “To download and deploy the
from your activation file. Save this appliance virtual machine image”
number; you need to enter this on page 1951.
number again when you register
this appliance with the Enforce
Server.

Step 5 Configure the network interfaces See “To download and deploy the
at the command line. appliance virtual machine image”
on page 1951.

Step 6 Set up your console password at See “To set up the passwords”
the command line. on page 1951.

Step 7 Set up your enable password at See “To set up the passwords”
the command line. on page 1951.

Step 8 Apply the .bcl activation file for the See “To apply the .bcl activation
appliance. file for the appliance” on page 1951.

Step 9 Set up and configure the See “Adding an appliance”

appliance to communicate with on page 1955.
the Enforce Server administration
See “Configuring the API
console. Then apply the license
Detection for Developer Apps
serial number at the Enforce
Appliance” on page 1956.
Server administration console.

Step 10 Configure the detection See “Network Prevent for Email

component of the appliance. Server—basic configuration”
on page 216.

See “Network Prevent for Web

Server—basic configuration”
on page 219.
 Deploying DLP Appliances 1950
Setting up the virtual appliance

Table 85-1 Overview of virtual appliance setup (continued)

Step Action More information

Step 11 Set up a TLS server keystore. For the email detection appliance,
there is an option to configure a
TLS server key. This private key
must be an RSA key.

See “Setting up the virtual appliance” on page 1950.

Setting up the virtual appliance

After you purchase a license for the detection appliance, you apply the activation file at the
command line within the virtual machine. You then establish the connection between the
appliance and the Enforce Server at the Enforce Server administration console.

Note: Only one detection type (for example, Network Prevent for Email) can be run on one
appliance at one time. Symantec doesn't support multiple detection types on the same
appliance.

You must have the following information on hand to perform initial configuration:
■ IP address
■ Subnet mask
■ Gateway address
■ Serial number
■ Passphrase
■ Console password to log on to the CLI through the Secure Shell (SSH) protocol and access
the advanced commands in the CL
■ Enable password for administrative access to the appliance
■ Default gateway IP address
■ Primary DNS server IP address
■ For the API Detection for Developer Apps Appliance, a keystore file in PKCS12 format
(.pfx or .p12).
■ For the API Detection for Developer Apps Appliance, a truststore file in PKCS12 format
(.pfx or .p12).
 Deploying DLP Appliances 1951
Setting up the virtual appliance

To download and deploy the appliance virtual machine image

1 Download the appliance virtual machine image from Symantec Software Download.
2 Click the Power on icon in VMware ESXi to start up the virtual appliance. It takes a few
minutes to format and partition the disk. You may see a black screen for a few moments
during this booting process.
3 Input the serial number (10-digit number) that comes with the activation file that you
downloaded from Symantec.
4 After the appliance boots, when prompted, press <Enter> three times. The configuration
process begins.
5 When a prompt appears, select option 2: Setup Console to set up the network interfaces
on the appliance.
6 Enter the IP address for the virtual appliance.
7 Enter the IP subnet mask for the virtual appliance.
8 Enter the IP gateway address for the virtual appliance.
9 Enter the IP address of the DNS server for the appliance.
To set up the passwords
1 Specify a console password in Enter console password. The console password gives
you access to log on to the command line interface (CLI) using Secure Shell (SSH) protocol.
2 Specify an enable password in Enter enable password. The enable password gives you
administrative access to the CLI.

Note: Ignore the message that says you can go to port 8082 for administration. This port
is currently not available for managing the virtual appliance.

To apply the .bcl activation file for the appliance

Log on to the CLI and apply the activation file you received from Symantec.
1 Enter your host name:
ssh admin@[your host name here].

2 Enter your console password:

[your console password here]

3 At the prompt, enter enable:

localhost> enable
 Deploying DLP Appliances 1952
Deployment overview for the DLP-S500 hardware appliance

4 Enter your enable password:

localhost# [your enable password here]

5 To apply the activation file that you received from Symantec and previously saved to an
HTTP server URL and the passphrase that you set up at the Network Protection Licensing
Portal enter:
localhost# licensing load url [your url here] passphrase [your passphrase
here]

Alternately, use the licensing inline command and copy and paste the license.
6 To confirm that the license has been installed, enter:
localhost# licensing view

7 Restart the appliance for the license to take effect:

localhost# restart

8 Go to the Enforce Server administration console to configure the communication between

the virtual appliance and the Enforce Server administration console.
See “Adding an appliance” on page 1955.
See “Configuring the API Detection for Developer Apps Appliance” on page 1956.

Deployment overview for the DLP-S500 hardware

appliance
Table 85-2 provides an overview of the steps for deploying a DLP-S500 hardware appliance.
The hardware appliance comes with a virtual image preinstalled and an activation file.

Table 85-2 Overview of hardware appliance setup

Step Action More information

Step 1 Download the activation and See “Obtaining activation and

software license files from license files for the virtual
Symantec Software Download. appliance” on page 1944.
These files contain the ovf
(virtual machine image)
compressed files for the
appliance. The zip file that
contains the ovf also contains
virtual disk files, info files, and
checksum files.
 Deploying DLP Appliances 1953
Setting up the DLP-S500 Appliance

Table 85-2 Overview of hardware appliance setup (continued)

Step Action More information

Step 2 Gather the information that you See “Setting up the DLP-S500
need for setup. Appliance” on page 1953.

Step 3 Perform initial configuration for the See “To perform the initial
DLP-S500 hardware. configuration for the DLP-S500 ”
on page 1954.

Step 4 Configure the network interfaces See “To configure the network
at the command line. interfaces” on page 1954.

Step 5 Specify a console password. See “To set up the passwords”

on page 1954.

Step 6 Specify an enable password. See “To set up the passwords”

on page 1954.

Step 7 Apply the .bcl activation file for the See “To apply the .bcl activation
appliance. file for the hardware appliance”
on page 1955.

Step 8 Configure the appliance and apply See “Adding an appliance”

the activation file serial number at on page 1955.
the Enforce Server administration
See “Configuring the API
console.
Detection for Developer Apps
Appliance” on page 1956.

Step 9 Configure the detection See “Network Prevent for Web

component of the appliance. Server—basic configuration”
on page 219.

See “Setting up the DLP-S500 Appliance” on page 1953.

Setting up the DLP-S500 Appliance

See the DLP-S500 Quick Start Guide for information on powering on the DLP-S500 hardware,
rack mounting the appliance, and connecting the cables. Some of that information is repeated
here for reference.
The DLP-S500 comes preinstalled with the DLP software. Currently, only Network Prevent for
Web is offered for the hardware appliance. After you set up the hardware, you configure the
detection appliance at the Enforce Server administration console.
You must have the following information on hand to perform initial configuration:
 Deploying DLP Appliances 1954
Setting up the DLP-S500 Appliance

■ DLP-S500 IP address
■ Subnet mask
■ Console password to log on to the CLI through the Secure Shell (SSH) protocol and access
the advanced commands in the CLI.
■ Enable password for administrative access to the appliance.
■ Default gateway IP address
■ Primary DNS server IP address
To perform the initial configuration for the DLP-S500
1 Confirm that a null-modem serial cable is connected from the appliance to a workstation's
serial port.
2 Open a terminal emulation program such as Microsoft HyperTerminal, PuTTY, Tera Term,
or Procomm.
3 Configure the terminal emulation software to the following settings:
■ Bud rate: 9600
■ Parity: None
■ Flow control: None
■ Data bits: 1
■ Stop bits: 8

4 Turn on the appliance, (if it is not already powered on).

5 After the appliance boots, when prompted, press <Enter> three times. The configuration
process begins.
To configure the network interfaces
1 When the prompt appears, select option 2: Setup Console to set up the network interfaces.
2 Specify the IP addresses you want to use for the appliance in Enter interface number
to configure [3].
3 Enter the IP address of the DNS server.
To set up the passwords
1 Specify a console password in Enter console password. The console password gives
you access to log on to the command line interface (CLI) using Secure Shell (SSH) protocol.
2 Specify an enable password in Enter enable password. The enable password gives you
administrative access using the CLI.
 Deploying DLP Appliances 1955
Adding an appliance

Note: Ignore the message that says you can go to port 8082 for administration. This port is
currently not available for managing the DLP-S500.

To apply the .bcl activation file for the hardware appliance

1 Enter your host name:
ssh admin@[your host name here]

2 Enter your console password:

[your console password here]

3 At the prompt, enter enable:

localhost> enable

4 Enter your enable password:

localhost# [your enable password here]

5 To apply the hardware license you received from Symantec and previously saved to an
HTTP server URL, enter:
localhost# licensing load url [your url here]

Alternately, use the licensing inline command and copy and paste the license.
6 To confirm that the license has been installed, enter:
localhost# licensing view

7 Restart the appliance for the license to take effect:

localhost# restart

8 Go to the Enforce Server administration console to configure the communication between

the DLP-S500 and the Enforce Server administration console.
See “Adding an appliance” on page 1955.
See “Configuring the API Detection for Developer Apps Appliance” on page 1956.

Adding an appliance
After you have set up the appliance, you can register your detection appliance at the Enforce
Server administration console.
To add a detection appliance
1 Log on to the Enforce Server administration console as administrator.
2 Go to System > Servers and Detectors.
 Deploying DLP Appliances 1956
Configuring the API Detection for Developer Apps Appliance

3 Click Add Server...Appliance.

4 The Add an Appliance screen appears.
5 Choose a detection appliance type to add, then click Next.
See “Configuring the API Detection for Developer Apps Appliance” on page 1956.

Configuring the API Detection for Developer Apps

Appliance
After you add the API Detection for Developer Apps Appliance, follow these configuration
steps:
To configure the API Detection for Developer Apps Appliance
1 Add a name for this appliance in the Appliance Name field.
2 Enter the 10-digit serial number that you received from Symantec in the Serial Number
field.
3 Enter the host name or the IP address in the Hostname or IP Address field.
4 Enter admin in the User Name field.
5 Enter your administration password in the Password field.
6 Re-enter your password in the Re-enter Password field.

Note: This password is your console logon password that you configured previously. It
is not your enable password.

7 In the Upload keystore for SSL certificate field, click Browse to select your PKCS12
keystore file.
8 Enter the keystore password in the Keystore password field.
9 In the Upload truststore to validate client certificate fields, click Browse to select your
PKCS12 truststore file.
10 Click Save.
You can find more information about the command line interface (CLI) commands in the
Symantec Data Loss Prevention Command Line Interface Reference at
www.symantec.com/DOCS/DOC10599.html.
 Chapter 86
Post-deployment tasks
This chapter includes the following topics:

■ Unbinding or resetting a DLP appliance

■ Updating appliance software

■ Log files and logging for appliances

Unbinding or resetting a DLP appliance

The Enforce Server automatically unbinds an appliance if the appliance is removed from the
Enforce Server while it is still connected to the Enforce Server. You must manually unbind an
appliance when it is moved to another Enforce Server without having been removed from the
old Enforce Server. Here are some situations where you need to reset an appliance:
■ When you move an appliance from one Enforce Server instance to another: You must
unbind the appliance from the old Enforce instance before you connect it to the new instance.
■ Cloning VMs: Reset the appliance ID after you clone VMs. Each appliance must have a
unique ID so that Enforce can tell them apart.
■ Starting from scratch: Perform a factory reset, which reformats and clears the data disk. A
factory reset does not roll back the appliance to the previous software.
To unbind an appliance from the Enforce Server
◆ Enter the following command in the Admin CLI (after you have entered enable mode):
dlp admin unbind

To perform a factory reset

1 Get the appliance ID.
2 Locate the appliance at the console.
3 To reconfigure the appliance to reset the ID, see Unbinding or resetting a DLP appliance.
 Post-deployment tasks 1958
Updating appliance software

See “Updating appliance software” on page 1958.

Updating appliance software

Updating an appliance image can be done from the System > Servers and Detectors >
Overview > System Readiness and Appliance Update page. The Appliances Software
Update section is at the middle of this page. On this page you can choose the following update
actions on installed appliances:
■ Deploy an Appliance Image
■ Update Appliances(s)
■ Rollback Appliances(s) Update
■ Cancel In-Progress Actions
All of your installed appliances appear on this page, with the following details about each
appliance:
■ Server - a list of all of your appliances, both hardware and virtual
■ Form Factor
■ Current Appliance Version
■ Install date
■ Active Since - Active status date
■ Version Available For Update
■ Update Readiness
■ Version Available For Rollback - the previous version that you use for rollback, if there
is one.

Note: When running actions for Appliances Software Update, it may take some time for
images to deploy, update, and restart. You may also see what appears to be a disconnect,
but it is normal behavior. When the action completes you see a new status in the Version or
Update Readiness columns. You also see new information on the Servers and Detectors
> Server Detail page.

In general, for each action you perform, you need to:

■ Locate an image (if one is necessary for that action).
Select the appliance you want to update.
Select the action.
 Post-deployment tasks 1959
Log files and logging for appliances

To update an appliance
1 Find the .bcsi upgrade image that you have downloaded from Symantec Software
Download. Upload the image to a local HTTP server.
2 Go to System > Servers and Detectors > Overview > System Readiness and Appliance
Update.
3 Under Appliances Software Update, select Deploy Appliance Image
4 Select the appliance that you want to update.
5 Select the image you uploaded in Step 1 from the Installer Image URL menu.
6 Click Run Action for Selected Appliances. It takes some time for the image to deploy.
After the image is deployed, you see Ready to update in the Update Readiness column
for the selected appliance.
7 Select Update Appliances and select the appliance you want to update.
8 Click Run Action for Selected Appliances.

Note: The DLP appliance version number on the Servers and Detectors page does not match
the DLP appliance version number that is displayed on the Appliances Software Update
page. The Appliances Software Update page presents a version number with an extra ".0"
in it. Also, while DLP version numbers match, the build number for appliances may be different
from the build number for servers.

See “Log files and logging for appliances” on page 1959.

Log files and logging for appliances

The Enforce Server collects the appliance logs.
To collect logs
◆ Go to System > Servers and Detectors > Logs and select your appliance from the list.
See "Managing log files" in the Symantec Data Loss Prevention Administration Guide for
more information.

Note: The Log Configuration file section is grayed out for appliances and cannot be used.

See “About performance tuning and sizing for appliances” on page 1947.

Symbols
1407
A creating a new 1858
access control lists (ACL)
incident snapshots 1387
Active Directory 1852
attribute 1854
attributes 1850
AddDefaultHeader field 1502
AddDefaultPassHeader field 1502
administration
introduction to 65
administration console
about 66
logging on and off 67
Administrator account
about 68
email account 69
password, changing 69
password, resetting 109
AdminPasswordReset utility 109
Advanced Process Control 210
advanced server settings 1492
Agent 1916
agent attribute
creating a new 1853
agent attributes 1855
managing 1852
user-defined 1856
Agent configuration
about 1783
adding 1784
applying 1848
agent events
about 1881
agent event detail screen 1882
agent group
conditions 1857
Agent Groups 1849
deployment process 1851
Index
Agent Groups (continued)
deployment strategy 1850
agent groups
assigning configurations to deploy 1859
updating outdated 1858
viewing and managing 1856
Agent Host Domain 1852
Agent Host Name 1852
Agent Host Type 1852
Agent Host Version 1853
agent overview
summary screen 1863
alerts. See system alerts
AllowHosts field 1505, 1516
appliances
Server/Detector Detail screen 243
Application Detection
about 1936
configuring 1937
managing 1937
Application Detection configuration
adding 1938
Cloud Detection API Service 1941
CloudSOC Gatelets 1938
CloudSOC Securlets 1939
modifying 1941
application monitoring 1743
about 1896
adding an application 1902, 1906
Applications
incident lists 1342
incident reports 1340
incident snapshots 1345
incident summaries 1349
Attribute Query Resolver tool 1854
attribute values 1854
attributes 1310, 1314, 1417
applying 1855
types 1853
user-defined 1853
authenticating 201
 Index 1961

authentication credentials 145 Classification Server

Authority Information Access field 133 configuring 232
configuring retention categories for 1250
B clipboard 1743
cloud authorization
best practice
Box 1538–1539
evaluate per-fold accuracy rates 592
managing 1538
reject training if accuracy rate above 5% 592
cloud detectors
best practices
adding 236
allocate low memory for endpoint policies 591
Cloud Storage Discover scans
collect as many example documents as
Box cloud storage 1595
possible 590
configuring 1596
create documents staging area 591
Box cloud storage authorization 1539
do not use VML to detect graphics or PII 589
Cloud Storage Discover targets
narrowly define the category 589
Box cloud storage 1595
perform negative testing 582
code numbers
policies 412, 414–420
system events 164
profiled DGM 758
Common name (CN) values 132
seed the negative training set with generic
configure IDM partial content matching 531
content 590
console. See administration console
tune profile before deploying into production 594
correlations 1313
undeploy unused profiles 594
credential store
use documents archives 591
adding authentication 146
use to detect unstructured, text-based
deleting credentials 147
content 588
editing credentials 147
VML, summary of 587
endpoint credentials 146
BindAddress field 1504, 1516
managing 147
blocking requests 1517
credentials 145
Box 199
CRLDP revocation checks
Box cloud storage scanning 1595
configuring aproxy for 136
configuring 1596
support for 133
BoxMonitor process 294
custom attributes 1314, 1416–1417
creating 1418
C editing 1418
CA certificates incident snapshots 1385
importing 238 Lookup option (incident snapshot) 1418
CD/DVD populating 1418
about 1740 setting values manually 1420
list of 1900 uses of 1417
Certificate authentication using 1416
adding CA certificates for 129
configuring 125
configuring revocation checks for 133, 135
D
dashboard reports
enabling or disabling 127
configuring 1359
mapping CN values for 132
creating 1358
troubleshooting 139
scheduling 1371
Certificate Revocation Lists Distribution Point. See
dashboards 1356
CRLDP revocation checks
deleting 1381
checksum offloading 1483
editing 1373
 Index 1962

dashboards (continued) delete

viewing 1357 hidden incidents 1409
Data Identifiers deploying
cloning, manually 649 SMS 1916
modifying 626 using silent installation 1916
Data identifiers using the Endpoint FlexResponse utility 1919
about 612 detection
best practices 681 best practice 720
breadths, about 622 crackable CAD formats 782
configuration, about 666 crackable database file formats 783
cross-component matching 624 crackable email formats 782
custom, about 668 crackable encapsulation formats 784
data normalizers, about 680 crackable graphics formats 783
extending 621 crackable other formats 783
optional validators, about 623 crackable presentation formats 779
pattern language limitations, about 669 crackable spreadsheet formats 780
patterns 623 crackable text and markup formats 781
system-defined 613, 621 crackable word-processing file formats 777
validators, about 624 Custom File Type Signature 719
data identifiers file name 714, 717
adding 626 file name examples 718
breadths, list of 629 file name syntax 718
Content Matches data identifier condition 628 file properties 711
editing validator input 650 file size 713, 716
implementing custom script validators 680 file type 711, 715
implementing, custom 666 file type, custom 713, 719
implementing, patterns 671 Message Attachment or File Name Match 717
managing 626 Message Attachment or File Size Match 716
normalizers, list of 629 Message Attachment or File Type Match 715
optional validators, configuration 644 network 723–724
optionl validators, acceptable characters 645 Protocol Monitoring, network 724
selecting validators 679 word processing formats 777
data loss prevention. See Symantec Data Loss detection servers
Prevention about 210
database adding 234
adjusting warning thresholds 192 advanced settings 245
diagnostic tools 190 configuration 213
generating a report 192 controls 211
report 190 errors and warning list 243
viewing table details 193 kinds of 59
viewing tablespace and data file allocations 191 logging 301
DBPasswordChanger utility removing 237
example of using 324 Server/Detector Detail screen 243
introducing 321, 323 settings, advanced 234
locating 323 single tier 234
prerequisites for using 323 status of 241
running 323 System Overview screen 239
debug log files 293–294, 307 detectors
advanced settings 245, 286
 Index 1963

detectors (continued) Endpoint (continued)

editing 233 user cancel response rule 1750
Server/Detector Detail screen 243 endpoint
settings, advanced 234 agent advanced settings 1804
direcotry servers (LDAP) Agent log levels 1892
connecting to 140 Agent logs 1891
Directory Group Matching (DGM) incidnet summary screen 1326
implementing synchronized 750 incompatible detection and response rules 1717
Recipient based on a Profiled Directory policies for 1716
condition 757 response rules in different locales 1753
Sender/User based on a Profiled Directory setting response rules in different locales 1754
condition 756 setting the endpoint location 1751
synchronized 747 summary reports 1326
Directory Group Matching (DGM), profiled Endpoint Discover
profiled 754 adding a rule 1762
profiled conditions 756 configuring targets 1765
profiled create exact data source file 434 creating a policy 1762
two-tier detection 754 creating a policy group 1761
workflow 755 Endpoint Discover target 1764
Directory Group Matching (DGM), synchronized filters 1770
Recipient matches User Group based on a full scanning 1757
Directory Server Group 752 how it works 1755
scheduling indexing 143 implementing 1763
Sender/User matches User Group based on a incremental scan working 1758
Directory Server Group 751 incremental scanning 1757
directory servers (LDAP) introducing 63
configuring connections 141 Max Scan Duration 1777
DLP Agent reports 1781
advanced settings 1804 Scan Idle Timeout 1777
DLP agent scan timeout settings 1777
health 1863 scanning 1755
DLP Agent summary reports 1871 targeted endpoints 1755–1756
document upload targeted endpoints, parallel scan 1759
max size per 591 Endpoint Discover scans
documents excluding items or repositories 1773
supported types 591 including items or repositories 1773
Documentum targets 1691 reporting scan details 1779
Endpoint FlexResponse
E about 1913
deploying 1915
email
deploying plug-ins 1915
blocking 1505
deploying plug-ins using the Endpoint
quarantining 1507
FlexResponse utility 1919
encrypt files 1619
enabling on Enforce Servers 1920
Endace cards 1484
uninstalling using the FlexResponse utility 1920
configuring Network Monitor to use 1492
Endpoint FlexResponse utility 1917
drivers for 1485
options 1918
installing drivers for 1486
password 1918
Endpoint
Quarantine response rule 1763
 Index 1964

endpoint incident Enforce Server (continued)

destination or protocol specific information 1325 introducing 60
lists 1316 response rules in different locales 1753
snapshot 1319 setting response rules in different locales 1754
endpoint location Enforce Server administration console
setting 1751 Profile screen 70
Endpoint Prevent error logging for the ICE Utility 201
application monitoring 1743 ethtool 1483
block response rule 1748–1749 Exact Data Matching (EDM)
CD/DVD monitors 1740 add profiles 447
Citrix XenApp 1745 creating the data source file 433
Citrix XenDesktop 1745 data source cleansing 427
clipboard monitor 1743 data source size limits 426
creating policies 1748 Directory EDM 430
implementing 1751 EDM condition 448
introducing 64 example 422
Microsoft Hyper-V 1745 exceptions 429
monitoring 1736 field mapping 428
network monitors 1739 functionality 423
network share monitoring 1742 index file 426
notify response rule 1748–1749 index updates 429
print/fax monitor 1741 manage profiles 447
Remote Desktop Services 1745 match counting 466
removable media 1737 policy condition 429
reporting response rules 1324 preparing for indexing 435
reports 1781 Remote EDM Indexer utility 484
virtual hosts 1745 remote indexing 483
virtual machines 1745 SQL Preindexer utility 484
VMWare View 1745 two-tier detection 431
Endpoint Server workflow 431
configuration, basic 222 Exact Data Matching (EDM), configure
configuring file filters 1789 Exact Data Profile 438
endpoint targets Remote EDM Indexer 436
configuring 1765 uploading the exact data source to Enforce 436
endpoint tools 1923 Exact Data Matching (EDM), profile
logdump.exe tool 1928 mapping fields 442
Service_Shutdown.exe tool 1926 schedule profile indexing 445
using on Windows Vista 1925 exporting agent attributes 1854
vontu_sqlite3.exe tool 1927
endpoint utilities 322 F
Enforce
filtering requests 1512
introducing 60
flrinst.exe utility
logging 300
about 1917
Enforce console. See administration console
deploying plug-ins 1919
Enforce Server
retrieving plug-in list 1922
about 66
retrieving plug-ins 1921
alerts, configuring to send 161
uninstalling plug-ins 1920
choosing a non-English language for 79
Forms-based log on
enabling Endpoint FlexResponse 1920
disabling 139
 Index 1965

forwarding mode 1498 incident reports 1352

Applications 1340
G creating summary reports 1362
customizing 1364
Gatelets 199
dashboards 1356, 1364
GET commands 1493, 1516
dashboards, configuring 1359
group conflicts
dashboards, creating 1358
viewing 1860
deleting custom reports 1381
group exceptions, type
editing custom reports 1373
Recipient Matches Pattern 742
exporting to CSV 1373
group rules, type
exporting to XML 1373
Recipient Matches Pattern 742
filter options 1383
filtering 1366, 1388
H implementing a strategy 1353
hidden introducing 1354
incidents 1406 navigating pages 1382
hidden incidents Network Discover 1331
deleting 1409 printing 1385
unhiding 1407 remediating incidents 1297
hiding saving 1366
incidents 1406–1407 scheduling 1367, 1369
Home page sending by email 1384
selection 66 setting advanced filters 1398
HTTP requests 219 setting general filters 1390
blocking 1517 setting preferences 1354
ignoring 1511–1512 summaries 1356, 1361, 1388
summary options 1383, 1393
I viewing incidents 1363
ICAP 62, 1511, 1515–1516 viewing summary reports 1361
configuring 1514 incident snapshots
ICE. See Information Centric Encryption ACL information 1387
DLP Agents 1804 Applications 1345
ICE Cloud Console 199 correlations tab 1386
ICE Utility 201 custom attributes section 1385
error logging for 201 history tab 1385
Identity Provider matches section 1386
authenticating with 201 Network Discover/Cloud Storage Discover 1335
incident lists policy section 1386
Applications 1342 incident summaries
Network Discover/Cloud Storage Discover 1332 Applications 1349
Network Monitor and Prevent 1304 Network Discover/Cloud Storage Discover 1338
incident remediation 1294 Incident Update privilege 101
commands 1298 incidents 1304, 1309–1311, 1313–1314
email response variables 1300 attributes, status 1410
Incident Reporting and Update API custom attributes 1416
privileges 101 custom attributes, and 1418
Incident Reporting and Update Web Service 296 deleting 1377
Incident Reporting privilege 101 hiding 1406–1407
preventing hiding 1408
 Index 1966

incidents (continued) language packs

remediating 1307 about 78
unhiding 1407 Language Pack Utility 80
incremental scanning 1568–1569 languages and character sets
Indexed Document Matching character sets, using 77
DocSource.rdx 518 choosing a non-English language 79
EncryptedDocSource.rdx 518 language packs, about 78
EndpointDocSource.rdx 518 language packs, working with 80
LegacyEndpointDocSource.rdx 518 licenses 206
scheduling indexing 542 Linux systems 1503
Indexed Document Matching (IDM) listing plugins 1917
adding document profiles 529 Livelink targets 1699
best practice 548, 550–552 localization. See languages and character sets
configuring document profiles 529 log files 293
configuring the match condition 545 logdump.exe tool 1928
document data source 516 logdump.exe utility 322
Document Profile 515 Logged in User 1853
exact file contents matching 521 Logged in User Domain 1852
exact file matching 520 logging
excluding content using white listing 527 distance and confidence 586
filtering by file name 539 number of features modeled 586
filtering by file size 541 per-fold evaluation rates 586
IDM match condition 523 logging for the ICE Utility 201
implementing 525 logging on and off 67
managing document profiles 528 logs
Overview 512 review 164
partial file contents matching 521 lookup parameters
Platforms 514 parameter groups 1438
preparing the document source for indexing 525 lookup plug-ins. See about
remote indexing 554 automatic lookup 1452
remote indexing options 517 automatic reload 1452
white listing 524 chaining 1449
Information Centric Encryption chaining multiple plug-ins 1439
about 199 CSV attribute mapping 1457
application settings 1897 CSV data file requirements 1455
DLP Agents 1275, 1804 CSV file delimiter 1456
settings 1804 CSV file location 1456
Information Centric Tagging 342 CSV key mapping 1457
installation log files 293 CSV, character set 1456
installing CSV, how it works 1436
plug-ins 1917 custom 1478
internationalization. See languages and character custom (legacy) 1437
sets data owner email output 1452
Internet Content Adaptation Protocol. See ICAP data owner output 1452
iptables command 1503–1504 deployment 1439
enabling 1449
L implementing, workflow for 1440
LDAP attribute mapping 1464
Language Pack Utility 80
LDAP configuration 1462
 Index 1967

lookup plug-ins (continued) Network Discover targets 1668

LDAP server connection 1463 custom 1707
LDAP, how it works 1436 DB2 databases 1628
lookup parameters 1444 Documentum 1691
reloading 1450 Domino servers 1622
script chaining 1474 Exchange 1659
timeout 1452 file shares 1601
types 1435 Livelink 1699
lookup plug-ins, script Lotus Notes 1622
enabling credentials 1472 Oracle databases 1628
encrypting credentials 1472 SharePoint 1636
lookup plugin SQL databases 1628
LDAP testing 1465 SQL server 2005 1628
script protocol filtering 1471 SQL server 2014 1628
lookup plugins UNIX file systems 1668
script configuring 1467 web servers 1680
script writing 1468 web services 1707
script, how it works 1436 web sites 1680
scripting languages 1436 Windows remote server file systems 1668
Lotus Notes targets 1622 Network Discover/Cloud Storage Discover
adding new targets 1529
M configuring 1526
configuring targets 1532, 1534
mail transfer agents. See MTAs
editing targets 1530
managed users 201
how Discover works 1523
manager process 295
incident lists 1332
manager-certauth.security 137
incident reports 1329–1330
manager-certauth.security file 135
incident snapshots 1335
matches 1313
incident summaries 1338
Microsoft Exchange targets 1659
introducing 62, 1522
Microsoft OneDrive. See OneDrive
logging 298
MIME types 220, 1513
reports 1329
minSizeofGetURL field 1517
setting up 1526
mobile devices 201
Network Discover/Cloud Storage Discover scans
MTAResubmitPort field 1502
auditing targets 1549
MTAs 61, 218, 1496, 1498, 1501
authentication 1537
configuring 1504
deleting 1558
MX records 217, 1500
differential scans 1571
encrypting passwords 1541
N excluding items or repositories 1542
Napatech 1484 filtering by item size 1545
Napatech cards filtering by last-accessed date 1545
configuring Network Monitor to use 1492 filtering by modified date 1545
Network Discover grid scanning 1573
how scanners work 1660 including items or repositories 1542
incident reports 1331 inventory scans 1549
quarantine files 1619 list of targets 1553
Network Discover Server managing 1553
configuration, basic 221 monitoring 1553
 Index 1968

Network Discover/Cloud Storage Discover scans Network Prevent for Web (continued)
(continued) troubleshooting 1519
optimizing 1548, 1565 Network Prevent for Web Server
parallel 1571 configuring 219
removing targets 1555 Network Protect
reporting 1553 ICE 1619
reporting scan details 1559 introducing 63
reporting scan history 1556 quarantine files 1619
scheduling 1535 Symantec Information Centric Encryption 1619
status 1564 Network Protect server
throttling 1548 configuration, basic 221
Network Discover/Cloud Storage Discover Server network share monitoring 1742
configuring 1527 network taps 1481, 1484
configuring parallel scans 1571 new_oracle_password parameter 323
Network Discover/Cloud Storage Discover targets Next MTA field 1501
removing 1555 NIC 1482, 1484
network interface card. See NIC
Network Monitor O
configuring 1492
OCSP revocation checks
creating policies for 1494
configuring 137
implementing 1481, 1483
configuring a proxy for 136
introducing 61
disabling 137
logging 300
support for 133
requirements for 1481
OneDrive 199
testing 1494–1495
Online Certificate Status Protocol. See OCSP
using Endace cards with 1492
revocation checks
Network Monitor Server
operational log files 293
configuring 214
Oracle database
Network Prevent (Email)
NLS_LANGUAGE setting 80
bouncing messages 1286
NLS_TERRITORY setting 80
Network Prevent for Email
oracle_create_user.sql script 195
blocking email 1505
Overview screen
configuring 1498
detection server, adding 234
creating policies for 1505
enabling policy violation headers 1507
implementing 1496, 1498 P
integrating MTAs with 1498 packet capture software 1482, 1484
introducing 61 installing 1485
logging 300 PACKET_MMAP software 1485
routing restricted ports to 1503 partial content matching 531
testing 1508 Password authentication
Network Prevent for Email Server disabling 139
configuring 216 enabling or disabling 127
Network Prevent for Web Password Renewal window 72
configuring 1511 password_file parameter 323
creating policies for 1517 passwords 323
implementing 1509–1510 See also DBPasswordChanger utility
introducing 61 Administrator 69, 109
testing 1519 changing 70, 72, 323
 Index 1969

passwords (continued) policy detection (continued)

encrypting for Network Discover/Cloud Storage similarity score 582
Discover scans 1541 technologies 347
resetting 109 using VML as an exception 588
pcapstart.reg file 1486 Vector Machine Learning (VML) 564
plug-ins policy detection template, configuration
deploying on the endpoint 1915 Yahoo Message Board 1193
Plugins.properties file 1586 policy detection templates, configuration
policies Caldicott Report 1085
about 327 CAN-SPAM Act 1087
add 375 Canadian Social Insurance Numbers 1086
adding response rules 405 Colombian Personal Data Protection Law
components 329 1581 1088
configuration 376 Common Spyware Upload Sites 1088
create 395 Competitor Communications 1089
Data Profiles 334 Credit Card Numbers 1090
deployment 332 Customer Data Protection 1091
manage 395 Data Protection Act 1998 1092
privileges, administration 334 Defense Message System (DMS) GENSER
privileges, authoring 334 Classification 1096
privileges, response rules 334 Design Documents 1097
removing 406 Employee Data Protection 1098
solution pack 331 Encrypted Data 1099
policies, about EU Data Protection Directives 1094
implementation 337 Export Administration Regulations (EAR) 1100
User Groups 335 FACTA 2003 (Red Flag Rules) 1101
policy Financial Information 1105
clone 403 Forbidden Websites 1105
export 402 Gambling 1106
about 402 Gramm-Leach-Bliley 1150
import 400 Human Rights Act 1998 1156
about 400 Illegal Drugs 1157
references 401 Individual Taxpayer Identification Numbers
policy conditions (ITIN) 1157
Content Matches data identifier 628 International Traffic in Arms Regulations
policy detection (ITAR) 1158
endpoint 727 Media Files 1159
endpoint application 728 Merger and Acquisition Agreements 1160
endpoint events 342 NASD Rule 2711 and NYSE Rules 351 and
endpoint protocol 727 472 1161
file contents 341 NASD Rule 3010 and NYSE Rule 342 1163
file properties 341 NERC Security Guidelines for Electric
identifiable file format types 761 Utilities 1164
identities 342 Network Diagrams 1165
international languages 706 Network Security 1166
introduction 340 Offensive Language 1166
languages 342 Office of Foreign Assets Control (OFAC) 1167
network 341 OMB Memo 06-16 and FIPS 199
rule severity 333 Regulations 1168
 Index 1970

policy detection templates, configuration (continued) policy detection, described identities

Password Files 1170 about 737
Payment Card Industry (PCI) Data Security Sender/User Matches Pattern 739
Standards 1170 policy detection, EDM token matching
PIPEDA 1172 implementing 453
Price Information 1174 policy detection, endpoint
Project Data 1174 devices, about 729
Proprietary Media Files 1174 devices, adding 734
Publishing Documents 1175 devices, configuring 734
Racist Language 1176 Endpoint Device Class or ID 733
Restricted Files 1176 Endpoint Location 732
Restricted Recipients 1176 locations, about 729
Resumes 1177 Protocol or Endpoint Monitoring 730
Sarbanes-Oxley 1177 policy detection, international
SEC Fair Disclosure Regulation 1180 data identifiers 708
Sexually Explicit Language 1182 find keywords 708
Source Code 1183 policy detection, keyword matching
SWIFT Codes 1187 exmaples 689
Symantec DLP Awareness and Avoidance 1187 implementing 686
UK Drivers License Numbers 1188 wildcards, about support for 686
UK Electoral Roll Numbers 1188 policy detection, keyword matching, configuration
UK National Health Service (NHS) Number 1189 Content Matches Keyword 692
UK National Insurance Numbers 1189 policy detection, keyword proximity
UK Passport Numbers 1189 about 688
UK Tax ID Numbers 1190 policy detection, regular expressions
US Intelligence Control Markings (CAPCO) and common engine 701
DCID 1/7 1190 Content Matches Regular Expression 702
US Social Security Numbers 1191 implementing 700
Violence and Weapons 1192 writing 701
Webmail 1192 policy exceptions
policy detection, add 387
endpoint destination 728 compound 392
policy detection, about configure 389
EDM token matching 453 policy exceptions, configure
keyword matching 686 match counting 384
policy detection, conditions policy groups
Content Matches Keyword 692 about 331
Content Matches Regular Expression 702 create 399
Endpoint Device Class or ID 733 default policy group 331
Endpoint Location 732 deployment 332
Protocol or Endpoint Monitoring 730 managing 398
Recipient matches User Group based on a modify 399
Directory Server Group 752 removing 406
Sender/User Matches Pattern 739 policy match conditions
Sender/User matches User Group based on a compound 356
Directory Server Group 751 content 350
policy detection, configuration content based on index 350
select message components to match on 386 cross-component matching 354
endpoint 352
 Index 1971

policy match conditions (continued) policy testing

exceptions 355 attachment 582
file properties 351 test corpus 582
identities and groups 353 policy violation headers 1506
message components 354 enabling 1507
network 352 print/fax 1741
server execution logic 357 processGets field 1517
simple 356 product suite. See Symantec Data Loss Prevention
two-tier detection 358 profile tuning
types 349 how to 582
policy rules similarity threshold 582
compound 392 properies
policy rules, conditions default similarity threshold 583
configure 380 properties
policy rules, configuration minimum number of documents per training
rule severity 383 set 583
policy rules, configure minimum number of features to keep 583
match counting 384 significance of features threshold 583
policy rules, detection proxy servers 1509
add 378 configuring 1514–1516
policy rules, group
add 378 Q
policy templates
quarantine files 1619
add 375
Confidential Documents 1089
create policy from 360 R
Customer and Employee Data Protection 366 reflecting mode 1498
export 336, 405 remediation 1294
General Data Protection Regulation 365 Box cloud storage
HIPAA and HITECH (including PHI) 1152 add visual tag 1599
import 336, 404 quarantine 1599
International Regulatory Enforcement 366 commands 1298
State Data Privacy 1184 email response variables 1300
system-defined 330 Remote EDM Indexer utility
US Regulatory Enforcement 363 command-line options for 496
policy templates, configure creating EDM profile with 487
Exact Data Profile, select 371 installation, Linux 500
Indexed Document Profile, select 373 installation, windows 499
policy templates, international installing 486
about 707 introducing 322
policy templates, type requirements for using 485
Confidential or Classified Data Protection 368 running 485, 487, 493
Network Security Enforcement 369 troubleshooting 498
Yahoo and MSN Messengers on Port 80 1194 uninstalling, Linux 500
policy templates, types uninstalling, windows 499
Acceptable Use Enforcement 369 Reporting API 1374
Columbia Personal Data Regulatory Reporting API privileges 101
Enforcement 371 reports 1314, 1352
dashboards 1356
 Index 1972

reports (continued) response rules, actions (continued)

incidents 1354 discarding network incident data 1241
list of options 1381 Encrypt Data-at-Rest 1257
summaries 1361 Encrypt Data-in-Motion 1266
system events 150 Endpoint Discover: Quarantine File 1270
REQMOD 1514–1515 Endpoint Prevent Block 1272
RequestProcdessor settings 1507 Endpoint Prevent Encrypt 1275
RequestProcessor fields 1502, 1504, 1507 Endpoint Prevent Notify, configuration 1279
RESPMOD 1514–1515 Endpoint Prevent User Cancel,
response filtering 1513 configurations 1282
response rules 1308 Endpoint: FlexResponse 1269
about 1199 Limit Incident Data Retention 1239
add 1219 Log to a Syslog Server 1242
best practices 1217 Network Prevent Block FTP Request 1285
composing email responses 1298 Network Prevent Block HTTP/S 1285
configure 1221 Network Prevent: Block SMTP Message 1286
manage 1219 Network Prevent: Modify SMTP Message 1287
modify ordering 1227 Network Prevent: Remove HTTP/HTTPS
response rules, about Content 1288
actions 1199 Network Protect Copy File 1290
authoring privileges 1215 Network Protect Encrypt File, configuration 1292
automated 1209 Network Protect Quarantine File,
conditions 1210 configuration 1290
execution 1208 Perform DRM on Data-at-Rest 1257
execution priority for actions 1211 Perform DRM on Data-in-Motion 1267
implementation 1216 Prevent download, copy, print 1260
removing 1227 Quarantine (Smart Response) 1253
Smart 1209 Quarantine Data-at-Rest 1258
Smart, configure 1222 Quarantine Data-in-Motion 1268
response rules, action Redact Data-in-Motion 1268
Add two-factor authentication 1264 retaining endpoint incident data 1240
Remove Collaborator Access 1260 Send Email Notification 1243
Set Collaborator Access to 'Edit' 1261 Set Attribute 1246
Set Collaborator Access to 'Preview' 1261 Set Status 1247
Set Collaborator Access to 'Read' 1262 Tag Data-at-Rest 1259
Set File Access to 'All Read' 1262 response rules, adding
Set File Access to 'Internal Edit' 1263 Automated 1220
Set File Access to 'Internal Read' 1264 Smart 1220
response rules, actions response rules, conditions
Add Note 1239 configure 1222
Block Data-in-Motion 1265 endpoint device 1230
Break Links in Data-at-Rest 1254 endpoint location 1229
Classify Enterprise Vault Content 1247 incident match count 1232
Cloud Storage: Add Visual Tag 1252 incident type 1231
Cloud Storage: Quarantine 1252 protocol or endpoint monitoring 1233
configure 1223 severity 1235
Custom Action on Data-at-Rest 1255 response rules, type
Custom Action on Data-in-Motion 1265 Endpoint Prevent Block 1749
Delete Data-at-Rest 1256 Endpoint Prevent Notify 1749
 Index 1973

response rules, type (continued) servers (DLP). See detection servers and Enforce
Endpoint Prevent User Cancel 1750 Server
Endpoint Quarantine 1763 ServerSocketPort field 1502
response rules, types Service_Shutdown.exe tool 1926
all detection servers 1200 Service_Shutdown.exe utility 322
Cloud Applications and API appliance 1204 SharePoint targets 1636
Cloud Service Connector 1204 Single Tier Monitor 234
Cloud Storage 1204 configuration, basic 223
Data-at-Rest (DAR) 1204 sizing, profiles
Data-in-Motion (DIM) 1204 memory allocation 591
endpoint 1201 significance threshold 591
network 1202 sizing, training sets
network protect 1203 minimum 50 590
restricted ports 1502–1503 recommended 250 590
Retention categories 1250 SMTP 1505
Revocation checks snapshots 1314
configuring 135 SOAP messages 296
support for 133 SPAN 1481, 1484
roles SQL 322
add 110 SQL Preindexer utility
adding 98 command-line options for 494
configuring 98 introducing 322
manage 110 troubleshooting 497
roles, about SQL scripts 195
configuring 94 SSL certificates
recommended 95 importing 238
role-based access control 93 sslkeytool utility
solution pack, included with 96 introducing 322
RRC. See rules results caching status attributes 1410
rules results caching 1747 status groups
adding 1413
S configuring 1413
deleting 1413
scans
status values
differential scans 1568
adding 1412
incremental scans 1568–1569
configuring 1412
Securelets 199
deleting 1412
Server Detail screen
summary reports 1314
server configuration 213
Switch Port Analyzer. See SPAN
Server FlexResponse
Symantec CloudSOC 199
configuring 1245, 1586, 1588
Symantec Data Loss Prevention
configuring a response rule action with 1245
administration of 65
configuring custom properties for 1588
initial system setup 68
deploying a plug-in for 1586, 1588
product suite 58
overview of 1583
Symantec Data Loss Prevention servers. See
remediating with 1585, 1592–1593
detection servers and Enforce Server
troubleshooting 1594
Symantec DLP Agent
Using a smart response action with 1592
administration 1862
Server/Detector Detail screen 243
agent store 1800
 Index 1974

Symantec DLP Agent (continued) training set

removing 1888 negative 589
removing manually 1890 positive 589
removing on Windows Vista 1890 trial mode 217, 1498, 1511
removing with system management software troubleshooting
(SMS) 1888, 1890 debug log files 586
Symantec DLP services property configuration 583
starting 89–91 training set quality 592
stopping 89–91
syslog servers 159 U
system alerts
unhide
about 160
hidden incidents 1407
adding 162
uninstalling 1920
configuring server 161
unmanaged users 201
modifying 162
upgrades, system 207
system events 149
user agents 1512
code numbers 164
User Groups
event details 154
creation 748
notification methods 150
user risk 1421
reports 150
user data sources 1423
reports, filtering 151
adding 1425
reports, saved 153
adding from a file 1425
responses 157
adding from Active Directory 1426
syslog servers 159
defining custom attributes 1424
thresholds, configuring 155
user details 1432
types (severities) of 155
User identification 1429
System Overview screen 239
user list 1431
errors and warning list 243
user risk summary 1432
server status 241
users
system reports
add 110
scheduling 1369
manage 110
system setup, initial 68
users, about
system upgrades 207
configuring 94
users, accounts
T adding 105
tagging. See Information Centric Tagging configuring 105
TagHighestSeverity field 1507 users, authentication
TagPolicyCount field 1507 Active Directory 121
TagScore field 1507 integrating Enforce with Active Directory 122
telnet command 1504 verifying the Active Directory connection 124
TLS proxies 217, 1503 users, managed and unmanaged 201
Tomcat users, passwords
adding certificates to 129 configuring strong or rotating 108
changing trust store password for 130 utilities
tools password 1918 introducing 321–322
training Utility, ICE 201
cross-fold 592 errors for 201
k-fold evaluation process 592
 Index 1975

V
Vector Machine Learning (VML)
about 564
accepting training 566
adjust similarity threshold 581
adjusting memory allocation 575
configuring VML exceptions 580
configuring VML rules 579
creating new VML profiles 569
Currernt Profile tab 570
editing profile name, description 579
implementation process 568
manage training sets 576
manage VML profiles 577
rejecting training 566
similarity score 567
similarity threshold 567
Temporary Workspace tab 570
training content 565
training the profile 572
uploading contents for training 571
violated policies 1506
VIP Access 201
Vontu services
starting 86–91
stopping 86–91
vontu_sqlite3.exe tool 1927
vontu_sqlite3.exe utility 322

W
Web archives 1414
Web Services 101
WinPcap software 1484–1485
installing 1485

X
X-CFilter-Loop: Reflected header 1502
X-DLP-Max-Severity header 1507
X-DLP-Policy-Count header 1507
X-DLP-Score header 1508